GB/T 33008.1-2016Industrial automation and control system security—Programmable logic controller(PLC)—Part 1: System requirements (English PDF)

3.1 Terms and definitions

The following terms and definitions apply to this document.

3.1.1 Programmable (logic) controller (PLC)

It refers to an electronic system for digital operation in industrial environments. This system uses programmable memory for internal registers of user instructions, in order to complete specified functions such as logic, sequence, timing, counting, arithmetic, etc., AND it controls the machinery or process of different types through digital or analog input/output. The programmable controller and its associated peripherals are designed so that it can be easily integrated into industrial control systems, AND can easily achieve all the desired functionality.

Note: In this part, the acronym PLC is used to represent the programmable controllers, which has a consensus in the automation industry.

Originally PC is used as an acronym for programmable controllers, BUT it is easy to be confused with the acronym PC which is used by personal computers. [GB/T 15969.1-2007, Definition 3.5]

3.1.2 Programmable controller system or PLC-system

It refers to the configuration which is composed of the programmable controller and its associated peripherals as established by the user for the purposes of completing the automation system requirements. It is composed of the units which are formed by the interconnection of the power cables or plug-in components connected to the permanent facilities, AND the power cables or other connection means connected to the portable or transportable peripherals. [GB/T 15969.1-2007, Definition 3.6]

3.1.3 Vulnerability

It refers to the defects or weaknesses which are existed in the design, realization, operation, and management of system, which can be used to compromise the integrity of the system or security strategy. [GB/T 30976.1-2014, Definitions 3.1.1]

3.1.4 Identify

It refers to the process of marking and identifying a certain assessment element. [GB/T 30976.1-2014, Definitions 3.1.2]

3.1.5 Acceptance

It refers to a method which is used in the risk assessment activity to end the implementation of a project. For this method, the party under assessment organizes institute to perform inspection against the assessed activity item by item, AND the acceptance criteria are whether it reaches the assessment objective. [GB/T 30976.1-2014, Definitions 3.1.4]

The PLC system network security shall include all the activities related to the system in different phases including the design and development, installation, operation maintenance, and exit from use in the system life cycle. It shall be recognized that the risks to the system will change throughout the life cycle, AND it shall use the technology and management to reduce the PLC system network security risk to the minimum or acceptable level.

4.2 Overview of network security related content

4.2.1 Hazard sources

Hazard sources include non-secure equipment, systems and network access points. The hazard source may either come from outside the PLC system OR may also come from within the PLC system. Safety threats can cause harm to the recipient through the risk introduction point AND use of the route of transmission. […]