Commentary: Security Incidents Organization tries to find its way doing important work

The newly formed, non-profit Security Incidents Organization (SIO) has announced it will provide public access to the Repository of Industrial Security Incidents (RISI). RISI bills itself as an industry-wide repository for collecting, investigating, analyzing, and sharing critical information regarding cyber security incidents that directly affect SCADA, manufacturing, and process control systems. With over 150 incidents, RISI is the largest known collection of industrial cyber security incidents.

Modeled after similar safety incident databases, RISI provides subscribers with reliable information that allows them to learn from others’ experiences, understand the risks associated with industrial cyber-threats, and adapt their current security policies in step with changing industrial cyber-security dynamics.

RISI traces its history back to early 2001, when academic researchers developed a database called the Industrial Security Incidents Database (ISID). In 2008 several private cyber security experts, building on ISID, began collaboration on the RISI project with a goal of making the information available to the entire industrial automation community. The new SIO was established in 2009 to fulfill this goal by operating the RISI database, researching incidents, and making the results of that research publically available.

"We have always known that the ISID was a tremendous resource for asset owners," says Mark Fabro, president and chief security scientist for Lofty Perch and SIO advisory board member. "It was used to do sector analysis, threat trending, and provided foundation for setting security program budgets. It was a real agent of change for the community. Back in early 2008, Eric Byres and I, along with Mark Zanotti from Lofty Perch, started planning to bring such a database back to life. We felt that the time was right to do it, and we had the experience and the trust of the community to make it work.

"After many months of planning, as well as formal announcements at PCSF, we started to roll it out. The RISI database was founded on the same principles as ISID, and takes into consideration the wants and needs the community has shared over the last couple of years. We know how the database needs to look, what detail it needs to have, and what the best subscription model looks like.

"Make no mistake, we are still finding our way and working out some wrinkles. We think the effort will mature quickly, and we are counting on the continued support from the community of interest to help it along. We think we have been able to mitigate most if not all of the issues raised by interested parties, and are grateful for the insights we have received from various sector stakeholders."

It will be interesting to see how this plays out in the coming months and years as the organization finds direction. This is important work for the industrial community and deserves widely based support.

-Peter Welander, process industries editor, PWelander@cfemedia.com
Process & Advanced Control Monthly eNewsletter
Register here to select your choice of free eNewsletters .

Do you have experience and expertise with the topics mentioned in this content? You should consider contributing to our WTWH Media editorial team and getting the recognition you and your company deserve. Click here to start this process.