Commentary: Security Incidents Organization tries to find its way doing important work

Newly formed organization carries on task of collecting information on cyber security breach incidents.


The newly formed, non-profit Security Incidents Organization (SIO) has announced it will provide public access to the Repository of Industrial Security Incidents (RISI). RISI bills itself as an industry-wide repository for collecting, investigating, analyzing, and sharing critical information regarding cyber security incidents that directly affect SCADA, manufacturing, and process control systems. With over 150 incidents, RISI is the largest known collection of industrial cyber security incidents.

Modeled after similar safety incident databases, RISI provides subscribers with reliable information that allows them to learn from others' experiences, understand the risks associated with industrial cyber-threats, and adapt their current security policies in step with changing industrial cyber-security dynamics.

RISI traces its history back to early 2001, when academic researchers developed a database called the Industrial Security Incidents Database (ISID). In 2008 several private cyber security experts, building on ISID, began collaboration on the RISI project with a goal of making the information available to the entire industrial automation community. The new SIO was established in 2009 to fulfill this goal by operating the RISI database, researching incidents, and making the results of that research publically available.

"We have always known that the ISID was a tremendous resource for asset owners," says Mark Fabro, president and chief security scientist for Lofty Perch and SIO advisory board member. "It was used to do sector analysis, threat trending, and provided foundation for setting security program budgets. It was a real agent of change for the community. Back in early 2008, Eric Byres and I, along with Mark Zanotti from Lofty Perch, started planning to bring such a database back to life. We felt that the time was right to do it, and we had the experience and the trust of the community to make it work.

"After many months of planning, as well as formal announcements at PCSF, we started to roll it out. The RISI database was founded on the same principles as ISID, and takes into consideration the wants and needs the community has shared over the last couple of years. We know how the database needs to look, what detail it needs to have, and what the best subscription model looks like.

"Make no mistake, we are still finding our way and working out some wrinkles. We think the effort will mature quickly, and we are counting on the continued support from the community of interest to help it along. We think we have been able to mitigate most if not all of the issues raised by interested parties, and are grateful for the insights we have received from various sector stakeholders."

It will be interesting to see how this plays out in the coming months and years as the organization finds direction. This is important work for the industrial community and deserves widely based support.

-Peter Welander, process industries editor,
Process & Advanced Control Monthly eNewsletter
Register here to select your choice of free eNewsletters .

No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Choosing controllers: PLCs, PACs, IPCs, DCS? What's best for your application?; Wireless trends; Design, integration; Manufacturing Day; Product Exclusive
Variable speed drives: Smooth, efficient, electrically quite motion control; Process control upgrades; Mobile intelligence; Product finalists: Vote now; Product Exclusives
Machine design tips: Pneumatic or electric; Software upgrades; Ethernet advantages; Additive manufacturing; Engineering Leaders; Product exclusives: PLC, HMI, IO
This article collection contains the 5 most referenced articles on improving the use of PID.
Learn how Industry 4.0 adds supply chain efficiency, optimizes pricing, improves quality, and more.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Cyber security cost-efficient for industrial control systems; Extracting full value from operational data; Managing cyber security risks
Drilling for Big Data: Managing the flow of information; Big data drilldown series: Challenge and opportunity; OT to IT: Creating a circle of improvement; Industry loses best workers, again
Pipeline vulnerabilities? Securing hydrocarbon transit; Predictive analytics hit the mainstream; Dirty pipelines decrease flow, production—pig your line; Ensuring pipeline physical and cyber security