这国际自动化学会（ISA，www.isa.org）announced on March 3 that the ISA99 standards committee on Industrial Automation and Control Systems Security has formed a task group to conduct a gap analysis of the current ANSI/ISA99 standards with respect to the rapidly evolving threat landscape, as demonstrated by the highly publicizedStuxnetmalware.
这purpose for the task group is to determine if companies following theISA99标准将受到保护，免受这种复杂的攻击，并确定ISA99委员会制定的标准所需的更改（如果有）。新任务小组指定为ISA99 WG5 TG2，打算制定一份技术报告，总结其分析结果到2011年中期。
Short work
后重新形成的任务组cent publication of a White Paper by industrial security experts Eric Byres, Andrew Ginter and Joel Langill that examines how the Stuxnet malware works. That paper, titled “How Stuxnet Spreads—a Study of Infection Paths in Best Practice Systems,” determines that existing best-practice industrial security measures are insufficient against sophisticated attacks such as Stuxnet. “Not surprisingly, we learned that a worm as complex as Stuxnet will make short work of even the best of today’s ICS (industrial control system) security architectures,” Byres wrote recently on his blog. That paper is available on Byres’ company’s Web site, following registration,here。
Stuxnet is a highly sophisticated computer worm that was first disclosed in the summer of 2010. It is the first known malware to have been specifically written with the intent to compromise a control system and sabotage an industrial process. Stuxnet’s capabilities are being well documented in the press, and some of these capabilities may migrate into new threats. Going forward, automation systems must be able to detect and either block or be able to recover from advanced Stuxnet-like threats.
这ANSI/ISA99 (for American National Standards Institute) standards address the vital issue of cyber security for industrial automation and control systems. The standards describe the basic concepts and models related to cyber security, as well as the elements contained in a cyber-security management system for use in the industrial automation and control systems environment. They also provide guidance on how to meet the requirements described for each element.
Essential stop
这ANSI/ISA99 standards form the base documents for the International Electrotechnical Commission’s IEC 62443 series of industrial automation (sometimes generically labeled “SCADA,” or supervisory control and data acquisition) security standards. Over the next few years, these standards will become core international standards for protecting critical industrial infrastructures that directly impact human safety, health, and the environment, the ISA said, and they will likely will be extended to other areas of application, even broader than those generically labeled “SCADA.” Based on this, it is essential that industrial companies following IEC 62443 standards know they will be able to stop the next Stuxnet. The work of the new ISA99 task group is intended to have a significant impact on ensuring that automation facilities are secure in the future.
这new task group is open to all cyber security subject matter experts. Interested parties are asked to contact Eric Byres, at eric@byressecurity.com.
国际自动化学会
www.isa.org
