GB/T 33009.4-2016Industrial automation and control system security—Distributed control system (DCS)—Part 4: Risk and vulnerability detection requirements (English PDF)
工业自动化和控制系统网络安全 集散控制系统（DCS） 第4部分：风险与脆弱性检测要求
This is a limited preview
Buy now to download the full PDF (33 pages)
Need quotation for your management?
Get a formal quotation for GB/T 33009.4-2016 in 30 minutes.
Issued by
SAMR; SAC
Level / Type
National · Recommended
Issue date
October 13, 2016
Implementation date
May 1, 2017
Scope
GB/T 33009.4-2016 is the English-translated version of 工业自动化和控制系统网络安全 集散控制系统（DCS） 第4部分：风险与脆弱性检测要求.
This part of GB/T 33009 sets the requirements for detecting risks and vulnerabilities in a distributed control system (DCS).
Clause 1 states that it covers that detection both before and after the DCS is put into operation and puts specific requirements on the detection carried out on DCS software, on the Ethernet network communication protocol and on the industrial control network protocol; it applies to monitoring software, configuration software, database software and other DCS application software, to operating systems such as those of DCS operator stations and control stations, and to functions and components in the DCS that implement a network protocol and can communicate over a network, and it does not apply to the vulnerability detection of intelligent instrumentation or industrial wireless.
The table of contents gives clause 4 overview of DCS risk and vulnerability detection, with its system overview, detection objectives, basic principles, detection content, basic work unit, implementation and disposal of results; clause 5 DCS software security risk and vulnerability, divided across the operating system of server and control station, the database management system, OPC software, DCS monitoring software, DCS configuration software and other software; and clause 6 DCS network communications security risk and vulnerability, divided across the commercial Ethernet protocol communication mechanism, the industrial network protocol communication mechanism, DCS communication data security, DCS communication services and DCS status conversion.
Clause 3 is split into terms and definitions and abbreviations, and defines availability, taken from GB/T 20984-2007 definition 3.3, along with authentication and authorized user, and lists confidentiality without showing its definition.
Clause 4 describes the usual DCS application as a vertical hierarchy of a process monitoring layer, a field control layer and a field equipment layer, each joined by a communication network, and states that this part addresses the security requirements of the networks of those three layers.
The same clause sets out how a work unit is written: detection implementation names the method, the target and the operation process and uses shall for the steps that must be completed before the detection staff conclude and may for those left to their discretion, while result judgment describes how the staff decide from the evidence whether the system under detection meets the requirements, a single implementation item being concluded before the work unit as a whole.
For deployment it distinguishes three cases, detection before a new DCS goes into production and after its security assessment, detection of the newly added systems before the joint test of old and new when an existing DCS is upgraded or extended, and detection for systems already in service, at which point the draft breaks off.
Clause 2 cites GB 17859-1999, GB/T 20271-2006, GB/T 20984-2007, GB/T 28449-2012, GB/T 30976.1-2014, GB/T 33009.1-2016 and GB/T 33009.2-2016.
It is part 4 of GB/T 33009, whose four parts are protection requirements, management requirements, assessment guidelines and risk and vulnerability detection requirements and which, together with GB/T 33008 on programmable logic controllers, forms the series of standards on industrial automation and control system network security; it was issued on October 13, 2016 and has applied since May 1, 2017.
Found what you need?
Document preview — GB/T 33009.4-2016
National Standard of the People's Republic of China
- ICS
- 25.040
- Classification
- N 10
Issued by: State Administration for Market Regulation; Standardization Administration of the PRC
Contents
- Foreword3
- 1 Scope5
- 2 Normative references5
- 3 Terms, definitions, abbreviations6
- 3.1 Terms and definitions6
- 3.2 Abbreviations9
- 4 Overview of DCS risk and vulnerability detection10
- 4.1 DCS system overview10
- 4.2 DCS risk and vulnerability detection objectives12
- 4.3 Basic principles of DCS risk and vulnerability detection12
- 4.4 DCS risk and vulnerability detection content13
- 4.5 Basic work unit of DCS risk and vulnerability detection13
- 4.6 Implementation of DCS risk and vulnerability detection15
- 4.7 Disposal of DCS risk and vulnerability detection results16
- 5 DCS software security risk and vulnerability16
- 5.1 Operating system of server and control station16
- 5.2 Database management system18
- 5.3 OPC software21
- 5.4 DCS monitoring software22
- 5.5 DCS configuration software24
- 5.6 Other software26
- 6 DCS network communications security risk and vulnerability26
- 6.1 Commercial Ethernet protocol communication mechanism26
- 6.2 Industrial network protocol communication mechanism27
- 6.3 DCS communication data security29
- 6.4 DCS communication services30
- 6.5 DCS status conversion31
- References33
Foreword
GB/T 33009 "Industrial automation and control system security - Distributed control system (DCS)" and GB/T 33008 "Industrial automation and control system security - Programmable logic controller (PLC)" and other standards together constitute the industrial automation and control systems network security series standard.
GB/T 33009 "Industrial automation and control system security - Distributed control system (DCS)" is divided into 4 parts.
- Part 1. Protection requirements;
- Part 2. Management requirements;
- Part 3. Assessment guidelines;
- Part 4. Risk and vulnerability detection requirements.
This part is part 4 of GB/T 33009.
This part was drafted in accordance with the rules given GB/T 1.1-2009.
1 Scope
This part of GB/T 33009 specifies the risk and vulnerability detection of the distributed control system (DCS) before and after being put into operation, proposes specific requirements for the risk and vulnerability detection of the DCS software, Ethernet network communication protocol and industrial control network protocol.
This part applies to vulnerability detection of the following objects in the DCS.
a) Monitoring software, configuration software, database software and other DCS application software;
b) Operating systems such as DCS operator stations and control stations;
c) Functions and components in the DCS with network protocol implementation and network communication capabilities.
