Last updated: 10-23-2014
Industrial Control Systems (ICS) are physical equipment oriented technologies and systems that deal with the actual running of plants and equipment, include devices that ensure physical system integrity and meet technical constraints, and are event-driven and frequently real-time software applications or devices with embedded software. These types of specialized systems are pervasive throughout the infrastructure and are required to meet numerous and often conflicting safety, performance, security, reliability, and operational requirements. ICSs range from building environmental controls (HVAC, lighting), to systems such as the electrical power grid. With the increasing interconnectivity of ICS to the internet, the ICS can be an entry point into the organization's other IT systems.
Within the controls systems industry, ICS systems are often referred to as Operational Technology (OT) systems. Historically, the majority of OT systems were proprietary, analog, vendor supported, and were not internet protocol (IP) enabled. Systems key components, such as Remote Terminal Units (RTUs), Programmable Logic Controllers (PLCs), Physical Access Control Systems (PACs), Intrusion Detection Systems (IDSs), closed circuit television (CCTV), fire alarm systems, and utility meters have become digital and IP enabled. OT systems use Human Machine Interfaces (HMIs) to monitor the processes, versus Graphical User Interfaces for IT systems. Most current ICS systems and subsystems are now a combination of Operational Technologies (OT) and Information Technologies (IT).
The Stuxnet, Duqu, Flame and Shamoon malware were specifically designed to target ICS and cause physical damage to the processes or equipment. Stuxnet "spoofed" the integrity of the uranium centrifuges and caused the centrifuges to overspin and self-destruct, while the operators console showed the system was operating within normal parameters. The Duqu malware looks for information that could be useful in attacking industrial control systems. Its purpose is not to be destructive; the known components are trying to gather information. The Flame malware looks for engineering drawings, specifications, and other technical details about the systems and records audio, screenshots, keyboard activity, and network traffic. The program also records Skype conversations and can turn infected computers into Bluetooth beacons which attempt to download contact information from nearby Bluetooth-enabled devices. The most recent malware attack, Shamoon, destroyed over 30,000 Saudi Armco work stations. Shamoon is capable of spreading to other computers on the network, through exploitation of shared hard drives. Once a system is infected, the virus continues to compile a list of files from specific locations on the system, erase and then send information about these files back to the attacker. Finally, the virus will overwrite the master boot record of the system to prevent it from booting as shown in Figure 1.
Figure 1: The Shamoon malware has the ability to overwrite the master boot record of a computer. Image credit: Securelist
In February 2013, Executive Order Improving Critical Infrastructure Cybersecurity was issued which requires the National Institute of Standards and Technology (NIST) to "lead the development of a framework to reduce cyber risks to critical infrastructure (the "Cybersecurity Framework"). The Cybersecurity Framework shall include a set of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks. The Cybersecurity Framework shall incorporate voluntary consensus standards and industry best practices to the fullest extent possible.
While federal agencies have been required to meet stringent Cybersecurity standards for the traditional IT systems since the Federal Information Security Management Act (FISMA) was passed in 2002, the same level of protection and analysis is just beginning to be developed for building control systems. Buildings are becoming increasingly reliant on technologies that allow centralized monitoring and control of multiple building systems ( Building Automation, Fire and Life Safety, Energy Management, Physical Security, Access Control, etc.), to assist in accomplishing design and operational goals. Because of the unique operating and configuration of building control systems, traditional IT processes such as continuous monitoring, host based scanning, and automated patch management can cause building control systems to fail or become non-operational.
This section will provide an overview of the current efforts underway with regards to policy, standards, guides, and tools to assist building owners and operators, designers, and constructors meet the Cybersecurity challenges.
Industrial Control Systems and Operational Technology
Within the controls systems industry, Industrial Control Systems (ICS) are often referred to as Operational Technology (OT). ICS are physical equipment oriented technologies and systems that deal with the actual running of plants and equipment, include devices that ensure physical system integrity and meet technical constraints, and are event-driven and frequently real-time software applications or devices with embedded software. These types of specialized systems are pervasive throughout the infrastructure and are required to meet numerous and often conflicting safety, performance, security, reliability, and operational requirements. NIST SP 800-53 Rev. 3 Appendix I defines ICS as:
"information systems that differ significantly from traditional administrative, mission support, and scientific data processing information systems. ICS typically have many unique characteristics—including a need for real-time response and extremely high availability, predictability, and reliability. These types of specialized systems are pervasive throughout the critical infrastructure, often being required to meet several and often conflicting safety, operational, performance, reliability, and security requirements such as: (i) minimizing risk to the health and safety of the public; (ii) preventing serious damage to the environment; (iii) preventing serious production stoppages or slowdowns that result in negative impact to the Nation's economy and ability to carry out critical functions; (iv) protecting the critical infrastructure from cyber attacks and common human error; and (v) safeguarding against the compromise of proprietary information."
