Firing up a security framework

Like anything in the cyber security arena, things have to move fast and just after the Obama Administration signed an Executive Order calling for stronger security movement to help protect critical infrastructure, the first step in the development of a Cybersecurity Framework is moving forward.

02/14/2013


ISS SourceLike anything in the cyber security arena, things have to move fast and just after the Obama Administration signed an Executive Order calling for stronger security movement to help protect critical infrastructure, the first step in the development of a Cybersecurity Framework is moving forward.

That first step involves creating a set of voluntary standards and best practices to guide industry in reducing cyber risks to the networks and computers vital to the nation’s economy, security and daily life.

President Obama called for the Cybersecurity Framework in his Improving Critical Infrastructure Cybersecurity Executive Order. In accordance with the Executive Order, the Secretary of Commerce directed the director of the National Institute of Standards and Technology (NIST) to lead the development of a framework to reduce cyber risks to critical infrastructure, such as power plants and financial, transportation and communications systems.

NIST will issue a Request for Information from critical infrastructure owners and operators, federal agencies, state, local, territorial and tribal governments, standards-setting organizations, other members of industry, consumers, solution providers and other stakeholders.

NIST will use the input to identify existing consensus standards, practices and procedures that are effective and can truly undergo adoption to protect its digital information and infrastructure from the full range of cyber security threats. The framework will not dictate “one-size-fits-all” solutions, but will instead enable innovation by providing guidance that is technology neutral and recognizes the different needs and challenges within and among critical infrastructure sectors.

“The Commerce Department has a critical role to play in helping American businesses address their cyber security issues and risks,” said Deputy Secretary of Commerce Rebecca Blank. “As we move forward with the Cybersecurity Framework, NIST will be collecting input from a wide variety of stakeholders to come up with an effective set of voluntary standards that will safeguard our nation’s most critical infrastructure from cyber security threats. Protecting our businesses and systems from attacks, while also ensuring that new voluntary standards allow the flexibility for innovation, is crucial to ensuring our economy can continue to grow.”

In the official Request for Information, which will be in the Federal Register, NIST will ask organizations to share their current risk management practices; use of frameworks, standards, guidelines and best practices; and other industry practices. NIST plans to hold workshops over the next several months to collect additional input and will complete the framework within one year.

“The process for developing the framework reflects a core component of NIST’s work, bringing together various stakeholders to address a technical challenge,” said Under Secretary of Commerce for Standards and Technology and NIST Director Patrick Gallagher. “By collaborating with industry to develop the framework, we will better protect our nation from the cybersecurity threat while enhancing America’s ability to innovate and compete in a global market.”

The RFI will request additional information on a number of core practices NIST views as applicable across industry, like:

  • Encryption and key management: With multiple encryption tools in use at any given organization, how does one protect, store and organize encryption keys?
  • Asset identification and management: How does an organization determine which assets need protection and their value?
  • Security engineering practices: How does an organization design its systems to meet security needs?

The framework will consist of a roadmap and structure for future efforts, including a recommended process for how the standards within each sector will undergo review by each stakeholder community. NIST will continue to revise and update the framework to meet changing business and security needs.



No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
Each year, a panel of Control Engineering editors and industry expert judges select the System Integrator of the Year Award winners.
Control Engineering Leaders Under 40 identifies and gives recognition to young engineers who...
Learn more about methods used to ensure that the integration between the safety system and the process control...
Adding industrial toughness and reliability to Ethernet eGuide
Technological advances like multiple-in-multiple-out (MIMO) transmitting and receiving
Virtualization advice: 4 ways splitting servers can help manufacturing; Efficient motion controls; Fill the brain drain; Learn from the HART Plant of the Year
Two sides to process safety: Combining human and technical factors in your program; Preparing HMI graphics for migrations; Mechatronics and safety; Engineers' Choice Awards
Detecting security breaches: Forensic invenstigations depend on knowing your networks inside and out; Wireless workers; Opening robotic control; Product exclusive: Robust encoders
The Ask Control Engineering blog covers all aspects of automation, including motors, drives, sensors, motion control, machine control, and embedded systems.
Join this ongoing discussion of machine guarding topics, including solutions assessments, regulatory compliance, gap analysis...
News and comments from Control Engineering process industries editor, Peter Welander.
IMS Research, recently acquired by IHS Inc., is a leading independent supplier of market research and consultancy to the global electronics industry.
This is a blog from the trenches – written by engineers who are implementing and upgrading control systems every day across every industry.
Anthony Baker is a fictitious aggregation of experts from Callisto Integration, providing manufacturing consulting and systems integration.
Integrator Guide

Integrator Guide

Search the online Automation Integrator Guide
 

Create New Listing

Visit the System Integrators page to view past winners of Control Engineering's System Integrator of the Year Award and learn how to enter the competition. You will also find more information on system integrators and Control System Integrators Association.

Case Study Database

Case Study Database

Get more exposure for your case study by uploading it to the Control Engineering case study database, where end-users can identify relevant solutions and explore what the experts are doing to effectively implement a variety of technology and productivity related projects.

These case studies provide examples of how knowledgeable solution providers have used technology, processes and people to create effective and successful implementations in real-world situations. Case studies can be completed by filling out a simple online form where you can outline the project title, abstract, and full story in 1500 words or less; upload photos, videos and a logo.

Click here to visit the Case Study Database and upload your case study.