I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate student enrolled in BAISc (Information Systems Security).

My paper will be primarily structured around developing policies for employees, as well as access control.

I'm looking for online resources for:

  • Viewing historical data of social engineering attacks as they pertain to said industry
    (I currently have data from Anti-Phishing Working Group (APWG) for the following time period: Q4 Nov. '04 - Q4 Dec. '10)
  • Viewing overviews of ISO 27000-series regulatory compliances (Wikipedia?)

At the moment, I'm using the following resources:

  • SANS Institute Publications
  • API Security Guidelines (2005)
  • ICS-CERT publications
  • Department of Homeland Security publications
  • Lecture notes on risk analysis
  • Audits of Canadian electricity generating companies by the Office of the Auditor General of Ontario
  • Reports from Siemens, NERC
  • maybe you could ask this question on this site proposal: undergraduates. Follow it if you find it interesting!
    – Daniele B
    Commented Jan 23, 2013 at 17:12

1 Answer 1


you might want to consider taking a look in The Repository of Industrial Security Incidents which covers in industrial control systems as a whole and breaks down the data by specific industry. I'm not sure if it will specifically cover Social Engineering attacks though

  • Thank you for your response Colin! I'll likely go with the Anti-Phishing Working Group's trend reports for social engineering statistics.
    – Tyler
    Commented Mar 23, 2012 at 17:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .