Analytics
9/12/2013
11:33 AM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%

New Industrial Control Systems Cyber Security Certification In Development

Objective of collaborative is to develop a vendor-neutral certification to be known as the Global Industrial Cyber Security Professional (GICSP)

BETHESDA, Md., Sept. 12, 2013 /PRNewswire-USNewswire/ -- Global Information Assurance Certification (GIAC), a leading provider of cyber security certifications, and representatives from a global industry collaborative announce today that they have formed a community initiative to establish an open body of knowledge for Process Control Design and Information Technology Security. The objective of the collaborative, involving organizations which design, deploy, operate, and maintain industrial automation and control system infrastructure, is to develop a vendor-neutral certification to be known as the Global Industrial Cyber Security Professional (GICSP) to debut this fall. The GICSP will be available to candidates in late November 2013. For more information, please visit: http://www.giac.org/info/139030

"Protecting industrial control and automation systems from constantly evolving cyber security threats is a very challenging task shared by all involved stakeholders. The foundation for any successful program is the people involved in developing, designing, operating and maintaining these systems. We are therefore proud to be part of the creation of the first professional certification program for industrial control system cyber security. The effort did not only result in a certification program that will advance workforce development, but it is also an industry commitment to improve the security of our critical infrastructure," stated Markus Braendle, Group Head of Cyber Security, ABB, Zurich, Switzerland.

Warnings about attacks to critical infrastructure have been circulating for years, but in recent years real threats have been identified and have had an identifiable impact on critical infrastructure assets and systems. Critical infrastructures, such as power utilities and the oil and gas industry, must keep the operational environment safe, secure and resilient against current and emerging cyber threats to maintain the safety of workers and well being of customers and the communities they serve. One of the key challenges these industries are facing is educating and certifying a workforce that need to possess the knowledge, skills and abilities to securely deploy and maintain process control systems. The GICSP is being developed to meet this challenge.

"Managing cyber risk is an issue effecting the entire energy industry ecosystem and in order to effectively implement and sustain security controls on industrial infrastructure, we're all reliant on a complex ecosystem of people (system vendors, project engineering contractors, process operators, IT service providers and maintenance/support personnel) who require a blended set of IT/Engineering/Cyber Security competencies - a skill-pool which is unique and scarce in today's marketplace," said Tyler Williams, Manager, PCD IT Security Solutions at Shell and Chair of the industry consortium. "Developing and maintaining this workforce can be a challenge for any one organization and that is why we support this collaborative effort to establish a community developed body of knowledge and certification program for industrial cyber security. "

GIAC and the industry leaders have worked to establish a panel of Subject Matter Experts (SME) to identify the knowledge, skills and abilities necessary to develop the certification objectives for the GICSP. The SME panel met in Houston, Texas in May 2013, to begin this process. A further outcome of the SME panel is to develop a Job Task Analysis survey, which is sent to a broad array of critical infrastructure participants to ensure the certification aligns to job duties. The GICSP expects adoption on a global basis as a gateway certification in the cyber security domain for industrial control systems.

"GIAC is actively engaging with industrial control systems (ICS) security and engineering experts to develop a broad based and foundational certification that will begin to prepare enterprises, global agencies and governments to mitigate and implement a process to address ICS cyber security concerns," said Michael Assante, SANS ICS Director.

The global industry experts involved in this initiative include representatives from the following national and international companies:

-- ABB

-- BP

-- Cigital

-- Cimation

-- Emerson Process Management

-- Global Information Assurance Certification

-- Industrial Automated and Control Systems & Smart Grids Thematic Group,

ERNCIP project, European Commission's Joint Research Centre

-- Invensys

-- KPMG

-- Pacific Gas & Electric

-- Phoenix

-- Red Tiger Security

-- Rockwell Automation

-- SANS Institute

-- Schneider Electric

-- Shell

-- TNO

-- Wurldtech

-- Yokogawa

About GIAC

Global Information Assurance Certification (GIAC) is a certification body featuring over 25 hands-on, technical certifications in information security.

GIAC has certified over 51,000 IT security professionals since it was founded in 1999. The GIAC program is accredited under the IEC/ISO/ANSI 17024 quality standard for certifying bodies. GIAC is an affiliate of the SANS Institute.

(www.GIAC.org)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3304
Published: 2014-10-30
Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.

CVE-2013-7409
Published: 2014-10-30
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.

CVE-2014-3446
Published: 2014-10-30
SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.

CVE-2014-3584
Published: 2014-10-30
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

CVE-2014-3623
Published: 2014-10-30
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vect...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.