The term ICS is used in its broadest sense which includes:
- Supervisory Control and Data Acquisition (Energy, Water, Wastewater, Pipeline, Airfield Lighting, Locks, and Dams, etc.)
- Distributed Control Systems (Process and Manufacturing, etc.)
- Building Control Systems/Building Automation Systems
- Utility Management Control Systems
- Electronic Security Systems
- Fire, Life Safety, Emergency Management Systems
- Exterior Lighting and Messaging Systems
- Intelligent Transportation Systems
Within the Department of Defense, there are over 30 unique types of ICS as shown in Figure 2. There are an estimated 2.5 million unique ICS systems that are used in over 300,000 buildings and over 250,000 linear structures.
Figure 2: Examples of DoD OT and ICS Systems and Subsystems1
The majority of these systems were historically proprietary, analog, vendor supported, and used direct serial, and/or wireless connection, and were not IP enabled. The systems components such as Remote Terminal Units, Programmable Logic Controllers, Physical Access Control, Intrusion Detection Systems, CCTV, fire alarm systems, and utility meters have long equipment life spans, and are typically designated as Operational Technology (OT) and Real Property Equipment.
ICSs differ significantly from traditional administrative, mission support and scientific data processing information systems, and use specialized software, hardware and protocols. ICS systems are often integrated with mainstream organizational information systems to promote connectivity, efficiency, and remote access capabilities. The "front end" portions of these ICSs resemble traditional information systems in that they use the same commercially available hardware and software components. While the majority of an ICS system still does not resemble a traditional information system (IS), the integration of the ICS's "front end" with IS introduces some of the same vulnerabilities that exist in current networked information systems.
As these systems and components became digital and IP enabled, the interconnects to the organization network and business systems began to expose the organization to exploits and significant vulnerabilities. Typically, there was not a clear line of demarcation where one system started and one ended, for example a EMCS meter could be on the utility SCADA system, or on the buildings BAS. A comparison of IT versus OT systems is provided in the table below:
Table 1—IT vs. OT Systems Comparison
|Information Technology||Operational Technology|
|Purpose||Process transactions, provide information||Control or monitor physical processes and equipment|
|Architecture||Enterprise wide infrastructure and applications (generic)||Event-driven, real-time, embedded hardware and software (custom)|
|Interfaces||GUI, Web browser, terminal and keyboard||Electromechanical, sensors, actuators, coded displays, hand-held devices|
|Ownership||CIO and IT||Engineers, technicians, operators and managers|
|Connectivity||Corporate network, IP-based||Control networks, hard wired twisted pair and IP-based|
|Role||Supports people||Controls machines|
ICSs can have long life spans (in excess of 20 years) and be comprised of technology that while functional, do not have the same technology refresh cycle as the IT. This introduces two issues: first, depending upon the relative age and isolation of the system, there may not be a patch or upgrade path for components of the system, and second, attempting to patch the component or employing modern scanning methods might disrupt the system. ICSs have experienced complete system shutdown when an intrusion detection system (IDS) or host-based scanning system (HBSS) scan is performed on an otherwise operational ICS. For an ICS, updates should be delayed until after a thorough analysis of deployment impact has been completed. This might stretch out security update timeliness and require flexibility in security control compliance measurement and enforcement.
An ICS physical system can span many miles; for example, locks and dams, pipelines, electric transmission and distribution systems can have many non-contiguous components, and there are a number of protocols commonly used by ICSs to allow the devices to communicate both horizontally and vertically. A building use could use a number of protocols at the same time. Typical building protocols are:
- DNP 3
These protocols were developed initially to ensure availability and reliability, and able to communicate down to the device level with small data transmission and verification. Many devices have embedded firmware with default passwords. The protocol organizations and vendors are now working to add additional security features on new systems while working on securing legacy systems.
