How industrial control system security training is falling short

Abstract

Industrial control systems monitor and manage critical infrastructure assets. Every sector relies extensively on the proper operation of control systems and a major disruption could have devastating consequences to the economy and society. Protecting industrial control systems requires large numbers of well-trained security personnel to detect and respond to increasingly sophisticated cyber attacks. This chapter evaluates current government and industry training courses in the area of industrial control systems security. The results indicate that training is typically geared towards the basic or intermediate knowledge levels and that adequate advanced training programs are not readily available. A primary deficiency is the lack of robust training facilities that incorporate real critical infrastructure assets. Additionally, the curricula do not sufficiently incorporate the physical components and processes associated with industrial control systems. Indeed, there is a great need for training facilities that incorporate real-world industrial control systems and processes to provide trainees with a strong understanding of the effects that cyber-initiated actions have on physical processes. While major investments are required to create advanced curricula and training facilities, they will contribute significantly to the important task of protecting the critical infrastructure.