NIST Releases Update of Industrial Control Systems Security Guide

The National Institute of Standards and Technology (NIST) has issued the second revision to its Guide to Industrial Control Systems (ICS) Security. It includes new guidance on how to tailor traditional IT security controls to accommodate unique ICS performance, reliability and safety requirements, as well as updates to sections on threats and vulnerabilities, risk management, recommended practices, security architectures and security capabilities and tools.

Downloaded more than 3 million times since its initial release in 2006, the ICS security guide advises on how to reduce the vulnerability of computer-controlled industrial systems to malicious attacks, equipment failures, errors, inadequate malware protection and other threats.

ICS encompass the hardware and software that control equipment and the information technologies that gather and process data. They are commonly used in factories and by operators of electric utilities, pipelines and other major infrastructure systems.

Most ICS began as proprietary, stand-alone collections of hardware and software that were walled off from the rest of the world and isolated from most external threats. Today, widely available software applications, Internet-enabled devices and other nonproprietary IT offerings have been integrated into most such systems. This connectivity has delivered many benefits, but it also has increased the vulnerability of these systems. Cybersecurity threats to ICS can pose significant risks to human health and safety, the environment, and business and government operations.

Due to unique performance, reliability and safety requirements, securing ICS often requires adaptations and extensions to NIST-developed security standards and guidelines commonly used to secure traditional IT systems.

A significant addition in this revision is a new ICS overlay offering tailored guidance on how to adapt and apply security controls and control enhancements detailed in the 2013 comprehensive update of Security and Privacy Controls for Federal Information Systems and Organizations (NIST Special Publication 800-53, revision 4) to ICS. SP 800-53 contains a catalog of security controls that can be customized to meet specific needs stemming from an organization's mission, operational environment, or the particular technologies used. Using the ICS overlay, utilities, chemical companies, food manufacturers, automakers and other ICS users can adapt and refine these security controls to address their specialized security needs.

NIST SP 800-82, Revision 2, Guide to Industrial Control System (ICS) Security, can be downloaded from the NIST Computer Security Resource Center or http://dx.doi.org/10.6028/NIST.SP.800-82r2