Improving Critical Infrastructure Cybersecurity: An explanation of the NIST framework

NIST’s Vicky Yan Pillitteri, at the 2014 ARC Forum, discussed the NIST Cybersecurity Framework, and today’s release of the Executive Order 13636, Improving Critical Infrastructure Cybersecurity.

02/13/2014


Preview of the Feb. 13 U.S.cyber security announcement was given by Vicky Yan Pillitteri, NIST, on Feb. 11, at the 18th Annual ARC Industry Forum. Executive Order 13636, Improving Critical Infrastructure Cybersecurity, is expected to have provisions for sThe U.S. federal government partnered with the private sector to strengthen cybersecurity for critical infrastructure sectors, according to those involved. Vicky Yan Pillitteri, NIST, while at the 2014 ARC Forum, discussed the NIST Cybersecurity Framework and today's release of the Executive Order 13636, Improving Critical Infrastructure Cybersecurity.

The policy creates a framework to reduce cybersecurity risks by sharing threat information. It was developed, Pillitteri said, by consulting standards and holding workshops with key stakeholders to develop methods, procedures, and process as part of the framework.

Cybersecurity differs across industries. Finance and water industries, for instance, differ in their needs and approaches. Given this heterogeneity, the framework needed to be agile, repeatable, and effective, she said.

3 main elements to cybersecurity framework

The framework contains three main elements:

1. Core: The core incorporates industry standards, guidelines, and best practices. The steps are to identify threats, protect, detect, respond, and recover. Categories and subcategories for each of the five steps are matched with descriptions of and links to informative resources.

2. Tiers: Implementation tiers provide context on how an organization views cybersecurity risk and how to manage that risk. Tiers range from partial to adaptive.

3. Profile: The profile aligns functions, categories, and subcategories to fit risks within organizations.

The cyber security framework is intended for organizations to:

  • Review practices
  • Establish or improve themselves
  • Communicate with stakeholders
  • Identify opportunities for new or revised informed references
  • Incorporate methods to protect privacy and civil liberties.

The framework also includes defined adoption criteria and steps needed. But the first goal will always be to support the industry and increasing awareness of cybersecurity considerations.

Version 1.0 of the framework (it will evolve) is available today, Feb. 13, in the Federal Register and on the NIST Cybersecurity Framework site. It includes a draft to identify the next steps for further development and harmonization. A roadmap includes issues to address, such as supply chain connections to critical infrastructure.

- Mark T. Hoske, content manager CFE Media, Control Engineering, and Plant Engineering, mhoske(at)cfemedia.com.



No comments
Consulting-Specifying Engineer's Product of the Year (POY) contest is the premier award for new products in the HVAC, fire, electrical, and...
Consulting-Specifying Engineer magazine is dedicated to encouraging and recognizing the most talented young individuals...
The MEP Giants program lists the top mechanical, electrical, plumbing, and fire protection engineering firms in the United States.
Water use efficiency: Diminishing water quality, escalating costs; Lowering building energy use; Power for fire pumps
Building envelope and integration; Manufacturing industrial Q&A; NFPA 99; Testing fire systems
Labs and research facilities: Q&A with the experts; Water heating systems; Smart building integration; 40 Under 40 winners
Maintaining low data center PUE; Using eco mode in UPS systems; Commissioning electrical and power systems; Exploring dc power distribution alternatives
Protecting standby generators for mission critical facilities; Selecting energy-efficient transformers; Integrating power monitoring systems; Mitigating harmonics in electrical systems
Commissioning electrical systems in mission critical facilities; Anticipating the Smart Grid; Mitigating arc flash hazards in medium-voltage switchgear; Comparing generator sizing software
As brand protection manager for Eaton’s Electrical Sector, Tom Grace oversees counterfeit awareness...
Amara Rozgus is chief editor and content manager of Consulting-Specifier Engineer magazine.
IEEE power industry experts bring their combined experience in the electrical power industry...
Michael Heinsdorf, P.E., LEED AP, CDT is an Engineering Specification Writer at ARCOM MasterSpec.