This part does not apply to intelligent instrumentation and industrial wireless vulnerability detection.
2 Normative references
The following documents are essential to the application of this document. For the dated documents, only the versions with the dates indicated are applicable to this document; for the undated documents, only the latest version (including all the amendments) are applicable to this document.
GB 17859-1999 Classified criteria for security protection of computer information system
GB/T 20271-2006 Information security technology - Common security techniques requirement for information system
GB/T 20984-2007 Information security technology - Risk assessment specification for information security
GB/T 28449-2012 Information security technology - Testing and evaluation process guide for classified protection of information system security
GB/T 30976.1-2014 Industrial control system security - Part 1: Assessment specification
GB/T 33009.1-2016 Industrial automation and control system security - Distributed control system (DCS) - Part 1: Protection requirements
GB/T 33009.2-2016 Industrial automation and control system security - Distributed control system (DCS) - Part 2: Management requirements
3 Terms, definitions, abbreviations
3.1 Terms and definitions
The terms and definitions as defined in GB/T 20984-2007 and GB/T 30976.1-2014 AND the following terms and definitions apply to this document. For ease of use, some terms and definitions from GB/T 20984-2007 and GB/T 30976.1-2014 are repeatedly listed below.
3.1.1 Availability
Characteristics of data or resources that can be accessed and used by the authorized entities as required. [GB/T 20984-2007, Definition 3.3]
3.1.2 Authentication
The act of verifying the entity's claimed identity.
3.1.3 Authorized user
A user who can perform an action based on security policy.
3.1.4 Confidentiality
4 Overview of DCS risk and vulnerability detection
4.1 DCS system overview
4.1.1 Network structure of common DCS system application
DCS system applications are usually a vertical hierarchical network structure, from top to bottom including process monitoring layer, field control layer and field equipment layer. Each layer is connected by a communication network, and each equipment in each layer is communicated through a communication network of the same level. The typical network structure is as shown in Figure 1. This part mainly proposes requirements for security requirements of the process monitoring layer, field control layer network, and field equipment layer network in the DCS system. The description of each layer is as follows.
- Process monitoring layer. the main task is to monitor the operation, it has some management functions at the same time. This level is for operator and control system engineers, so it is equipped at this level with technologically sophisticated computer systems and a wide range of external devices, especially displays and keyboards, it also requires support from hard discs or soft discs of large storage capacity as well as the support of software of strong functions, to ensure that engineers and operators configure, monitor and operate the system, implement advanced control policies, diagnostics, and quality assessments of the production process;
- Field control layer. The main functions of the field control layer include. collecting process data, data conversion and processing; monitoring and control of the production process, output of control signals, achieving analog and digital control; I/O card diagnosis; data communication with process monitoring layer;
- Field equipment layer. The main functions of the field equipment layer include. collecting control signals, executing control commands, performing equipment actions in accordance with control signals.
4.5 Basic work unit of DCS risk and vulnerability detection
system operation site to perform field observation of personnel actions, technical facilities and physical environments to judge the personnel security awareness, business operation, management procedures, and other security conditions. Test refers to the testing performed by technical tools.
Detection implementation. The main component of the work unit. It is the specific requirements for detection implementation as developed based on the detection purposes and the detection contents, which relates to the specific detection method, detection target, and operation process. In the detection implementation process, use the adverb "shall" to indicate that these processes are mandatory, which must be completed before the detection staff makes conclusions; use the adverb "may" to indicate that these processes are non-mandatory activities, which have no fundamental impact onto the conclusions made by the detection staff, and can be selectively completed by the detection staff based on actual conditions. The detection measures in this part are all important and need to be considered, but it should be based on the actual application of DCS, DCS security requirements of enterprise to determine whether the detection measures are appropriate and to select feasible detection measures.
Result judgment. Describe how the detection staff can determine whether the system under detection meets the testing requirements based on these detection evidences after the detection staffs have obtained various detection evidences through performing the detection operations. Before giving the detection conclusions of the overall work unit, it shall first give the conclusion of a single detection implementation item. Generally speaking, the conclusion judgment of a single detection implementation item always requires the subjective judgment of the detection staff, and this detection implementation item is satisfied once the correct and critical evidence is obtained.
4.6 Implementation of DCS risk and vulnerability detection
For DCS systems that have not been deployed and implemented, the DCS risk and vulnerability detection can be selected before the DCS is put into production and after the security assessment.
For DCS upgraded based on existing DCS or newly added with extension functions, it is recommended to perform risk and vulnerability detection on the newly added systems before the new and old system joint test. Conduct risk and vulnerability detection on the affected DCS key components and network communication functions in the old and new joint test phase. […]
......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 33 pages — is available in the English PDF.
Referenced standards
Normative references
- GB 17859-1999Classified criteria for security protection of computer information system
- GB/T 20271-2006Information security technology Common security techniques requirement for information system
- GB/T 20984-2007Information security technology—Risk assessment method for information security
- GB/T 28449-2012Information security technology—Testing and evaluation process guide for classified protection of cybersecurity
- GB/T 30976.1-2014Industrial control system security—Part 1: Assessment specification
- GB/T 33009.1-2016Industrial automation and control system security—Distributed control system(DCS)—Part 1: Protection requirements
Similar standards
How to Download GB/T 33009.4-2016
- 1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
- 2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
- 3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
- 4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.
Related Standards
GB 17859-1999 — Classified criteria for security protection of computer information system
GB/T 20271-2006 — Information security technology Common security techniques requirement for information system
GB/T 30976.1-2014 — Industrial control system security—Part 1: Assessment specification
Secure payment via Stripe
Payments accepted
GB/T 33009.4-2016
$125.00