Security papers or material focusing on the industrial control systems (SCADA)

Question

Anyone know a good site or a list of resource to start to know issue related to the security of SCADA system ?

Answer 1

For specific analysis of a particular attack in this space you should read the Symantec Stuxnet paper - gives good background as to just how badly a SCADA attack can compromise an industrial system.

Answer 2

Recently have stumbled upon SCADAPedia: http://www.digitalbond.com/wiki/index.php/Special:Allpages. I suppose, it could be useful.

Answer 3

The US Department of Homeland Security and US-CERT maintain a great set of resources through their Control Systems Security program. It includes security advisories and vulnerability bulletins as well as architecture best practices and other defensive strategies:

http://www.us-cert.gov/control_systems/index.html

It's a good introduction to the field. I'd recommend starting there.

Answer 4

I work in the control system security industry, so you can always follow me on Twitter (@mtoecker) for updates.

Additionally, there are several industry groups active in the area:

1. NIST's Computer System Resource center has some information: (csrc.nist.gov/publications/PubsDrafts.html)
2. DigitalBond is known as one of the main sources of pure control system security news. http://www.digitalbond.com. Dale also maintains a twitter account on @digitalbond

3. EnergySec is the DOE sponsored organization for control system security in electric power (www.energysec.org)

4. Bob Radvanovsky's Infracritical does an excellent job of news and a community through the SCADASEC mailing listserv http://www.infracritical.com/ (Look in the Mailing Lists heading)

5. ControlGlobal has posts and articles on security, though with a much more political and less technical viewpoint. The 'Unfettered' blog is run by Joe Weiss, the grandfather of control system security (community.controlglobal.com)

I hope this helps!

Mike Toecker Private Citizen

/Currently limited to TWO hyperlinks. :(