NIST and DOE still not distinguishing between IT and ICS

Nov. 15, 2011

A message from Joe Weiss:

September 2011, DOE published the Electricity Sector Cybersecurity Risk Management Process Guideline for comment. The document draws from a significant number of experts, though none are industrial control systems (ICS) experts. The document effectively equates IT and ICS. It references IEC-62443 which is still not a formal document and excludes any mention of ISA99.

A message from Joe Weiss:

September 2011, DOE published the Electricity Sector Cybersecurity Risk Management Process Guideline for comment. The document draws from a significant number of experts, though none are industrial control systems (ICS) experts. The document effectively equates IT and ICS. It references IEC-62443 which is still not a formal document and excludes any mention of ISA99.

Meanwhile NIST recently published their National Initiative for Cyber Security Education (NICE) Cybersecurity Workforce Framework. The document states: "Consequently, with the exception of select critical support roles that allow cybersecurity professionals to effectively do their work, we did not include occupational specialties related to acquisition, physical security, oversight of critical infrastructure, electrical engineering, and so forth." This can create, or at least exacerbate, the training and cultural issues that currently divide IT Security and Operations. 

NIST and DOE need to address the unique aspects of industrial control systems as identified in NIST SP80-82. Moreover, NIST SP800-82 needs to be updated to address newer threats to ICSs including threats such as Stuxnet.

Sponsored Recommendations

Measurement instrumentation for improving hydrogen storage and transport

Hydrogen provides a decarbonization opportunity. Learn more about maximizing the potential of hydrogen.

Get Hands-On Training in Emerson's Interactive Plant Environment

Enhance the training experience and increase retention by training hands-on in Emerson's Interactive Plant Environment. Build skills here so you have them where and when it matters...

Learn About: Micro Motion™ 4700 Config I/O Coriolis Transmitter

An Advanced Transmitter that Expands Connectivity

Learn about: Micro Motion G-Series Coriolis Flow and Density Meters

The Micro Motion G-Series is designed to help you access the benefits of Coriolis technology even when available space is limited.