7

Anyone know a good site or a list of resource to start to know issue related to the security of SCADA system ?

4 Answers 4

6

For specific analysis of a particular attack in this space you should read the Symantec Stuxnet paper - gives good background as to just how badly a SCADA attack can compromise an industrial system.

2
  • 1
    Just FYI, ESET has analysed this attack first and they have comprehensive paper about this: blog.eset.com/2010/10/20/…
    – anonymous
    Commented Dec 21, 2010 at 17:15
  • @Ams - That one is pretty good. I hadn't seen it. Cheers.
    – Rory Alsop
    Commented Dec 21, 2010 at 22:50
3

Recently have stumbled upon SCADAPedia: http://www.digitalbond.com/wiki/index.php/Special:Allpages. I suppose, it could be useful.

2
  • 1
    Fantastic resource. There have also been a lot of talks at 2010 security/hacker conferences on SCADA-related subjects. Here are a few;
    – user502
    Commented Dec 21, 2010 at 14:12
  • Yep, SCADA has gained a lot of attention in recent times.
    – anonymous
    Commented Dec 21, 2010 at 14:28
3

The US Department of Homeland Security and US-CERT maintain a great set of resources through their Control Systems Security program. It includes security advisories and vulnerability bulletins as well as architecture best practices and other defensive strategies:

http://www.us-cert.gov/control_systems/index.html

It's a good introduction to the field. I'd recommend starting there.

1
  • thanks, i'm starting check some material from UK web site about critical structures: cpni.gov.uk/default.aspx then i think i read some from your URL.
    – boos
    Commented Dec 22, 2010 at 15:01
0

I work in the control system security industry, so you can always follow me on Twitter (@mtoecker) for updates.

Additionally, there are several industry groups active in the area:

  1. NIST's Computer System Resource center has some information: (csrc.nist.gov/publications/PubsDrafts.html)
  2. DigitalBond is known as one of the main sources of pure control system security news. http://www.digitalbond.com. Dale also maintains a twitter account on @digitalbond
  3. EnergySec is the DOE sponsored organization for control system security in electric power (www.energysec.org)

  4. Bob Radvanovsky's Infracritical does an excellent job of news and a community through the SCADASEC mailing listserv http://www.infracritical.com/ (Look in the Mailing Lists heading)

  5. ControlGlobal has posts and articles on security, though with a much more political and less technical viewpoint. The 'Unfettered' blog is run by Joe Weiss, the grandfather of control system security (community.controlglobal.com)

I hope this helps!

Mike Toecker Private Citizen

/Currently limited to TWO hyperlinks. :(

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .