DHS issues security guidelines for U.S. power infrastructure operators

Growing fears about the vulnerability of U.S. critical infrastructure have led DHS to set out security requirements for automated control systems, principally in the power industry, to protect installations against physical and cyber attacks. Note that although the document deals with automated systems rather than data networks, it does includes recommendations about protection against spam and social engineering, threats not typically associated with control systems. Vnunet’s Andrew Charlesworth writes that Mountain View, California-based security firm Verisign expressed fears in its most recent weekly iDefense security bulletin that “so many of the problems that some hoped would either never migrate from the IT world into the control system world (social engineering, spam, etc) or be so rare as to be negligible, are apparently sufficient enough threats to be viewed as issues of concern for control systems.”

Many of the recommendations in the Catalog of Control System Requirements (draft) July 2007(PDF) report describe basic cyber-security measures. These include installing antivirus software and ensuring that DNS is not used for control systems to protect against denial of service attacks. Other recommendations include not using VoIP, IM, FTP, HTTP, and file sharing on control systems. The document also emphasizes that remote updates for antivirus software are performed when the control system is offline, that is, disconnected from the equipment it controls.

The draft catalog was drawn up in consultation with the National Institute of Standards and Technology (NIST) and four National Laboratories — Argonne, Idaho, Pacific Northwest, and Sandia. This very high level of cooperation is but one indication of the growing fear that physical or cyber attacks on the power infrastructure of the United States.