In a move that may be helpful for utilities, the Industrial Control Systems Joint Working Group (ICSJWG)on July 23 published a new document on a framework for disclosing Industrial Control System (ICS) vulnerabilities.

Industrial Control Systems Joint Working Group (ICSJWG), which was established by the U.S.  Department of Homeland Security Control Systems Security Program, published the document -- Common Industrial Control System Vulnerability Framework. The document was developed with the intention of providing consensus-based guidance to vendors and system integrators in helping them create ICS vulnerability disclosure policies.  Unfortunately, the industrial control systems/supervisory control and data acquisition(ICS/SCADA) industry has been criticized for less than effective disclosures of vulnerabilities in critical infrastructure systems and products.  This new document is intended to provide a foundation for the industry to follow once vulnerabilities are discovered and how the faults should be revealed to the vendors and the operators for remediation.

The ICSJWG notes that the new paper is “a living document and will continue to evolve to reflect the expectations of both asset owners and the IT community in general.’’

The document can be a good starting point.  Key sections include:

• Software Vulnerabilities (Types and Associated Remediation)
• Mechanisms for Identifying Vulnerabilities
• Types of Disclosure (Private, Public, Third-Party)
• Vulnerability Disclosure Policy Components
• Terminology/Glossary
• Sample Disclosure Policy Overview
• References

If you work with ICS/SCADA systems and if you could be in a situation where you are aware of vulnerabilities but do not have a sense of how they should be handled and revealed, I’d strongly suggest you look over this framework as a guide.  Secondly, if your company develops and/or tests ICS/SCADA software, then this framework can be a good starting point in developing your own internal policy and procedures for handling and ultimately disclosing newly discovered ICS vulnerabilities.