CSSP Web Page Update 02-19-10

The DHS CERT Control Systems Security Program (CSSP) web page has been updated. The new format includes a listing of “Notable Infrastructure Security News”. The pull down tab in the center of the page currently lists links to four news stories;

War game simulates cyberattack Cyberattack simulation highlights vulnerabilities Teaming up for security Shell hit by massive data breach

All of the stories are interesting reads, but the last one is kind of scary for employees. It seems that someone accessed and downloaded the Shell contact data base (phone numbers and email addresses for employees and contractors). The list was then forwarded to a number of activist organizations that have opposed various Shell operations around the world. According to the article it is not yet clear if it was an unauthorized internal access or an outsider hack. Of special concern is that this now opens the company to potential spear phishing attacks that could provide detailed access to company operations data and possibly control systems access.

CSSP Web Page Update 12-23-09

The DHS-CERT Control Systems Security Program (CSSP) web page has been updated. There is now a link to the Industrial Control Systems Joint Working Group’s (ICSJWG) announcement of their spring meeting in Austin, TX, as well as a link to a new publication about the use of encryption to protect industrial control systems. ICSJWG Spring Meeting The ICSJWG is a part of Critical Infrastructure Partnership Advisory Council (CIPAC). According to the meeting announcement web page the “goal of the ICSJWG is to continue and enhance the collaborative efforts of the industrial control systems stakeholder community in securing CIKR by accelerating the design, development, and deployment of secure industrial control systems.” The spring meeting will be held over April 6th thru 8th in Austin, TX. The conference will include presentations by industry leaders in control systems cybersecurity, updates from the ICSJWG Subgroups, and the Introduction to Industrial Control Systems Cybersecurity training course. Further details, including a call for papers, will be forthcoming. ICS Encryption The CSSP has introduced a new publication, the Control Systems Communications Encryption Primer. According to the Abstract the “primer addresses the use of encryption systems within control systems environments”. It addresses the problems of applying encryption techniques to industrial control systems, acknowledging that these techniques “can introduce significant design challenges as they add complexities and operational limitations to the environment”. There will be more on this Primer in a future blog.