Industrial Control Systems (ICS) monitor and control physical processes in many different industries and sectors. Cyber attacks against ICS devices present a real threat to organizations that employ ICS to monitor and control manufacturing processes. The NIST Engineering Laboratory (EL), in conjunction with the National Cybersecurity Center of Excellence, will produce a series of example solutions demonstrating four cybersecurity capabilities for manufacturing organizations. Each example solution will highlight an individual capability: Behavioral Anomaly Detection, ICS Application Whitelisting, Malware Detection and Mitigation, and ICS Data Integrity. This document is part one of a four-part series and addresses only behavioral anomaly detection capabilities.

With these capabilities in place, manufacturers may find it easier to detect anomalous conditions, control what programs and applications are executed in their operating environments, mitigate malware attacks, and ensure the integrity of critical operational data.

For each of the four capabilities listed above, the NIST EL and the NCCoE will map the security characteristics to the NIST Cybersecurity Framework (CSF), which will provide standards-based security controls for manufacturers. In addition, the EL and the NCCoE will implement each of the capabilities in two distinct but related lab settings: a robotics-based manufacturing enclave and a process control enclave that resembles what is being used by chemical manufacturing industries.

This project will result in a publicly available NIST Cybersecurity Practice Guide, a detailed implementation guide of the practical steps needed to implement the cybersecurity example solution that addresses this challenge.