GB/T 36323-2018Information security technology—Security management fundamental requirements for industrial control systems (English PDF)

3.1 Industrial control system

Control systems used in industrial production, including monitoring and data acquisition systems (SCADA), distributed control systems (DCS), and others Smaller control systems, such as programmable logic controllers (PLCs).

3.2 Distributed control system

A computer-based system for distributed control and centralized management of production processes within the system (within the unit).

Note: The DCS system generally includes two levels. the field control level and the control management level. The field control level mainly controls the individual sub-processes, and controls the management level.

It is mainly for data collection, centralized display, unified scheduling and management of multiple distributed sub-processes.

3.3 Monitoring and data acquisition system

In the process of industrial production control, centralized data collection for large-scale and long-distance geographically distributed assets and equipment in the WAN environment Set and control management system.

Note: It is based on computer and monitors and dispatches remotely distributed running equipment. Its main functions include data acquisition, parameter measurement and adjustment, and signal alarm.

Wait. The SCADA system generally consists of a Master Terminal Control Unit (MTU), a communication line and equipment, and a Remote Terminal Unit (RTU) located in the control center.

3.4 Programmable logic controller

An electronic device that uses programmable memory to control industrial production equipment through digital operations.

Note: PLC mainly performs various types of calculations, sequence control, timing and other instructions for controlling the movement of industrial production equipment. It is the basic unit of industrial control system.

3.5 Security control baseline

The security controls the starting point of the selection process and the selection base point.

Note: The Safety Control Baseline is the minimum safety basis developed to help organizations select the most cost-effective and appropriate safety control set to meet safety requirements. Guidelines.

5.1 ICS Security Management Basic Framework

Many important differences between industrial control systems (ICS) and traditional information technology (IT) systems determine that ICS should be planned and managed.

Consider the characteristics of ICS itself in the information security process. Refer to the traditional information security management system, combined with the characteristics of ICS, the security needs Seeking integration into ICS, formed the basic framework of ICS security management (as shown in Figure 1). The framework is in determining the specific intent of ICS security management, Based on understanding the requirements of the requirements and clarifying the scope of the ICS system, the ICS security management activities are divided into top-level commitments, planning assessments, and resource support.

Six aspects of holding, strategy implementation, performance evaluation, and continuous improvement. Among them, the top-level commitment requires the organization to obtain management's commitment to determine The ICS security management policy clearly defines the roles and responsibilities of all relevant members in ICS management activities; the organization should determine the rules in the planning assessment General rules, conduct ICS security risk assessment and disposal, clarify objectives and achieve planning; in the resource support part of the organization should guarantee ICS security Resources needed, providing capacity and awareness training, identifying communication mechanisms and establishing a documented system; organization of strategy implementation should be planned, implemented and controlled The specific process of meeting the requirements of ICS safety management activities, and regularly carry out ICS safety risk assessment and disposal; in the performance evaluation stage, The organization conducts monitoring, measurement, analysis and evaluation of ICS, conducts internal audits and management reviews on a regular basis, and organizes responses to ICS in the continuous improvement phase.

The safety is continuously monitored, and corrective actions are taken and improved continuously in the event of an ICS safety anomaly.

In order to realize the security functions of each stage of the basic framework of ICS security management, this standard gives the basics of ICS security management in Chapter 6.

The basic control measures required at each stage of the framework, and the safety management requirements for different levels of industrial control systems are given in Appendix A.

It should be used to guide the organization to select the basic control measures for safety management according to the different safety levels of its industrial control system, and according to industrial control System system safety control application guide, safety grading and other related standards, tailoring and selecting the basic control measures for selected safety management.

5.2 Top-level commitment

5.2.1 Management commitment

The organization shall make a commitment to ICS security in accordance with 5.1 of GB/T 22080-2016.

5.2.2 Policy

The organization shall establish a policy applicable to ICS security in accordance with 5.2 of GB/T 22080-2016. In addition, the corresponding ICS shall be formulated accordingly.

The safety policy is consistent with the overall policy of organizing information security and serves as an integral part of it.

5.2.3 Establishing ICS Security Joint Management Team

To ensure the implementation of ICS security, the organization should.

a) Establish an inter-departmental, cross-functional ICS security joint management team;

b) The management team shall include at least IT personnel, control engineers, control system operators, network and information system security experts, and management Representatives of the physical layer and representatives of the physical security department;

c) Top management shall ensure that the team has the rights and responsibilities for ICS security management activities and provides corresponding commitments.

5.2.4 Roles, responsibilities and authorities of the organization

Top management should ensure that responsibilities and authorities for ICS information security related roles are assigned and communicated.

