GB/T 26333-2010Evaluation specification for security in industrial control network (English PDF)

Foreword

This standard was drafted in accordance with GB/T 1.1-2009 given rules.

Some contents of this standard may involve certain patents, the present standard of any such patent shall not bear responsibility for identification. The standard proposed by China Machinery Industry Federation.

The standard measurement and control by the National Standardization Technical Committee of industrial processes.

Introduction

With the various communication technologies are widely used in industrial control networks, in more functionality while industrial control network security asked Problem has become increasingly prominent.

This assessment is a standard for industrial control network security risk assessment methodology. Through the industrial control network security risk assessment You can find the network security risks by adopting appropriate security measures to make security vulnerabilities, thereby enhancing the industrial control network security.

This standard specifies the industrial control network security risk assessment methodology and general guidelines, describes industrial control network security risk assessment The general procedure design focuses on the assessment and evaluation of the analytical program.

1 Scope

This standard specifies the procedure for evaluating and gives recommendations on evaluation methods.

This standard applies to industrial control network security risk assessment, the definition of the main points of the assessment.

This standard is discussed in industrial control network communications security, which depends primarily on protective measures system used.

2 Normative references

The following documents for the application of this document is essential. For dated references, only the dated version suitable for use herein Member. For undated references, the latest edition (including any amendments) applies to this document.

GB/T 9361-1988 computer site security requirements

GB/T 9387.2-1995 Information processing systems - Open Systems Interconnection - Basic Reference Model - Part 2: Security Architecture

GB 17859-1999 computer information system security protection classification criterion

GB/T 17903.1-2008 Information technology - Security techniques - Non - repudiation - Part 1: Overview

GB/T 17965-2000 Information technology - Open Systems Interconnection - Upper layers security model (idt ISO /IEC 10745:1995)

GB/T 18272.1-2000 industrial process measurement and control system evaluation of system properties assessment - Part 1: General and methods

GB/T 18272.2-2000 industrial process measurement and control system evaluation of system properties assessment - Part 2: Assessor methods

GB/T 18272.3-2000 industrial process measurement and control system evaluation of system properties - Part 3: System Function Evaluation

GB/T 18272.7-2006 industrial process measurement and control system evaluation assessment - Part 7 System features. System Security Evaluation

GB/T 18336.1-2008 Information technology - Security techniques - Evaluation criteria for IT security - Part 1: Introduction and general Model (ISO /IEC 15408-1:2005, IDT)

GB/T 18336.2-2008 Information technology - Security techniques - Evaluation criteria for IT security - Part 2: Security functional to Demand (ISO /IEC 15408-2:2005, IDT)

GB/T 18336.3-2008 Information technology - Security techniques - Evaluation criteria for IT security - Part 3: Security assurance to Demand (ISO /IEC 15408-3:2005, IDT)

GB/T 19715.1-2005 Information technology IT Security Management Guide - Part 1: Concepts and models for IT Security

GB/T 20000.4-2003 Guide for standardization - Part 4: Safety aspects Standard

GB/T 20269-2006 Information Security techniques - Information security management systems requirements

GB/T 20270-2006 Information security technology security technology network infrastructure requirements

GB/T 20271-2006 Information security technology - Common security techniques requirement information system

GB/T 20275-2006 Information technology security intrusion detection system technical requirements and test evaluation methods

GB/T 20278-2006 Information security technology for network vulnerability scanning product technical requirements

GB/T 20281-2006 Information security technology firewall technology requirements and testing and evaluation approaches

GB/T 20945-2007 Information security technology information system security audit requirements and product testing and evaluation methods […]