ICS-ISAC Chair Chris Blask noted that Cyber Senate is an example of an information sharing organization which spans key demographics. “The mission of information sharing involves many stakeholders groups across the entire global community. Cyber Senate captures key thought leaders and works to share information among them and with critical communities. We see Cyber Senate as a highly valuable organization and are pleased to support the good work they are doing.”
Join the Cyber Senate on March 16th in London for an in-depth discussion on the current and future threat, how the industry is responding, the absolute importance of “Security by Design,” the challenges that bridging IT and OT bring in deploying enterprise facing architecture and how to further develop a culture of awareness. Cyber threats are growing in frequency and capability across every industry, but none carry more consequences than those carried out against critical national infrastructure. The global rail industry is where the Smart Grid industry was 10 years ago, now realising that through advanced connectivity and digitisation that greater levels of efficiency and optimisation can be achieved, reduction of carbon footprints and greater value can be provided to both asset owners and operators, passengers and shareholders. The rush to next generation infrastructure however is not with out its vulnerabilities. The proliferation of machine to machine sensors, the Internet of Things and the convergence of IT and OT – two very different disciplines, has extended the attack surface dramatically for an industry historically isolated from modern day cyber threats. Join the Cyber Senate on March 16th in Londonfor an in-depth discussion on the advancing threat, the reality of security of our future rail networks, the absolute importance of “Security by Design,” the challenges that bridging IT and OT bring in deploying enterprise facing architecture and more. This is a unique opportunity to address key cyber issues in the design stage within the rail industry, so let us begin. A strong cyber security strategy saves lives. All stakeholders have a responsibility in ensuring the safety, reliability and stability of our Critical National Infrastructure. Information sharing is paramount in educating ourselves and the industry
The Cyber Senate are pleased to announce the IAEA will be joining us as Key Note presenters on the Industrial Control Cyber Security Nuclear conference we will be hosting in Warrington UK, May 24-25th 2016.
For further information see www.industrialcontrolsecuritynuclear.com
According to Symantec, “A new information stealer, Trojan.Laziok, acts as a reconnaissance tool allowing attackers to gather information and tailor their attack methods for each compromised computer.”
More information can be found on Symantecs blog and we highly suggested familiarising your firm with this latest threat as although it is focused on the Middle East, it started as a “Multi staged attack campaign against energy companies around the world.”
“The Energy Sector led all others again in 2014 with the most reported incidents” Please find the report here https://ics-cert.us-cert.gov/sites/default/files/Monitors/ICS-CERT_Monitor_Sep2014-Feb2015.pdf
“Of the total number of incidents reported to ICS-CERT, roughly 55 percent involved advanced persistent threats (APT) or sophisticated actors. Other actor types included hacktivists, insider threats, and criminals. In many cases, the threat actors were unknown due to a lack of attributional data.”
Those involved in the security sector however are quoting numbers for higher than this, as many incidents go unreported.
The Cyber Senate are pleased to announce Mr Marty Edwards, Director ICS CERT, Department of Homeland Security will be joining us as the Key Note speaker on October 13th and 14th in Sacramento California for the 2nd annual Industrial Control Cyber Security USA conference.
Assistant Deputy Director, National Cybersecurity and Communications Integration Center (NCCIC) Director, Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) Department of Homeland Security Marty Edwards is the Director of the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), an operational division of the department’s National Cybersecurity and Communications Integration Center (NCCIC) and the DHS Office of Cybersecurity and Communications (CS&C) ICS-CERT works to reduce industrial control system risks within and across all critical infrastructure and key resource sectors by coordinating efforts among federal, state, local and tribal governments, as well as industrial control systems owners, operators and vendors. In collaboration with the other NCCIC components the ICS-CERT responds to and analyzes control systems related incidents, conducts vulnerability and malware analysis, and shares and coordinates vulnerability information and threat analysis through products and alerts.
Mr. Edwards has over 20 years of experience and brings a strong industrial control system industry focus to DHS. Before coming to the ICS-CERT, Mr. Edwards was a program manager focused on control systems security work at Idaho National Laboratory. Prior to his work at the laboratory, Mr. Edwards held a wide variety of roles in the instrumentation and automation fields, including field service, instrument engineering, control systems engineering and project management. Mr. Edwards has also held various positions in nonprofit organizations, including Chairman of the Board for one of the automation communities’ largest user group conferences. Mr. Edwards holds a diploma of technology in Process Control and Industrial Automation (Magna cum Laude) from the British Columbia Institute of Technology.
According to Skynews, “some 140 million people were left without electricity after a transmission line was attacked, knocking out the national grid.”
Power has been restored to much of Pakistan after more than 140 million people were plunged into darkness due to an apparent rebel attack on a key power line.
Up to 80% of the country’s population lost electricity in the early hours of Sunday and disruption was reported at Lahore’s international airport, but flights were not affected.
“In GCHQ we continue to see real threats to the UK on a daily basis, and I’m afraid the scale and rate of these attacks shows little sign of abating.”
The government has worked with the Information Assurance for Small and Medium Enterprises (IASME) consortium and the Information Security Forum (ISF) to develop Cyber Essentials, a set of basic technical controls for organisations to use.
Download Cyber Essentials documents here: https://www.cyberstreetwise.com/cyberessentials/
The full scheme, launched on 5 June 2014, enables organisations to gain 1 of 2 new Cyber Essentials badges. It is backed by industry including the Federation of Small Businesses, the CBI and a number of insurance organisations which are offering incentives for businesses.
The Cyber Essentials Requirements document sets out the necessary technical controls. The Assurance Framework shows how the independent assurance process works and the different levels of assessment organisations can apply for to achieve the badges. It also contains guidance for security professionals carrying out the assessments.
From 1 October 2014, government requires all suppliers bidding for certain sensitive and personal information handling contracts to be certified against the Cyber Essentials scheme.
More information available here : https://www.gov.uk/government/publications/cyber-essentials-scheme-overview#history
CYBER ESSENTIALS SCHEME
The Cyber Essentials scheme provides businesses small and large with clarity on good basic cyber security practice. By focussing on basic cyber hygiene, your company will be better protected from the most common cyber threats.
Cyber Essentials is for all organisations, of all sizes, and in all sectors – we encourage all to adopt the requirements as appropriate to their business. This is not limited to companies in the private sector, but is also applicable to universities, charities, and public sector organisations.
Cyber Essentials is mandatory for central government contracts advertised after 1 October 2014 which involve handling personal information and providing certain ICT products and services. Find out more here.
The Cyber Essentials scheme has been developed as part of the UK’s National Cyber Security Programme and in close consultation with industry.