ICS released Version 3.0 of The Roadmap To Secure Control Systems in The Transportation Sector. It’s a good primer to transportation sector ICS, which surprisingly includes pipelines. Each sector is defined along with a glossary of key terms. The four goals are very basic, but this may be exactly the type of document that most parts of transportation sector needs as they are behind other sectors like electric, oil/gas, chemical and even water.
Automotive control system security is heating up. The Linux Foundation just created the Automotive Grade Linux Workgroup. Their initial focus will be on Linux for the Instrumentation Panel and Infotainment System. On the other side, The Register reported on BMW’s being stolen using On Board Diagnostics bypass tools.
The US Federal Energy Regulatory Commission has created an Office of Energy Infrastructure Security (OEIS). FERC and a cooperative Congress has been promoting the notion that FERC lacks the authority to help secure the electric sector, but FERC hasn’t done much with the authority they have (NERC CIP). Security had been in the FERC Office of Electric Reliability, and I like the idea of security being considered an element of reliability. That said, if this new OEIS helps FERC get a fresh start on cyber security it’s a good move.
NERC has posted their presentation on the major differences and benefits to CIP V5.
There are so many articles and discussions on cyberwar going on that it is hard to track. This week the most amusing was US Pentagon’s Joint Staff saying that Iran was pursuing a covert cyber war on the US. As an American my sympathies lie with the US efforts, but we really can’t cry foul if Iran hits back.
A Sophos anti-virus signature update resulted in false positives this week. These rare occurrences are sometimes used as rationale to not update AV. Instead split AV updates into two groups (splitting redundant systems) and stagger updates, and perhaps consider having a delay between download and update.
Tweet of the Week
[blackbirdpie id=”248479445030166528″]
Don’t forget to subscribe to this blog RSS feed and follow @digitalbond.com on twitter.
Worth Reading Articles
- Dick Caro looks at the efforts to merge or integrate WirelessHART into ISA100.11a, ISA100.11a and WirelessHART – Your Future In Wireless
- Ralph Langner punctures the government superhero solution, Dial 1-800-Cyberrescue
- Richard Bejtlich’s Over Time, Intruders Improvise, Adapt, Overcome
- Honeywell/Matrikon blog on the CIP-002 Not So Bright Line
Critical Intelligence’s ICS Security Event Calendar Updates
Thanks to Stephan Beirer of GAI NetConsult for updating the events in Germany.
- Grid – Smart Safe, Secure, Oct 23-24 in Munich, Germany
- IT Security Industrial and Automation, Nov 13-14 in Leipzig, Germany
- Secure Communication for Energy Networks, Nov 20-21 in Dusseldorf, Germany
Critical Intelligence provides reports and other information products on Cyber Situational Awareness and Threat Intelligence services for Industrial Control System Owner/Operators, Vendors and Government stakeholders.
Image by bixentro