This is the companion article to our 15 Reasons to be Pessimistic about ICS Security in 2015 that we ran on Friday. On Wednesday I’ll lay out what to look forward to in 2015 based on these two contrasting articles.
Many of the items below come from experiences with clients, peers and ICS community friends. They are not as visible as most of the pessimistic items, but they are activities going on in real companies making real progress on these issues.
- Many large asset owners, those with 10, 50 or 100 ICS spread around the world, are deploying ICS security programs across all sites with required security controls and metrics that management is tracking.
- The mainstream press remains hot on ICS security stories.
- Multiple high quality ICS security training options are available.
- Application whitelisting deployed on ICS computers with and without vendor blessing.
- Some universities are now performing true ICS security research.
- More ICS vendors are implementing an effective security development lifecycle (SDL).
- The NIST Cybersecurity Framework is launching C-level discussions and programs.
- Governments around the world are now engaged in this problem. Varying approaches, different results.
- Peer pressure … multiple examples in 2014 where ICSsec projects were launched because competitor/peer was doing it.
- Virtualization is becoming a mainstream deployment option.
- Greater acceptance of the need for an inventory, data flow diagrams and other basic documentation.
- Leaders in wide variety of sectors beginning ICS security efforts. It’s not focused on electric, petrochem any more.
- Wait … we are still running Windows XP? Management awakening to state of cyber maintenance neglect and finding it unacceptable.
- Vendors are, admittedly still slowly, adding security posture acceptance tests to FAT and SAT.
- Large consulting practices, i.e. IBM, PWC, …, are creating ICS security teams.
What would you add to the list?
Image by PixelVikings