I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate student enrolled in BAISc (Information Systems Security).
My paper will be primarily structured around developing policies for employees, as well as access control.
I'm looking for online resources for:
- Viewing historical data of social engineering attacks as they pertain to said industry
(I currently have data from Anti-Phishing Working Group (APWG) for the following time period: Q4 Nov. '04 - Q4 Dec. '10)
- Viewing overviews of ISO 27000-series regulatory compliances (Wikipedia?)
At the moment, I'm using the following resources:
- SANS Institute Publications
- API Security Guidelines (2005)
- ICS-CERT publications
- Department of Homeland Security publications
- Lecture notes on risk analysis
- Audits of Canadian electricity generating companies by the Office of the Auditor General of Ontario
- Reports from Siemens, NERC