Commentary: Security Incidents Organization tries to find its way doing important work

Newly formed organization carries on task of collecting information on cyber security breach incidents.

08/04/2009


The newly formed, non-profit Security Incidents Organization (SIO) has announced it will provide public access to the Repository of Industrial Security Incidents (RISI). RISI bills itself as an industry-wide repository for collecting, investigating, analyzing, and sharing critical information regarding cyber security incidents that directly affect SCADA, manufacturing, and process control systems. With over 150 incidents, RISI is the largest known collection of industrial cyber security incidents.

Modeled after similar safety incident databases, RISI provides subscribers with reliable information that allows them to learn from others' experiences, understand the risks associated with industrial cyber-threats, and adapt their current security policies in step with changing industrial cyber-security dynamics.

RISI traces its history back to early 2001, when academic researchers developed a database called the Industrial Security Incidents Database (ISID). In 2008 several private cyber security experts, building on ISID, began collaboration on the RISI project with a goal of making the information available to the entire industrial automation community. The new SIO was established in 2009 to fulfill this goal by operating the RISI database, researching incidents, and making the results of that research publically available.

"We have always known that the ISID was a tremendous resource for asset owners," says Mark Fabro, president and chief security scientist for Lofty Perch and SIO advisory board member. "It was used to do sector analysis, threat trending, and provided foundation for setting security program budgets. It was a real agent of change for the community. Back in early 2008, Eric Byres and I, along with Mark Zanotti from Lofty Perch, started planning to bring such a database back to life. We felt that the time was right to do it, and we had the experience and the trust of the community to make it work.

"After many months of planning, as well as formal announcements at PCSF, we started to roll it out. The RISI database was founded on the same principles as ISID, and takes into consideration the wants and needs the community has shared over the last couple of years. We know how the database needs to look, what detail it needs to have, and what the best subscription model looks like.

"Make no mistake, we are still finding our way and working out some wrinkles. We think the effort will mature quickly, and we are counting on the continued support from the community of interest to help it along. We think we have been able to mitigate most if not all of the issues raised by interested parties, and are grateful for the insights we have received from various sector stakeholders."

It will be interesting to see how this plays out in the coming months and years as the organization finds direction. This is important work for the industrial community and deserves widely based support.

-Peter Welander, process industries editor, PWelander@cfemedia.com
Process & Advanced Control Monthly eNewsletter
Register here to select your choice of free eNewsletters .





No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Robotic safety, collaboration, standards; DCS migration tips; IT/OT convergence; 2017 Control Engineering Salary and Career Survey
Integrated mobility; Artificial intelligence; Predictive motion control; Sensors and control system inputs; Asset Management; Cybersecurity
Big Data and IIoT value; Monitoring Big Data; Robotics safety standards and programming; Learning about PID
Featured articles highlight technologies that enable the Industrial Internet of Things, IIoT-related products and strategies to get data more easily to the user.
This article collection contains several articles on how automation and controls are helping human-machine interface (HMI) hardware and software advance.
This digital report will explore several aspects of how IIoT will transform manufacturing in the coming years.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Mobility as the means to offshore innovation; Preventing another Deepwater Horizon; ROVs as subsea robots; SCADA and the radio spectrum
Future of oil and gas projects; Reservoir models; The importance of SCADA to oil and gas
Big Data and bigger solutions; Tablet technologies; SCADA developments
Automation Engineer; Wood Group
System Integrator; Cross Integrated Systems Group
Jose S. Vasquez, Jr.
Fire & Life Safety Engineer; Technip USA Inc.
This course focuses on climate analysis, appropriateness of cooling system selection, and combining cooling systems.
This course will help identify and reveal electrical hazards and identify the solutions to implementing and maintaining a safe work environment.
This course explains how maintaining power and communication systems through emergency power-generation systems is critical.
click me