Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Anyone know a good site or a list of resource to start to know issue related to the security of SCADA system ?

share|improve this question

4 Answers 4

For specific analysis of a particular attack in this space you should read the Symantec Stuxnet paper - gives good background as to just how badly a SCADA attack can compromise an industrial system.

share|improve this answer
1  
Just FYI, ESET has analysed this attack first and they have comprehensive paper about this: blog.eset.com/2010/10/20/… –  anonymous Dec 21 '10 at 17:15
    
@Ams - That one is pretty good. I hadn't seen it. Cheers. –  Rory Alsop Dec 21 '10 at 22:50

Recently have stumbled upon SCADAPedia: http://www.digitalbond.com/wiki/index.php/Special:Allpages. I suppose, it could be useful.

share|improve this answer
1  
Fantastic resource. There have also been a lot of talks at 2010 security/hacker conferences on SCADA-related subjects. Here are a few; –  user502 Dec 21 '10 at 14:12
    
Yep, SCADA has gained a lot of attention in recent times. –  anonymous Dec 21 '10 at 14:28

The US Department of Homeland Security and US-CERT maintain a great set of resources through their Control Systems Security program. It includes security advisories and vulnerability bulletins as well as architecture best practices and other defensive strategies:

http://www.us-cert.gov/control_systems/index.html

It's a good introduction to the field. I'd recommend starting there.

share|improve this answer
    
thanks, i'm starting check some material from UK web site about critical structures: cpni.gov.uk/default.aspx then i think i read some from your URL. –  boos Dec 22 '10 at 15:01

I work in the control system security industry, so you can always follow me on Twitter (@mtoecker) for updates.

Additionally, there are several industry groups active in the area:

  1. NIST's Computer System Resource center has some information: (csrc.nist.gov/publications/PubsDrafts.html)
  2. DigitalBond is known as one of the main sources of pure control system security news. http://www.digitalbond.com. Dale also maintains a twitter account on @digitalbond
  3. EnergySec is the DOE sponsored organization for control system security in electric power (www.energysec.org)

  4. Bob Radvanovsky's Infracritical does an excellent job of news and a community through the SCADASEC mailing listserv http://www.infracritical.com/ (Look in the Mailing Lists heading)

  5. ControlGlobal has posts and articles on security, though with a much more political and less technical viewpoint. The 'Unfettered' blog is run by Joe Weiss, the grandfather of control system security (community.controlglobal.com)

I hope this helps!

Mike Toecker Private Citizen

/Currently limited to TWO hyperlinks. :(

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.