NIST Updates ICS Security Guide

Monday, June 8, 2015 @ 07:06 PM gHale

The National Institute of Standards and Technology (NIST) issued the second revision to its Guide to Industrial Control Systems (ICS) Security.

The new version includes new guidance on how to tailor traditional IT security controls to accommodate unique ICS performance, reliability and safety requirements, as well as updates to sections on threats and vulnerabilities, risk management, recommended practices, security architectures and security capabilities and tools.

Grant Money for Security Projects
Students Defend ‘Operation Transit Storm’
Cyber Lab Available for Training
MD Grant Gives Boost to Security Careers

Downloaded more than 3 million times since its initial release in 2006, the ICS security guide advises on how to reduce the vulnerability of computer-controlled industrial systems to malicious attacks, equipment failures, errors, inadequate malware protection and other threats.

Most ICS began as proprietary, stand-alone collections of hardware and software walled off from the rest of the world and isolated from most external threats.

Today, widely available software applications, Internet-enabled devices and other nonproprietary IT offerings integrated into most such systems. This connectivity has delivered benefits, but it also has increased the vulnerability of these systems. Cyber security threats to ICS can pose significant risks to human health and safety, the environment, and business and government operations.

Due to unique performance, reliability and safety requirements, securing ICS often requires adaptations and extensions to NIST-developed security standards and guidelines commonly used to secure traditional IT systems.

A significant addition in this revision is a new ICS overlay offering tailored guidance on how to adapt and apply security controls and control enhancements detailed in the 2013 comprehensive update of Security and Privacy Controls for Federal Information Systems and Organizations (NIST Special Publication 800-53, revision 4) to ICS.

SP 800-53 contains a catalog of security controls that can end up customized to meet specific needs stemming from an organization’s mission, operational environment, or the particular technologies used. Using the ICS overlay, utilities, chemical companies, food manufacturers, automakers and other ICS users can adapt and refine these security controls to address their specialized security needs.

NIST SP 800-82, Revision 2, Guide to Industrial Control System (ICS) Security, can end up downloaded from the NIST Computer Security Resource Center.