Scribd Logo
Upload

Welcome to Scribd!

  • 8 views

    8 - IC624 - ISCM - John - 10 March 24

    Uploaded by

    ayushjee79
    John Kingsley will discuss trends, approaches, and issues related to industrial automation as well as information security continuous monitoring (ISCM). He has 17 years of experience in industrial automation and is a senior member of the International Society of Automation and member of the ISA Security Compliance Institute. The presentation will cover ISCM based on the NIST framework, establishing metrics, monitoring security controls, applicable standards, and the OT security professional community.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    8 - IC624 - ISCM - John - 10 March 24

    Uploaded by

    ayushjee79
    8 views15 pages
    John Kingsley will discuss trends, approaches, and issues related to industrial automation as well as information security continuous monitoring (ISCM). He has 17 years of experience in industrial automation and is a senior member of the International Society of Automation and member of the ISA Security Compliance Institute. The presentation will cover ISCM based on the NIST framework, establishing metrics, monitoring security controls, applicable standards, and the OT security professional community.

    Original Title

    8_IC624_ISCM_John_10 March 24

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    John Kingsley will discuss trends, approaches, and issues related to industrial automation as well as information security continuous monitoring (ISCM). He has 17 years of experience in industrial automation and is a senior member of the International Society of Automation and member of the ISA Security Compliance Institute. The presentation will cover ISCM based on the NIST framework, establishing metrics, monitoring security controls, applicable standards, and the OT security professional community.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    8 views15 pages

    8 - IC624 - ISCM - John - 10 March 24

    Uploaded by

    ayushjee79
    John Kingsley will discuss trends, approaches, and issues related to industrial automation as well as information security continuous monitoring (ISCM). He has 17 years of experience in industrial automation and is a senior member of the International Society of Automation and member of the ISA Security Compliance Institute. The presentation will cover ISCM based on the NIST framework, establishing metrics, monitoring security controls, applicable standards, and the OT security professional community.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 15

    Session 8

    Industrial Automation Trends


    Approaches and issues
    And Information Security continuous
    Monitoring (ISCM)

    Speaker – John Kingsley


    Disclaimer:

    1
    Introduction

    17 years of Experience in Industrial


    Automation and Design
    Senior Member, International Society of
    Automation
    Member, ISA Security Compliance Institute
    John Kingsley S
    (ISCI)
    https://www.linkedin.com/in/sjkingsley/
    exida Cybersecurity Practioner
    ISA/IEC62443 Certified Cybersecurity
    Fundamentals Specialist
    Worked in Manufacturing, Oil and Gas,
    Petrochemicals, Marine, Energy
    Disclaimer:
    Agenda

    • Industrial Automation Trends Approaches and issues


    • And Information Security continuous Monitoring (ISCM)
    Disclaimer:

    3
    Information Security continuous Monitoring (ISCM)

    NIST SP 800-137,1 Information Security Continuous Monitoring (ISCM) for Federal


    Information Systems and Organizations, defines the process for developing an ISCM
    strategy and implementing an ISCM program. ISCM is defined as “maintaining ongoing
    awareness of information security, vulnerabilities, and threats to support organizational
    risk management decisions.”

    FIGURE 1.1 Blocks of an automated process


    Disclaimer:

    4
    The ISCM Process

    The ISCM Process


    Source: NIST SP 800-137 (2011)
    Disclaimer:

    5
    Establishing Appropriate Metrics

    • Maintaining an understanding of threats and threat activities


    • Assessing all security controls
    • Collecting, correlating, and analyzing security-related information
    • Providing actionable communication of security status across all tiers
    of the organization
    • Active management of risk by organizational officials
    Disclaimer:

    6
    The Risk Management Framework
    Disclaimer:

    The Risk Management Framework


    Source: NIST SP 800-137 (2011) 7
    Monitoring Security Controls

    • Security Control Volatility


    • System Categorizations/Impact Levels
    • Security Controls or Specific Assessment Objects Providing Critical
    Functions
    • Security Controls with Identified Weaknesses
    • Organizational Risk Tolerance
    • Threat Information
    • Vulnerability Information
    • Risk Assessment Results
    • Reporting Requirements
    Disclaimer:

    8
    The Security Automation Domains
    Disclaimer:

    9
    NIST SP 800-53 Security Controls Applicable to
    Security Automation Domains
    Disclaimer:

    10
    NIST SP 800-53 Security Controls Applicable to
    Security Automation Domains
    Disclaimer:

    11
    NIST SP 800-53 Security Controls Applicable to
    Security Automation Domains
    Disclaimer:

    12
    Standards

    • NIST SP 800-53 Rev 5


    • NIST Cybersecurity Framework v2
    • ISO/IEC 27002
    • NIST SP 800-82r2
    • NERC CIP
    • Neureg 6847
    • CIS Critical Security Controls v8
    Disclaimer:

    13
    Standards

    • Committee on National Security Systems Instruction (CNSSI) 1253


    • International Society of Automation: ISA/IEC-62443 (formerly ISA99)
    • NRC Regulatory Guide 5.71, “Cyber Security Programs for Nuclear
    Facilities”
    • INGAA Control Systems, “Cyber Security Guidelines for the Natural
    Gas Pipeline Industry”
    • NISTIR 7628, “Guidelines for Smart Grid Cyber Security”
    • API STD 1164, 3rd Edition, August 2021 - Pipeline Control
    Systems Cybersecurity
    Disclaimer:

    14
    OT Security Professionals
    OT Security Professional on LinkedIn is a community of experienced Cybersecurity Professionals from across
    the globe, who are very passionate in sharing their experience and improving Cybersecurity knowledge within
    the community

    A platform for professionals to connect, learn, and grow in the field of Operational Technology (OT) - Industrial Control
    System (ICS), SCADA, and Substation Automation System (SAS) and get specialized in OT Security. We take pride in
    bringing together experts from the industry, who impart knowledge and share practical experiences to help you stay
    abreast of the latest trends and challenges.
    Disclaimer:

    15

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy