NIST updates ICS security guide

The National Institute of Standards and Technology (NIST) has issued the second revision to its Guide to Industrial Control Systems (ICS) Security. It includes new guidance on how to tailor traditional IT security controls to accommodate unique ICS performance, reliability and safety requirements, as well as updates to sections on threats and vulnerabilities, risk management, recommended practices, security architectures and security capabilities and tools.

Downloaded more than 3 million times since its initial release in 2006, the ICS security guide advises on how to reduce the vulnerability of computer-controlled industrial systems to malicious attacks, equipment failures, errors, inadequate malware protection and other threats.

ICS encompass the hardware and software that control equipment and the information technologies that gather and process data. They are commonly used in factories and by operators of electric utilities, pipelines and other major infrastructure systems.

Most ICS began as proprietary, stand-alone collections of hardware and software that were walled off from the rest of the world and isolated from most external threats. Today, widely available software applications, Internet-enabled devices and other nonproprietary IT offerings have been integrated into most such systems.

This connectivity has delivered many benefits, but it also has increased the vulnerability of these systems.

Cybersecurity threats to ICS can pose significant risks to human health and safety, the environment, and business and government operations.

Due to unique performance, reliability and safety requirements, securing ICS often requires adaptations and extensions to NIST-developed security standards and guidelines commonly used to secure traditional IT systems.