Reporting Cybersecurity Incidents

The Repository of Industrial Security Incidents (RISI) is an independent organization that collects and analyzes information about, and reports on, cybersecurity incidents involving industrial control systems. This weekend they announced a new online incident reporting form that allows for the anonymous reporting about industrial control system security incidents.

There is no other organization that (sorry ICS-CERT) that has a similar mandate. Since this is a non-governmental organization they have no way of requiring facilities to report these incidents. They rely on voluntary reporting and public news reports to maintain their data base of industrial control system security incidents.

RISI provides an incentive for reporting incidents; they provide one month of free access to reports and information to anyone reporting an ICS security incident. This will, of course, require some self-identification, but RISI maintains strict confidentiality. They note on their web site that:

“All reporting to RISI is strictly confidential. The security of all submitted information is of critical importance to RISI and all sensitive references are removed (and not masked) so there is no risk to the contributor or company. In addition, the investigative database is not available on line so identity data is not at risk from cyber theft.”

I would like to urge all readers working in chemical facilities (and any other facility that uses industrial control systems) to utilize this new reporting form to report any industrial control system security incidents. If the incident is an apparent attack, by all means report to law enforcement authorities first, but please follow-up with a report to RISI.

Reader Comment – 07-22-09 RISI

Wednesday John Cusimano of exida left a comment about an earlier post on the ‘birth’ of RISI. He pointed out that I failed to acknowledge the role of Mark Fabro of Lofty Perch. My apologies to Mark and all of the folks involved with RISI. John also took the opportunity to ask us to “Please check the website [link added] regularly as, especially over the next few months, we expect things to be very dynamic.” While I certainly look forward to reporting on developments at RISI, especially sharing any developing information on the control system security incidents, I urge any of my readers that work with control systems to track the site and their reports. And most importantly, Please REPORT CONTROL SYSTEM INCIDENTS.

Reporting Attacks on Control Systems

Monday, July 20th, 2009 was an important day for control system security. The long awaited birth of RISI (Repository of Industrial Security Incidents) finally occurred. The RISI is a data base operated by Security Incidents Organization (www.SecurityIncidents.org), a non-governmental organization (NGO) that will collect, investigate, analyze, and share information about security incidents involving industrial control systems. Walt Boyes and Joe Weiss from ControlGlobal.com are part of the team that has been working on bringing this organization and data base to life. Other easily recognized names behind this start-up include: John Cusimano, of exida, Eric Byres of Byres Security div. of Exida, Todd Stauffer, also of exida, Aris Espejo of Syncrude Ltd., Eric Cosman of Dow Chemical Company. To give a viable start to this project the RISI database was started with data from 150 cyber incidents that had been gathered by the Industrial Security Incidents Database (ISID) an academic project starting in 2001. This makes RISI currently the largest database of control system incidents. Those incidents include accidental cyber-related incidents, as well deliberate events such as external hacks, Denial of Service (DoS) attacks, and virus/worm infiltrations that did or could have resulted in loss of control, loss of production, or a process safety incident. While the Security Incidents Organization is a registered non-profit, it does have expenses to cover. There is an annual membership fee for full access to the RISI database, but in a remarkable marketing idea for a bunch of control geeks, they offer a free 3 month membership (or extension of membership) for each industrial cyber incident reported. Anyone that is responsible for an industrial control system (especially control systems at high-risk chemical facilities), or for security of the same, should visit the organization web site. A detailed exploration of the site would be well worth your time. I’m adding the site to my list of daily internet stops.