Security for critical infrastructures

DHS details security requirements for automated control systems.

The US Department of Homeland Security (DHS) has laid out a set of security requirements for automated control systems to protect the country's critical infrastructure and key resources against online attacks.

The recommendations in the Catalog of Control System Requirements include basic IT security measures such as installing anti-virus software and keeping it fully up to date. The document indicates that, for maximum security, remote updates for security software should be scheduled for periods when the control system is disconnected from the equipment it controls. The document also recommends against using DNS for control systems, in order to protect against denial of service attacks, and against using Voice over IP, Instant Messaging, FTP, HTTP and file sharing on control systems.

Elsewhere the document, which was put together by representatives of the Department of Energy National Laboratories and the National Institute of Standards and Technology, details practices that are recommended to increase physical security, including organisational, personnel and environmental security practices. The full set of recommendations can be seen here.

01 August 2007

Tags: del.icio.us digg this