Where does ICS Cyber Security Fit?

At the request of the Office of the Director of National Intelligence, the National Research Council (NRC) is undertaking a project entitled “Deterring Cyberattacks: Informing Strategies and Developing Options for U.S. Policy.”  In a world of increasing dependence on information technology, the prevention of cyberattacks on a nation’s important computer and communications systems and networks is a problem that looms large. Given the demonstrated limitations of passive cybersecurity defense measures (that is, measures taken unilaterally by an organization to increase the resistance of an information technology system or network to attack), it is natural to consider the possibility that deterrence might play a useful role in preventing cyberattacks against the United States and its vital interests. There were 51 questions of interest from the following categories:
- Theoretical Models for Cyberdeterrence
- Cyberdeterrence and Declaratory Policy
- Operational Considerations in Cyberdeterrence
- Regimes of Reciprocal/Consensual Limitations
- Cyberdeterrence in a Larger Context
- The Dynamics of Action/Reaction
- Escalation Dynamics
- Collateral Issues

Of the 51 questions, only 6 even tangentially addressed critical infrastructure ICSs.  Reminiscent of the RSA Conference, an abstract to respond to the solicitation was not accepted because ICSs didn’t fit. In fact, the chief scientist told me “The Computer Science and Telecommunications Board (CSTB) has been trying to prompt attention to ICS issues for a while, but this project isn't an appropriate venue.”  What is the appropriate venue?

Joe Weiss