The goal of the DHS National Cyber Security Division's CSSP is to reduce industrial control system risks within and across all critical infrastructure and key resource sectors by coordinating efforts among federal, state, local, and tribal governments, as well as industrial control systems owners, operators and vendors. The CSSP coordinates activities to reduce the likelihood of success and severity of impact of a cyber attack against critical infrastructure control systems through risk-mitigation activities. These risk-mitigation activities have resulted in the following tools:

• Catalog of Control Systems Security: Recommendations for Standards Developers
• Cyber Security Evaluation Tool (CSET)
• CSSP Documents
• Critical Infrastructure and Control Systems Security Curriculum
• Cyber Security Procurement Language for Control Systems
• Recommended Practices
• Training
  

To obtain additional information or request involvement or assistance, contact cssp@hq.dhs.gov.

The DHS National Cyber Security Division (NCSD) recently issued the Strategy for Securing Control Systems, which focuses on the vision and elements necessary for coordinating activities to improve control systems security in the nation’s critical infrastructures. As the lead federal agency involved in industrial control systems cybersecurity for Critical Infrastructure and Key Resources (CIKR), NCSD continues to coordinate security efforts among stakeholders across critical infrastructure sectors. October 28, 2009

Now available: Developing an Industrial Control Systems Cybersecurity Incident Response Capability

CSSP has released a new Recommended Practice, Developing an Industrial Control Systems Cybersecurity Incident Response Capability. The document presents recommendations to help those facilities that use control systems better prepare for and respond to a cyber incident regardless of source. It also suggests ways to learn from incidents and to strengthen the system against potential attacks. The document includes accepted methods and approaches from tradition information technology, but is primarily focused on the unique aspects of industrial control systems. [7 October 2009]

DHS National Cyber Security Division Releases New Tool

The Cyber Security Evaluation Tool (CSET) is a new product of the Department of Homeland Security (DHS) National Cyber Security Division (NCSD). CSET assists organizations in protecting their key national cyber assets. It is a desktop software tool that guides users through a step-by-step process to assess their control system and information technology network security practices against recognized industry standards. The output from CSET is a prioritized list of recommendations for improving the cybersecurity posture of the organization's enterprise and industrial control cyber systems. Read more
[25 August 2009]

Common Cyber Security Vulnerabilities

The "Common Cyber Security Vulnerabilities Observed in DHS Industrial Control Systems Assessments" report presents results from 15 ICS assessments performed under the CSSP from 2004 through 2008. Although information found in individual stakeholder reports is protected from disclosure, the security of the critical infrastructure as a whole can be improved by sharing information on common security problems with those in industry responsible for developing and maintaining ICS. For this reason, vulnerability information was collected, analyzed, and organized in a way that the most prevalent issues could be identified and mitigated by those responsible for individual systems without disclosing the identity of the associated ICS product.

What's New