Communications Network and Business Systems
The Communications Network and Business Systems include the Demarcation or Point of Entry where the external communications connect with the buildings internal network and include voice, data, video and multimedia information services, such as video conferencing and email. Typically the business systems are on a separate fiber high-speed backbone.
Building Management System (BMS)
The Building Management System provides automatic monitoring, interaction and management for electricity, ventilation, water supply, security and fire control to the building. A BMS typically manages the: Building Automation System (BAS), Electronic Security System (ESS), and the Fire and Life Safety System (FLS). For larger buildings and campuses, there will usually be a Building Operations Center (BOC), Security Operations Center (SOC), or Emergency Operations Center (EOC) that has engineering, O&M, security or emergency management personnel monitoring the BMS. In smaller buildings, there may only be a workstation and panels that alarm and report to an off-site BOC, SOC, or EOC.
Building Automation System (BAS)/Building Control System (BCS)
A building automation system (BAS) or Building Control Systems (BCS) is an example of a distributed control system. The control system is a computerized, intelligent network of electronic devices designed to monitor and control the mechanical, electronic, and lighting systems in a building. A building controlled by a BAS is often referred to as an Intelligent Building or a Smart Building.2
BAS core functionality keeps the building climate within a specified range, provides lighting based on an occupancy schedule, monitors system performance and device failures, and provides malfunction alarms (via email and/or text notifications) to building engineering/maintenance staff. The BAS functionality reduces building energy and maintenance costs when compared to a non-controlled building. The BAS typically consists of:
- Fire and Life and Safety (FLS)
- Physical Security and Access Control (PACS)
- Energy Management Systems (EMS), which includes Lighting Control
- Heating, Ventilation and Air Conditioning (HVAC)
A typical BAS architecture with multiple protocols is shown in Figure 3.
Figure 3: Typical BAS Architecture
Electronic Security System (ESSS)
The Electronic Security System (ESS) is critical for providing a secure environment and protecting the safety of tenants. Elements include: Anti-theft Security and Alarm System, Electronic Control System, Physical Access Control System, Closed-Circuit TV Surveillance System. The ESS is typically monitored by security personnel in the SOC.
Fire and Life Safety System (FLS)
The Fire and Life Safety (FLS) system consists of the fire alarms, sensors, sprinklers, smoke purge, and exhaust fans, and is often connected to the BAS to shutdown HVAC, elevators, and other equipment. The FLS typically connects to the local fire department and alarms in the SOC and BOC. Traditionally, these systems were in separate conduits and cabling went from the control panel to the devices.
Power over Ethernet
A new technology, Power over Ethernet (PoE)3, is changing the traditional cabling process and operations of the BMS. PoE describes any of several standardized or ad-hoc systems which pass electrical power along with data on Ethernet cabling. This allows a single cable to provide both data connection and electrical power to devices such as network hubs or closed-circuit TV cameras. Unlike standards such as Universal Serial Bus which also power devices over the data cables, PoE allows long cable lengths. Power may be carried on the same conductors as the data, or it may be carried on spare pairs of the cable. A BAS with PoE is shown in Figure 4.
Figure 4: A BAS using Power over Ethernet (Contemporary Controls4)
There are a number of new PoE devices and systems that are entering the market and addressing the cybersecurity of these systems will be a challenge. When legacy systems are being modernized and/or upgraded with PoE, understanding the network connections and ripple effects of loss of communications or power must be carefully analyzed as part of the Contingency Plan and Disaster Recovery/Business Continuity Plan.
Smart Buildings/Intelligent Buildings
A Smart Building or Intelligent Building project generally covers three key elements.5
- Communications Network and Office Automation
- Building Management System
- Integrated Services Infrastructure
The GSA Public Building Service (PBS) has been an active leader in the development of Smart Buildings. In March 2011, the PBS issued the Technology Policy for PBS-Owned Building Monitoring and Control Systems memo, with the objective to "converge the building's Monitoring and Control (M&C) systems infrastructure to enable smarter and more efficient operations." The GSA Smart Building concept is shown in Figure 5.
Figure 5: GSA Smart Buildings Concept
The GSA Smart Buildings effort had three broad objectives:
Open Communication Protocols—Non-proprietary building controls that give GSA greater building management flexibility and reduce service costs
Converged Control Systems Networks (IT backbone)—Elimination of unnecessarily redundant controls infrastructure such as conduit, cables, switches, and UPS's that will then allow interoperability and security compliance
Normalized Data for Systems Communications—Different controls manufacturers or even disparate systems can "talk" to each other allowing for data collection and analysis and more flexibility and management control
The resulting efforts are the convergence of the IT and OT into a new hybrid where the CIO provides the switches, routers and firewalls as Government Furnished Equipment (GFE), and all the building monitoring and control systems plug into the CIO fiber backbone in the distribution closet, as shown in Figure 6.
