Sort By:

The European Cyber Security Challenge: Lessons Learned report

IOTSI Members can display IOTSI member badge on their websites and professional associations.

This publication is designed for readers with little or no knowledge of blockchain technology 103
 who wish to understand at a high level how it works and for what it can be used. It is not 104
 intended to be a technical guide; the discussion of the technology is abstracted to provide a 105
 conceptual understanding. Note that some figures and tables are purposefully simplified to fit the 106
 intended audience.

48 National Institute of Standards and Technology
49 Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology
50 National Institute of Standards and Technology Internal Report 8202
51 59 pages (January 2018)
52 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an
53 experimental procedure or concept adequately. Such identification is not intended to imply recommendation or
54 endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best
55 available for the purpose.
56 There may be references in this publication to other publications currently under development by NIST in accordance
57 with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies,
58 may be used by federal agencies even before the completion of such companion publications. Thus, until each
59 publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For
60 planning and transition purposes, federal agencies may wish to closely follow the development of these new
61 publications by NIST.
62 Organizations are encouraged to review all draft publications during public comment periods and provide feedback to
63 NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at
64 https://csrc.nist.gov/publications.

In this paper we present an overview of security threats to the cyber infrastructure of industrial and power plants and the current state of affairs of industrial and SCADA cyber security. Control systems security is of prime importance especially for energy sector. North American Electric Reli-ability Council (NERC) has issued mandatory rules which must be complied by 2010 by all registered power opera-tors in order to ensure control systems security for power  plants. Cyber security assessment was conducted on ICS (Industrial control systems) of different companies for a  period of four years and several vulnerabilities were iden-tified. Main problems included use of weak encryption,standard protocols and information disclosure using unen-crypted communication among ICS hosts on the network.

Limited Public Access - For complete document access login required.

ABSTRACT: We talk about how to best protect Australia against cyberterrorist attacks of the type in which
the offenders use a computer to attack or in which the offenders attack computers. Our concern is phenomena
like Stuxnet and Ransomware, but also any attack that has not yet happened, as for our official records, so say
hacking of satellite and use of its allowances to burn people alive to death. We talk about the basics, which
could be the advice of FireEye, and we talk about the sophisticated, which could be what is not yet printed. We
worry about actions that could be considered part of the intelligence system, so things that demand detailed
study of the past and systemic plus organised collection of data in the present. We do not talk about how to deal
with Acts of War: Only about how to protect our systems to best so that we do not get those happening via
computer or from a computer.

Every passing year has become more digital when compared to the preceding one. One of the
defining aspects of the new age is that the activities we used to pursue on a physical level have
 been transferred to a digital level. We communicate, we find dates, we read, we learn, we mourn,
we celebrate, we find our way and we do much more of our everyday practices online.

A Cyber Security Framework for Independent Hotels
Enrico Panai
University of Sassari, Italy
This email address is being protected from spambots. You need JavaScript enabled to view it.
It is generally not recommended to start developing an IT security management system (ISMS) without first having an understanding how to establish and implement the ISMS. This document, the step-by-step guide, is intended to (1) mitigate the risks of establishing a flawed system, and (2) to describe steps to establish and implement ISMS that, if required, would be in full compliance with the ISO/IEC 27001:2013 (what the current  ISO/IEC 27003:2010 guidance does not provide).  The  step-by-step  guide  represents  a  tailored  and  updated  version  of  the  official  ISMS  implementation guidance published  by  the  ISO/IEC  and  known  as ISO/IEC  27003:2010. The document describes steps that should  be  considered  when  establishing,  implementing  and  operating  an  effective  cybersecurity management system.
PDF | Step-by-step guidance on how to establish, implement and operate cybersecurity management system (ISMS).

We describe an approach for analysing and attacking the physical part (a process) of a cyber-physical system. The
stages of this approach are demonstrated in a case study, a simulation of a vinyl acetate monomer plant. We want
to demonstrate in particular where security has to rely on expert knowledge in the domain of the physical components
and processes of a system and that there are major chal-lenges for converting cyber attacks into successful cyber-
physical attacks.

IoTSI Overview with SRMP overlay

Includes a security  risk management plan.

Patient monitoring aims to collect health-related data independently of the patient's location. This helps not only to sample data under every-day conditions, at work or at home, but also gives control to the patients, because they can get immediate feedback in critical situations. For instance, a wrist watch with a wearable sensor (referred to as "wearable" or simply as "(mobile) device") can measure vital signs as blood pressure or heart rate.

