By Isiah Jones, MPS, CISSP, GICSP, C|CISO, Director, ICS Cyber Security Engineering
This is the second blog post in our series that explores the ICS Security Manager as a Service concept. To review Part 1, please visit ICS Security Manager as a Service – Part 1.
In my travels over the last four years, I’ve consistently encountered the same old tragedy over and over again regardless of what type of critical infrastructure asset type or sector vertical it was and regardless of what state, nation, continent, company and or military base it was. That tragedy was constantly connecting with and trying to support engineers and other personnel building security into active in-flight projects for both existing and new infrastructure monitored and controlled by some type of industrial automation and or control system device, network, protocol, system and or application.
I usually found many issues within contracts, cultures, and understanding of system design, integration, system configurations, validation, testing, requirements specifications and contract language or systems security engineering principles in general. I also consistently found very small teams, mostly a team of one on the ICS side and a team of totally ill-informed bull in the china shop folks on the IT teams. In other cases, I found teams of impossible to work with engineers and desperately anxious IT staff. One day on a project it hit me: why do I continue to create templates, steps and solutions and share them with folks who either don’t have the time to implement and maintain them, aren’t interested in the first place or honestly have no idea what it is that I just provided them? Why don’t I just complete the task for them, show them how I did it, show them how to maintain it then periodically return to make sure it is maintained? Thus, the idea for ICS Security Manager as a Service was born in my head at the time.
The next post in our series will explore why the ICS Security Manager as a Service is needed.