Figure 6: Converged Building M&C Connected in the Distribution Closet
While the GSA Smart Buildings model may work for many organizations, many others may not want to have the ESS or FLS running on the same fiber as the BAS. The redundancy and operational impact of converged systems is still a relatively new area.
To help evaluate system interdependencies, GSA has developed the Sustainable Facilities Tool. A sustainable building can operate more efficiently and cost less when the impacts of systems on each other are considered. The system bundling section can be leveraged to further understand whole building synergies and explore examples for ideas on what technologies might best be bundled together.
Achieving the design and operational performance requires a substantial change in mindset and training across multiple disciplines, changes in acquisition and contract language, and changes in the buildings operations and maintenance. GSA has developed a revised delivery process and is in the process of updating the Public Building Services Facilities Standard 100. The new process is shown in Figure 7.
Figure 7: GSA Smart Buildings Life Cycle Approach
Smart buildings are now becoming the norm across the country, and as the buildings get ever smarter and interconnected with Smart Cars, Smart Cities, etc., they become vulnerable to outside attack and malware. As the IT and OT systems continue to converge, the need for new Cybersecurity skills and training for the facilities workforce will need to be developed.
Cyber-Physical Systems and the Critical Infrastructure Cybersecurity Framework
An emerging classification developed by the National Science Foundation and NIST is to classify the hybrid IT and OT as Cyber-Physical Systems (CPS). CPS are defined as integrated, hybrid networks of cyber and engineered physical elements; co-designed and co-engineered to create adaptive and predictive systems, and respond in real time to enhance performance.6 CPS reflect the advances in technology, similar to the shift that occurred going from the Industrial Revolution/Physical Systems to the Internet Revolution/Cyber Systems, and now transitioning to Industrial Internet Revolution/Cyber Physical Systems as shown in Figures 8 and 9.
Figure 8: CPS Timeline Context7
CPS are enabling a new generation of 'smart systems'. NIST has taken an active role and lead in defining the CPS and has held several workshops, resulting in several publications in early 2013:
- National Institute of Standards and Technology (NIST) Executive Roundtable on Cyber-physical Systems
- National Institute of Standards and Technology (NIST) Executive Roundtable on Cyber-physical Innovation
- National Institute of Standards and Technology (NIST) Executive Roundtable on Cyber-physical Systems Strategic R&D
- National Institute of Standards and Technology (NIST) Industrial Internet Workshop, The Industrial Internet and Cyber-Physical Systems: A Government Perspective
Essential CPS characteristics include8:
- Cyber, engineered, and human elements as treated as integral components of a total system to create synergy and enable desired, emergent properties
- Integration of deep physics-based and digital world models provides learning and predictive capabilities for decision support (e.g., diagnostics, prognostics) and autonomous function
- Systems engineering-based open architecture and standards provide for modularity and composability for customization, systems of products, and complex or dynamic applications
- Reciprocal feedback loops between computational and distributed sensing/actuation and monitoring/control elements enables adaptive multi-objective performance
- Networked cyber components provide a basis for scalability, complexity management, and resilience
Figure 9: CPS Common Core Context9
A comparison of the CPS systems and impacts across various sectors are provided in Table 2.
Table 2—Cyber-Physical Sector Context10
|Innovative Products or Applications||Cyber-Physical Systems||Impacts|
|Smart Manufacturing and Production|
|Agile manufacturing||Intelligent controls||Enhanced global competitiveness|
|Supply chain connectivity||Process and assembly automation||U.S.-based high tech manufacturing|
|Robotics working safely with humans||Greater efficiency, agility, and reliability|
|Transportation and Mobility|
|Autonomous or smart vehicles (surface, air, water, and space)||Drive by wire vehicle systems||Accident prevention and congestion reduction (zero-fatality highways)|
|Vehicle-to-vehicle and vehicle-to-infrastructure communication||Plug ins and smart cars||Greater safety and convenience of travel|
|Interactive traffic control systems|
|Next-generation air transport control|
|Electricity systems||Smart electric power grid||Greater reliability, security, and diversity of energy supply|
|Renewable energy supply||Plug-in vehicle charging systems||Increased energy efficiency|
|Oil and gas production||Smart oil and gas distribution grid|
|Bridges and dams||Active monitoring and control system||More safe, secure, and reliable infrastructure|
|Municipal water and wastewater treatment||Smart grids for water and wastewater||Assurance of water quality and supply|
|Early warning systems||Accident warning and prevention|
|Medical devices||Wireless body area networks||Improved outcomes and quality of life|
|Personal care equipment||Assistive healthcare systems||Cost-effective healthcare|
|Disease diagnosis and prevention||Wearable sensors and implantable devices||Timely disease diagnosis and prevention|
|Buildings and Structures|
|High performance residential and commercial buildings||Whole building controls||Increased building efficiency, comfort and convenience|
|Net-zero energy buildings||Smart HVAC equipment||Improved occupant health and safety|
|Appliances||Building automation systems||Control of indoor air quality|
|Networked appliance systems|
|Soldier equipment||Smart (precision-guided) weapons||Increased warfighter effectiveness, security, and agility|
|Weapons and weapons platforms||Wearable computing/sensing uniforms|
|Supply equipment||Intelligent, unmanned vehicles||Decreased exposure for human warfighters and greater capability for remote warfare|
|Autonomous and smart underwater sensors||Supply chain and logistics systems|
|First responder equipment||Detection and surveillance systems||Increased emergency responder effectiveness, safety, efficiency, and agility|
|Communications equipment||Resilient communications networks||Rapid ability to respond to natural and other disasters|
|Fire-fighting equipment||Integrated emergency response systems|
NIST has developed a reference architecture shown in Figure 10 that:
Figure 10: CPS Reference Architecture
- Provides a common lexicon and taxonomy that can apply across CPS
- Shows a common architectural vision to help facilitate interoperability between components and systems
- Enables creation of reusable CPS components and tools to measure and evaluate their performance
- Promotes communication across diverse stakeholder community
- Provides a common lexicon and taxonomy that can apply across CPS
- Shows a common architectural vision to help facilitate interoperability between components and systems
- Enables creation of reusable CPS components and tools to measure and evaluate their performance
- Promotes communication across diverse stakeholder community
The use of the CPS terminology and reference architecture will continue to be an evolving area.
National Institute of Standards and Technology Computer Security Resource Center
The NIST Computer Security Division, Computer Security Resource Center is where the standards and publications are maintained. NIST 800-53 Recommended Security Controls for Federal Information Systems and Organizations, and NIST 800-82 Guide to Industrial Control Systems (ICS) Security are used by most federal agencies as the baseline to evaluate their systems. Both publications were updated and published in spring 2013.
The STUXNET, FLAME, and other cyber attacks have shown how vulnerable the nation's ICS are. As the Smart Grid develops, enhanced security controls are being developed by NIST, to include the NISTIR 7628 Guidelines for Smart Grid Cyber Security, and the NIST Framework and Roadmap for Smart Grid Interoperability Standard, Release 2.0. Buildings that have Advanced Smart Metering and other web or wireless connections to the system should be secured and tested to ensure vulnerabilities are mitigated and risks minimized.
Department of Homeland Security ICS-CERT
The Department of Homeland Security Control Systems Security Program is part of the United States Computer Emergency Readiness Team (US-CERT) and provides tools, standards, training, and publications for ICS.
The Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) works to reduce risks within and across all critical infrastructure sectors by partnering with law enforcement agencies and the intelligence community and coordinating efforts among Federal, state, local, and tribal governments and control systems owners, operators, and vendors. Additionally, ICS-CERT collaborates with international and private sector Computer Emergency Response Teams (CERTs) to share control systems-related security incidents and mitigation measures.
Similar to the advancement of the number of malicious malware and hacking of traditional IT systems, critical infrastructure (CI) is now a primary target and the number of ICS-CERT reported incidents is exponentially increasing.
Figure 11: ICS Vulnerabilities reported to ICS-CERT by ISA 99 Layer
CSET is a desktop software tool that guides users through a step-by-step process to assess their control system and information technology network security practices against recognized industry standards. The output from CSET is a prioritized list of recommendations for improving the cybersecurity posture of the organization's enterprise and industrial control cyber systems. The tool derives the recommendations from a database of cybersecurity standards, guidelines, and practices. Each recommendation is linked to a set of actions that can be applied to enhance cybersecurity controls.
Figure 12: DHS Cyber Security Evaluation Tool
CSET has been designed for easy installation and use on a stand-alone laptop or workstation. It incorporates a variety of available standards from organizations such as National Institute of Standards and Technology (NIST), North American Electric Reliability Corporation (NERC), International Organization for Standardization (ISO), U.S. Department of Defense (DoD), and others. When the tool user selects one or more of the standards, CSET will open a set of questions to be answered. The answers to these questions will be compared against a selected security assurance level, and a detailed report will be generated to show areas for potential improvement.
CSET provides an excellent means to perform a self-assessment of the security posture of your control system environment.
Department of Homeland Security Science and Technology
DHS S&T has developed several tools to assess the risk and resiliency of buildings, to include the cyber threat. The Integrated Rapid Visual Screening Tool, and the Owners Performance Requirement Tool assist building owners and operators evaluate the threats, vulnerabilities, and consequences and compare mitigation options.
Committee for National Security Systems ICS Overlay
The CNSS provides a forum for the discussion of policy issues, and is responsible for setting national-level Information Assurance policies, directives, instructions, operational procedures, guidance, and advisories for U.S. Government (USG) departments and agencies for the security of National Security Systems (NSS).
In April 2012, DoD formed a Technical Working Group (TWG) and undertook the task of creating the first CNSSI 1253 ICS-PIT Overlay:
"Security control overlays are specifications of security controls and supporting guidance used to complement the security control baselines and parameter values in the Committee on National Security Systems Instruction (CNSSI) No. 1253 and to complement the supplemental guidance in the NIST SP 800-53. Organizations select and apply CNSSI No. 1253 security control overlays by using the guidance in each of the standardized, approved and CNSS-published overlays."
The TWG delivered the first ICS-PIT Overlay to the CNSS in January, 2013, after extensive collaboration among 65 representatives spanning DoD, DHS and numerous agencies. The Overlay is both a "primer," with a standard architecture and layers diagram, and a pictorial of typical devices, sensors and actuators that enable the I&E, IT and Information Assurance (IA) staff in the field to identify and understand the operational protocols (Modbus, LonTalk, etc.), network ports, and connections.
Figure 13: CNSSI 1253 ICS Overlay Enclave Authorization Boundary and Layers
The initial ICS-PIT Overlay was DoD-centric and used DoD specific parameters, but was formally adopted by the CNSS in March, 2013. The initial version will be included in the CSET 5.1 release as an informational and training document; scheduled for a summer 2013 release.
Recognizing the value of the ICS-PIT Overlay, the CNNS has requested that the Overlay be generalized and made applicable to all CNSS stakeholders. The Overlay is currently being modified, and is expected to be formally submitted to the CNSS committee in June of 2013, with an expected approval and release date of August or September ET 6.0 release with a target release date of November 2013.
Handbook for Self-Assessing Security Vulnerabilities & Risks of Industrial Control Systems on DoD Installations
This handbook (PDF) was developed by the Air Force 346th Test Squadron, 262nd Network Warfare Squadron, Idaho National Laboratory and other stakeholder agencies in response to the need to address the lack of field guidance for ICS cybersecurity. The Department of Defense (DoD) Components and Agencies are encouraged to use this handbook to help establish a risk management framework to identify and prioritize mission-related vulnerabilities and risks that may be exposed or created by network connectivity to Industrial Control Systems (ICS). Installations & Environment (I&E)-related ICS include computer hardware, software, and associated sensors and controllers used to monitor and/or control real property, such as on-installation electricity, water, wastewater, natural gas, airfield lighting and petroleum systems. It also includes building heating and air conditioning equipment, lighting, fire and life safety systems. Supervisory Control and Data Acquisition Systems (SCADA), Distributed Control Systems (DCS), Energy Management Control Systems (EMCS) are also types of ICS.
Additional DoD ICS, facility, and building related cybersecurity information can also be found on the Installations & Environment Business Enterprise Integration office website.
