GB/T 33007-2016Industrial communication networks -- Network and system security -- Establishing an industrial automation and control system security program (English PDF)

0.1 Overview

Network security is an increasingly important topic in modern organizations. Over the years, many organizations involved in information technology and business have been Attention to network security, and in accordance with the ISO and IEC standards have been established an effective network security management system (CSMS) (see ISO/IEC 17799 [23] 1 and ISO/IEC 27001 [24]), these management systems provide an effective way for the organization to protect their assets from cyber attacks.

The Industrial Automation Control System (IACS) organization has begun to use commercially available off-the-shelf technology for business systems in its daily processes (COTS), which makes the IACS equipment by the possibility of network attacks increased. Due to various reasons, in the fight against the network attack side these systems are usually less robust than those designed for the IACS environment. These weaknesses can lead to health, safety and environmental aspects (HSE) consequences.

Without understanding these consequences, the organization may attempt to use existing information technology and business security solutions to address IACS security issues. Although many solutions can be applied to IACS, but need to take the right way to eliminate the adverse consequences.

0.2 IACS network security management system

The management system usually provides guidance on what should be included in the management system, but does not provide guidance on how to develop the management system. this the standard describes the elements contained in the CSMS of IACS, and also provides guidance on how to develop CSMS for IACS.

In the face of a challenging problem, a very common engineering approach is to break down the problem into smaller sub-problems, Way to solve each sub-problem. This is a reasonable way to solve the IACS network security risk. However, in the settlement of network security often committed the mistake is to try to solve all the network security problems with a system at once. Network security is a bigger challenge that needs to be considered throughout IACS and policies, procedures, practices and personnel that surround and utilize IACS. Implementing such a wide range of management systems may be required within the organization Department of cultural change.

It is a daunting task to solve network security on the basis of the whole organization. But for security, there is no ready solution Program. It is easy to understand because there is no safe practice for all situations. In theory, absolute security may be possible, but it is possible can not be desirable, because to achieve such a near-perfect state is bound to lose practicality. Security is actually a risk and cost balance. All the situation is different. In some cases, the risk may be related to the HSE factor rather than the mere economic impact. wind Risk may bring irreversible consequences rather than temporary financial setbacks. So a set of mandatory safety practices is either a solution in strict, expensive to follow, or not enough to deal with the risk.

The relationship between this standard and ISO/IEC 17799 and ISO/IEC 27001 ISO/IEC 17799 [23] and ISO/IEC 27001 [24] are excellent descriptions of network security management systems for business/information technology systems standard. Most of the contents of these standards also apply to IACS. This standard emphasizes the management and business/information of IACS network security practices There is a need for consistency between the management of technical systems for network security. Consistency of these procedures can save money. The standard encourages users to read ISO/IEC 17799 and ISO/IEC 27001 for additional support information. This standard is based on these ISO/IEC standards IACS and general business/information technology systems. This standard introduces an important concept that IACS's network security risks can be can bring HSE impact, should be combined with other existing risk management practices to deal with these risks.

Industrial communication network and system security Establish industrial automation and control System security program

3.1 Terms and definitions

IEC 62443-1-1 and the following terms and definitions apply to this document.

3.1.1

Access account Allows the user to access the access control function of a specific device or feature set for a fixed device.

Note. Accounts are often associated with the user's identity (ID) and password. These user IDs and passwords can be shared by individuals or groups, for example, to perform the same the task of working in the control room working group.

3.1.2

Administrative practice Well-defined and documented practice/procedures for employees to always comply.

Note. usually used for employees within the enterprise. In the IACS environment, often associated with HSE.

3.1.3

Assets

A physical or logical object owned or kept by an organization that has a potential or actual value to the organization [IEC 62443-1-1, 3.2.6]