Industrial security — resources for ISO27k compliance, social-engineering trend reports

Question

I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate student enrolled in BAISc (Information Systems Security).

My paper will be primarily structured around developing policies for employees, as well as access control.

I'm looking for online resources for:

• Viewing historical data of social engineering attacks as they pertain to said industry
  (I currently have data from Anti-Phishing Working Group (APWG) for the following time period: Q4 Nov. '04 - Q4 Dec. '10)
• Viewing overviews of ISO 27000-series regulatory compliances (Wikipedia?)

At the moment, I'm using the following resources:

• SANS Institute Publications
• API Security Guidelines (2005)
• ICS-CERT publications
• Department of Homeland Security publications
• Lecture notes on risk analysis
• Audits of Canadian electricity generating companies by the Office of the Auditor General of Ontario
• Reports from Siemens, NERC

Answer 1

you might want to consider taking a look in The Repository of Industrial Security Incidents which covers in industrial control systems as a whole and breaks down the data by specific industry. I'm not sure if it will specifically cover Social Engineering attacks though