Chapter 2 - About Industrial Networks

Abstract

Many organizations are attempting to define methods of securing the industrial systems. The Homeland Security Presidential Directive Seven (HSPD-7) attempts to distinguish the critical versus noncritical systems. HSPD-7 does not include specific security recommendations, relying instead upon other federal security recommendations such as those by the NIST on the security of both enterprise and industrial networks, as well as the Homeland Security Risk- Based Performance Standards used in securing chemical facilities. National Institute of Standards and Technology (NIST) 800 series documents provide best practices and information of general interest to information security. All 800 series documents concern information security and should be used as references where applicable. Of particular relevance to industrial network security is, SP 800-53 (“Recommended Security Controls for Federal Information Systems”), which defines many aspects of information security procedures and technologies, and SP 800-82 (“Guide to Supervisory Control and Data Acquisition [SCADA] and Industrial Control Systems Security”), which discusses industrial control system security specifically. The Federal Information Security Management Act (FISMA) may or may not apply to certain critical infrastructures, depending upon their geographic location and/or their jurisdiction within the United States federal government. However, the standards include valid and useful guidelines for the security of critical environments, referring to and relying upon the NIST “800 series” Special Publication documents (especially SP 800-53 and SP 800-82).