ICS Security Certification in Development

Friday, September 13, 2013 @ 05:09 PM gHale


It is one thing to certify the actual devices and systems to ensure they are cyber secure, but the next step is to certify professionals implementing them. That will happen this fall.

Cyber security certification provider, Global Information Assurance Certification (GIAC), launched an initiative to create an open body of knowledge for process control design and information technology security.

RELATED STORIES
Unlimited Career Path for Security Pros
Mining, Energy Face Worker Shortage
Online Security Career Portal
Summer Cyber Institute a Success

The objective of the collaborative — which involves organizations that design, deploy, operate, and maintain industrial automation and control system infrastructure — is to develop a vendor-neutral certification known as the Global Industrial Cyber Security Professional (GICSP). The certification will debut this fall. The GICSP will be available to candidates in late November 2013.

“Protecting industrial control and automation systems from constantly evolving cyber security threats is a very challenging task shared by all involved stakeholders,” said Markus Braendle, group head of cyber security, at ABB in Zurich, Switzerland. “The foundation for any successful program is the people involved in developing, designing, operating and maintaining these systems. The effort did not only result in a certification program that will advance workforce development, but it is also an industry commitment to improve the security of our critical infrastructure.”

Critical infrastructure attacks are occurring more often and predictions are staying they will get more intense and sophisticated. Critical infrastructure, such as power utilities and the oil and gas industry, must keep the operational environment safe, secure and resilient against current and emerging cyber threats to maintain the safety of workers and well being of customers and the communities they serve. Users need to avert any unplanned downtime.

One of the key challenges these industries face is educating and certifying a workforce that needs the knowledge, skills and abilities to securely deploy and maintain process control systems. That is where GICSP comes in.

“Managing cyber risk is an issue effecting the entire energy industry ecosystem and in order to effectively implement and sustain security controls on industrial infrastructure, we’re all reliant on a complex ecosystem of people (system vendors, project engineering contractors, process operators, IT service providers and maintenance/support personnel) who require a blended set of IT/Engineering/Cyber Security competencies – a skill-pool which is unique and scarce in today’s marketplace,” said Tyler Williams, manager, PCD IT Security Solutions at Shell and Chair of the industry consortium. “Developing and maintaining this workforce can be a challenge for any one organization and that is why we support this collaborative effort to establish a community developed body of knowledge and certification program for industrial cyber security.”

GIAC and industry leaders worked to establish a panel of subject matter experts (SME) to identify the knowledge, skills and abilities necessary to develop the certification objectives for the GICSP. The SME panel met in Houston, Texas in May 2013, to begin this process. A further outcome of the SME panel is to develop a Job Task Analysis survey, which will go out to a broad array of critical infrastructure participants to ensure the certification aligns to job duties. The GICSP expects adoption on a global basis as a gateway certification in the cyber security domain for industrial control systems.

“GIAC is actively engaging with industrial control systems (ICS) security and engineering experts to develop a broad based and foundational certification that will begin to prepare enterprises, global agencies and governments to mitigate and implement a process to address ICS cyber security concerns,” said Michael Assante, SANS ICS Director.

The global industry experts involved in this initiative include representatives from the following national and international companies: ABB; BP; Cigital; Cimation; Emerson Process Management; Global Information Assurance Certification; Industrial Automated and Control Systems & Smart Grids Thematic Group, ERNCIP project, European Commission’s Joint Research Centre; Invensys; KPMG; Pacific Gas & Electric; Phoenix; Red Tiger Security; Rockwell Automation; SANS Institute; Schneider Electric; Shell; TNO; Wurldtech, and Yokogawa.

The GIAC program gets its accreditation under the IEC/ISO/ANSI 17024 quality standard for certifying bodies. Click here for more information.



Leave a Reply

You must be logged in to post a comment.