Anyone know a good site or a list of resource to start to know issue related to the security of SCADA system ?
For specific analysis of a particular attack in this space you should read the Symantec Stuxnet paper - gives good background as to just how badly a SCADA attack can compromise an industrial system.
Recently have stumbled upon SCADAPedia: http://www.digitalbond.com/wiki/index.php/Special:Allpages. I suppose, it could be useful.
The US Department of Homeland Security and US-CERT maintain a great set of resources through their Control Systems Security program. It includes security advisories and vulnerability bulletins as well as architecture best practices and other defensive strategies:
It's a good introduction to the field. I'd recommend starting there.
I work in the control system security industry, so you can always follow me on Twitter (@mtoecker) for updates.
Additionally, there are several industry groups active in the area:
- NIST's Computer System Resource center has some information: (csrc.nist.gov/publications/PubsDrafts.html)
- DigitalBond is known as one of the main sources of pure control system security news. http://www.digitalbond.com. Dale also maintains a twitter account on @digitalbond
EnergySec is the DOE sponsored organization for control system security in electric power (www.energysec.org)
Bob Radvanovsky's Infracritical does an excellent job of news and a community through the SCADASEC mailing listserv http://www.infracritical.com/ (Look in the Mailing Lists heading)
- ControlGlobal has posts and articles on security, though with a much more political and less technical viewpoint. The 'Unfettered' blog is run by Joe Weiss, the grandfather of control system security (community.controlglobal.com)
I hope this helps!
Mike Toecker Private Citizen
/Currently limited to TWO hyperlinks. :(