Resources to Learn About ICS Security

I had an interesting conversation with a colleague yesterday.  He called to ask for some advice on ways to advance his career in the industrial controls security space.  He held a Certified Information Systems Security Professional (CISSP) certificate and a Masters in Information Security.  However, he was frustrated on determining ways to move ahead in ICS security.

As I considered his questions I realized that a person who can advance in the areas of industrial controls security is someone with factory or process plant experience, and understanding of basic controls theory, and a solid understanding of factory/process plant operations and maintenance.  These are very fundamental to one understanding the causes and effects of ICS security.

CLASSROOM / ONLINE TRAINING

Besides the “floor” experience, an individual interested in ICS security probably needs some formal training on the key aspects of ICS security you don’t learn when studying for your CISSP.  My recommendations include:

ICS-CERT Cyber Security Industrial Control Systems (210W):  This is a free course available on the ICS-CERT Virtual Learning Portal.  The training is all self-paced and requires between 10 to 15 hours to complete.  It is a great way to begin your ICS security knowledge journey.

·         ICS-CERT Cyber Security Industrial Control Systems (210W):  This is a free course available on the ICS-CERT Virtual Learning Portal.  The training is all self-paced and requires between 10 to 15 hours to complete.  It is a great way to begin your ICS security knowledge journey.

·    SANS ICS 410: ICS/SCADA Security Essentials: If you take the course, you’ll essentially have the necessary training to pass the SANS GICSP – Global Industrial Cyber Security Professional certification.  The details on the 5-day class are located here.  Of note, you don’t need to take the course but can instead pay to take the test.

·    ISA Cybersecurity Training:  The International Society for Automation (ISA) offers a series of four different classes covering ICS security.  These class titles include:

o    Industrial Networking and Security (TS12)

o    Introduction to Industrial Automation Security and the ANSI/ISA99 Standards (IC32C)

o    Using the ANSI/ISA99 Standard to Secure Your Control System (IC32)

o    Assessing the Cybersecurity of New or Existing IACS Systems (IC33)

o    IACS Cybersecurity Design & Implementation (IC34), and

o    IACS Cybersecurity Operations & Maintenance (IC37)

As I understand, each course has an associated certificate (not certification) with each class which you can receive after you satisfactorily pass a written test.

Overall, the ISA training has come a long way and should help with understanding practical ICS security.

You can find out more information regarding the ISA classes here.

READING RECOMMENDATIONS

In regards to reading, I’d highly recommend the following documents to read and establish your baseline knowledge of ICS security. 

• Guide to Industrial Control Systems (ICS) Security, NIST SP 800-82 R2:  Even though this is issued by the National Institute of Standards and Technology (NIST) it is a decent “textbook” prepared to give the reader a comprehensive view of ICS and the security issues associated with “operational technology (OT).”  I’d recommend the student read this document before moving ahead to any of the training above.  By the way, this is free.
  
• An Abbreviated History of Automation & Industrial Controls Systems and Cybersecurity, SANS:  This document is a high-level introduction to industrial controls, control theory, the history of industrial controls and a history of the security issues affecting ICS – including the infamous Stuxnet.  This information will be very helpful to the reader as they progress through the courses above and in their work.  Again, another resource available at no charge.
  
• Industrial Network Security, by Eric D. Knapp and Joel Thomas Langill, Syngress Press:  Although a $40 investment, this book offers excellent information on ICS and ICS security you will not normally see in the resources above or in other books written on SCADA security.  Messrs. Knapp and Langill provide excellent, real-world perspective on ICS security.  So, if you’re serious about your ICS security training, I strongly recommend you get this book and read/study it.

I’ve been lucky in my past 45+ years of work where I’ve operated power plants, evaluated various factories, and had a chance to practice “practical ICS security.”  Fortunately, my background has given me the tools to advance in this area but I’ve also taken advantage of the resources above.

### END ###

FEMA Bits and Pieces

For those of us in the "infrastructure community" we seem to be drawn to issues involving different critical infrastructure sectors along with broader issues such as emergency preparedness, disaster response and business continuity, government financing, climate change impacts, etc.

A useful resource is FEMA's Higher Education Program Bits and Pieces newsletter published by Barbara Johnson at the FEMA National Emergency Training Center, Emmitsburg, Maryland.  

The newsletter - often produced weekly on Fridays - not only includes information on FEMA training opportunities but it also weaves in timely  "bits and pieces" of information on emergency planning, critical infrastructure protection, etc.  The report also highlights any recently issued Congressional Research Service reports that may be of interest to the emergency planning/critical infrastructure protection professional.

Instructions on how to sign up for the email subscription service are below:

Sign up via our free e-mail subscription service to receive notifications when new information is available from the Higher Education Program and FEMA.gov.

You will receive Activity Reports and other pertinent information concerning professional development. You also have the option of signing up for additional e-mail updates from FEMA and EMI. Visit the subscriber settings page to sign up for additional e-mail notices. Once there, you can also receive e-mail updates targeted to your geographic area by clicking on “subscriber preferences” and inserting your state and ZIP Code where requested.

The links above will guide you through various aspects of the Higher Education Program. If you have any questions, please contact Barbara L. Johnson at Barbara.Johnson3@fema.dhs.gov.

Please note: Some of the websites linked from the Higher Ed courses, documents, presentations are not Federal government websites and may not necessarily operate under the same laws, regulations and policies as Federal websites.

Many thanks to Barbara for this useful service!  Well done!

###