topic CIA has a new I - Industrial security in Industry News

CIA has a new I - Industrial security

Flyslinger2 — Tue, 15 Jan 2019 15:09:06 GMT

Good article about large entities recognizing the need to take ownership of cybersecurity.

I get the need for industrial security, I'm dealing with it right now. But should it be added to the infamous CIA triad?

Re: CIA has a new I - Industrial security

Caute_cautim — Tue, 15 Jan 2019 21:56:22 GMT

@Flyslinger2 wrote:
Good article about large entities recognizing the need to take ownership of cybersecurity.

I get the need for industrial security, I'm dealing with it right now. But should it be added to the infamous CIA triad?

But where would you add the I before CIA, after it or in between? Or do what IoT does just add the extra I at the front to designate Industrial? E.g. IIoT or ICIA - which sort of rolls off the tongue.

Regards

Caute_cautim

Re: CIA has a new I - Industrial security

CraginS — Wed, 16 Jan 2019 02:41:58 GMT

@Flyslinger2 wrote:

I get the need for industrial security, I'm dealing with it right now. But should it be added to the infamous CIA triad?

NO, because C-I-A is about information security. Industrial security is a broader construct that includes physical security, information security, counter espionage, executive protection, and other aspects of protection.

The right place for information security / information assurance / cybersecurity (the focus of C-I-A) is as a subcomponent of industrial security. Don't try to shoe-horn other aspects of overall security into the C-I-A triad.

Re: CIA has a new I - Industrial security

Caute_cautim — Wed, 16 Jan 2019 03:39:42 GMT

@CraginS

I do tend to agree, Industrial security is very much about secure engineering and a discipline that goes with it.

Regards

Caute-Cautim

Re: CIA has a new I - Industrial security

Flyslinger2 — Wed, 16 Jan 2019 14:36:40 GMT

@CraginS wrote:
NO, because C-I-A is about information security. Industrial security is a broader construct that includes physical security, information security, counter espionage, executive protection, and other aspects of protection.

The right place for information security / information assurance / cybersecurity (the focus of C-I-A) is as a subcomponent of industrial security. Don't try to shoe-horn other aspects of overall security into the C-I-A triad.

Which was my thought as well. I was a little surprised that they tried to worm it in there.

I appreciate those big names in industry trying to lead the way by example. I'd much rather have industry do that then a government. Governments are about confiscation of wealth to further it's mission since it can't generate any income on it's own, unless they ramp up the printing presses. Confiscating income from businesses always has detrimental affects. If industry establishes the standards, holds each other accountable, and reports on the results of those standards we are much better off.