Login Required to view and/or download document. 

Broad technological advancements have contributed to the Internet of Things (IoT)phenomenon, where physical devices now have technology that allow them to connect to theinternet and communicate with other devices or systems. With billions of devices beingconnected to the internet, many industries, including healthcare, have leveraged, or arebeginning to leverage, IoT devices to improve operational efficiency and enhance innovation.

Abstract Cybersecurity Dynamics is new concept that aims to achieve the modeling, analysis, quantification, and management of cybersecurity from a holistic perspective, rather than from a building-blocks perspective. It is centered at modeling and analyzing the attack-defense interactions in cyberspace, which cause a “natural” phenomenon— the evolution of the global cybersecurity state. In this Chapter, we systematically introduce and review the Cybersecurity Dynamics foundation for the Science of Cybersecurity. We review the core concepts, technical approaches, research axes, and results that have been obtained in this endeavor. We outline a research roadmap towards the ultimate research goal, including a systematic set of technical barriers.

Security Guidance Application of the Security Triage Process_v1

APPLICATION OF THE SECURITY TRIAGE PROCESS. Linke is also embedded within Adopting a Baseline Security Approach for Design and Construction of Built Assets document.

Login Required to view and/or download document. 

IoTSI Smart Cities & CI Framework Release 1 - Overview

Overview of the IoTSI Framework. Includes methodologies, processes and engagement models.This document provides a walkthrough of the IoTSI Framework. The what and how of the IoTSI Framework.

Login Required to view and/or download document. 

Facilitation Guide Release One

This document provides guidance and support for those leading the implementation of the IoTSI Framework into the system’s lifecycle. The Framework aims to perform a risk assessment and related activities for a complex chain of events, focusing on developing a risk-analysis approach capable of handling the complexity of today’s cybersecurity attacks

Login Required to view and/or download document. 

 Workbooks_ALL_Release One

All IoTSI Workbooks and instructional material. Free Download.

Login Required to view and/or download document. 

Organisational Readiness Survey

This can be considered Phase One of the IoTSI Framework. Prior to the assessment of the proposed  IoT/ IIoT Solution an organisational readiness assessment CSAT (Cyber Security Assessment Tool)  is conducted to ascertain the overall cyber majority model and the depth of security controls deployed within the organisation.  This is a critical component of a Cyber Security Assessment Plan and should be implemented prior to an IoT/ IIoT deployment.

Provides an assessment of the current technology landscape. This is achieved by utilising a NIST assessment tool to determine the current maturity levels of the organisation. Such an approach allows for a pre IoT deployment view of what the current state of controls are within a given environment. This is a critical stage of the framework allowing for decision making prior to any procurement or deployment process has commenced.

Press Release: Partnership acknowledges a “time to act” approach to cyber and privacy security within the smart cities and critical infrastructure sectorsWASHINGTON, USA, March 26, 2019 -- The IoT Security Institute (IoTSI) announced today that it has established a collaborative partnership with MEASC and Quill Security Technology.

SCCISP Eligibility Criteria

To support the demand for skilled security and privacy professionals with the required knowledge and background to support the emerging security challenges within IoT- IIOT Smart Cities and Critical Infrastructure domains, the IoT Security Institute is offering the certification: Smart Cities & Critical Infrastructure Security Professional (SCCISP) to candidates that meet the IoTSI SCCISP eligibility criteria. 



The concept of Cybersecurity Culture (CSC) refers to the knowledge, beliefs, perceptions, attitudes, assumptions, norms and values of people regarding cybersecurity and how they manifest themselves in people’s behaviour with information technologies. CSC encompasses familiar topics including cybersecurity awareness and information security frameworks but is broader in both scope and application, being concerned with making information security considerations an integral part of an employee’s job, habits and conduct, embedding them in their day-to-day actions.

This paper is the result of a research project carried out by Labs in EVRY Financial Services during the fall of 2015. The content of this report is the result of a comprehensive study, featuring online sources, literary works, as well as recordings of financial conferences such as Consensus 2015 and Fintech Week 2015. We aim to provide a comprehensive report detailing the opportunities, challenges and key success factors for financial institutions looking to leverage the opportunities presented by blockchain technology. We hope you enjoy this study and that it helps give you greater understanding.