Operations and Maintenance (O&M)
- Committee for National Security Systems Instruction 1253—Security Categorization and Control Selection for National Security Systems (PDF 1.4 MB)
- Committee for National Security Systems Instruction 1253—Security Control Overlays for Industrial Control Systems (PDF 2 MB)
- Department of Defense 8500.1 Information Assurance (PDF 198 KB)
- Department of Defense 8570M Information Assurance Workforce Improvement Program (PDF 622 KB)
- Department of Defense Handbook for Self-Assessing Security Vulnerabilities & Risks of Industrial Control Systems on DoD Installations (PDF 6 MB)
- Department of Defense and General Services Administration Improving Cybersecurity and Resilience through Acquisition (PDF 4.2 MB)
- Department of Homeland Security Cyber Security Procurement Language for Control Systems (PDF 2.5 MB)
- Department of Homeland Security Cybersecurity Evaluation Tool
- Department of Homeland Security Science and Technology Building and Infrastructure Protection Series Tools
- Department of Homeland Security Science and Technology Owner Performance Requirements Tool
- National Institute of Standards and Technology NISTIR 6392 GSA Guide to Specifying Interoperable Building Automation and Control Systems Using ANSI/ASHRAE Standard 135-1995, BACnet (PDF 269 KB)
- National Institute of Standards and Technology SP 800-53 Rev 4 Security and Privacy Controls for Federal Information Systems and Organizations (PDF 4.2 MB)
- National Institute of Standards and Technology SP 800-82 Rev 1 Guide to Industrial Control Systems (ICS) Security (PDF 1.9 MB)
- North American Electric Reliability Corporation Critical Infrastructure Protection Standards
- Overview of the DoD Risk Management Framework and the Committee for National Security Systems Instruction 1253, Industrial Control Systems Platform IT Overlay
- Unified Facility Guide Specification 25-10-10 November 2012 Utility Monitoring and Control Systems Front End Integration (PDF 223 KB)
- Navy Unified Facility Guide Specification 25-10-10 May 2013 ICS Front End Integration (PDF 130 KB)
- Committee for National Security System (CNSS)
- Department of Defense Cybersecurity
- Defense Industrial Base Information Assurance Program
- Department of Homeland Security ICS-CERT
- Department of Homeland Security Science and Technology
- Department of Homeland Security National Protection and Programs Directorate
- General Services Administration Smart Buildings
- ISA99 Committee on Industrial Automation and Control Systems Security
- National Institute of Standards and Technology Cybersecurity Framework
- North American Electric Reliability Corporation
- SANS ICS Security
- Smart Power Infrastructure Demonstration for Energy Reliability and Security (SPIDERS) (PDF 2.9 MB)
- Wikipedia List of Automation Controls
|Industrial control system|
|Power system automation|
|Automatic meter reading|
|Automobile / Vehicle|
- Certified Information Security Professional (CISSP)
- Certified Cyber Forensics Professional (CCFP)
- Defensive Counter Cyber Operator - Identify (PDF 171 KB)
- Defensive Counter Cyber Operator - Hunt (PDF 698 KB)
- Department of Defense Enterprise Mission Assurance Support Service (EMASS)
- Department of Homeland Security ICS-CERT Training Courses
- SANS ICS Security Courses
- "Cybersecurity of Buildings Workshop" – Jan. 28, 2014
Focus was on the recently released draft DHS ISC Converged Systems White Paper document, GSA Smart Buildings program, and the NIST SP 800-82 Guide to Industrial Control Systems Security. This workshop built on the Cybersecurity of Building track listed below. The purpose of the Workshop was to bring the engineering, security, IT and IA communities together to build on current initiatives to create a common architecture and joint publications to develop defense in depth, continuous monitoring, incident response and recovery, and information sharing CONOPS for ICS and Converged Systems. Download materials and presentations. (ZIP 19 MB)
- "Cybersecurity of Buildings Workshop: OT and IT Convergence - A New Paradigm". Building Innovation 2014: The National Institute of Building Sciences Annual Conference & Expo – Jan. 6, 2014.
1 Courtesy of Fred E. Abbitt, CISSP-ISSEP, CSSA / Physical and Control System Security SME, Information Systems Engineering Command, Information Assurance and Security Engineering Directorate
6 Key metrics include: efficiency and sustainability, agility and flexibility, reliability and resilience, safety and security.
7 NIST Shyam Sunder Industrial Internet Workshop, March 2013
8 National Institute of Standards and Technology (NIST) Executive Roundtable on Cyber-physical Systems
9 NIST Shyam Sunder Industrial Internet Workshop, March 2013
10 NIST Shyam Sunder Industrial Internet Workshop, March 2013