Top management should assign responsibilities and authority to achieve the following objectives.

a) ensure that the basic framework of ICS security management meets the requirements of this standard;

b) report to the top management the basic framework performance of the ICS security management;

c) Accept regular reports from the joint management team.

5.3 Planning assessment

5.3.1 Measures to address risks and opportunities

5.3.1.1 General

The organization shall make a general rule for ICS in accordance with 6.1.1 of GB/T 22080-2016, and shall also include ICS security in the general rules. Expectations of operation and maintenance.

5.3.1.2 ICS Information Security Risk Assessment

The organization shall define and apply the risk assessment process for ICS in accordance with 6.1.2 of GB/T 22080-2016, and shall also fully demonstrate The consequences of the risk assessment process on the availability and stability of ICS to ensure the proper conduct of industrial production activities.

5.3.1.3 ICS information security risk disposal

The organization shall define and apply the ICS information security risk disposal process in accordance with 6.1.3 of GB/T 22080-2016.

5.3.2 ICS Information Security Objectives and Implementation Planning

The organization shall establish a target for ICS information security and its implementation plan in accordance with 6.2 of GB/T 22080-2016.

5.4 Resource support

5.4.1 Resources

The organization shall identify and provide the resources needed to establish, implement, maintain and continually improve the ICS Information Security Management System.

5.4.2 Ability

See 7.2 in GB/T 22080-2016.

5.4.3 Consciousness

Education and training should be carried out on a regular basis and personnel working under the control of the organization should be made aware of.

a) ICS information security policy;

b) its contribution to the effectiveness of the basic framework of ICS security management, including the benefits of improving ICS information security performance;

c) Does not meet the impact of the ICS security management basic framework requirements.

5.4.4 Communication

See 7.4 of GB/T 22080-2016.

5.5 Policy implementation

5.5.1 Operation planning and control

The organization shall carry out operational planning and control work for ICS information security in accordance with 8.1 of GB/T 22080-2016, and shall also.

a) A detailed assessment of the hazards that this safety control may pose to ICS before implementing safety control measures against ICS;

b) Authorization of safety control measures should be obtained prior to the implementation of safety control measures.

5.5.2 ICS Information Security Risk Assessment

The organization shall conduct risk assessment work for ICS information security in accordance with 8.1 of GB/T 22080-2016. In the risk assessment process In accordance with the contents of Appendix A of GB/T 32919-2016, fully consider the difference between ICS and traditional information systems.

5.5.3 ICS Information Security Risk Disposal

See 8.3 of GB/T 22080-2016 and carry out risk disposal according to the characteristics of ICS.

5.6 Performance evaluation

5.6.1 Monitoring, measurement, analysis and evaluation

See 9.1 of GB/T 22080-2016, and should also continuously monitor the implemented safety control measures, identify safety violations, and detect The occurrence of a security anomaly in ICS.

5.6.2 Internal Audit

See 9.2 of GB/T 22080-2016 and carry out internal audit according to the characteristics of ICS.

5.6.3 Management Review

See 9.3 of GB/T 22080-2016 and carry out management review according to the characteristics of ICS.

5.7 Continuous improvement

5.7.1 Non-compliance and corrective actions

See 10.1 of GB/T 22080-2016 and take corrective actions based on the characteristics of ICS.

5.7.2 Continuous improvement

The organization shall continually improve the suitability, adequacy and effectiveness of the basic framework of ICS security management, and in the ICS production business or system security Report to the joint management team and top management when major changes occur in full protection.

6.1 Classification of safety control measures

This standard gives security control from three aspects. management system, operation and maintenance management and technical management. There are a total of 16 security control families. As shown in Table 1.

6.2 Security Assessment and Authorization (CA)

6.2.1 Security Assessment and Authorization Policy and Procedures (CA-1)

This requirement includes.

a) Safety assessment and authorization strategies and procedures guidelines should be developed and published, including at least. purpose, scope, role, responsibilities, Management commitment, coordination and compliance between relevant departments;

b) Safety assessment and authorization guidelines and procedures should be developed and published to promote safety assessment and authorization strategies and related safety controls Implementation of the system;

c) Security assessment and authorization policies and procedures should be reviewed and updated on a regular basis.

6.2.2 Security Assessment (CA-2)

This requirement includes.

a) A safety assessment plan should be developed, which should include. safety control measures to be evaluated; assessment of the effectiveness of safety measures Assess the process; assess the environment, team, role and responsibilities;

b) The correctness and effectiveness of the implementation of the safety measures adopted by ICS should be regularly evaluated and the relevant safety should be judged. demand;

c) an assessment report should be generated based on the assessment results and the assessment results reported to the relevant personnel;

d) An independent and accredited body should be authorized to conduct the assessment and ensure that the assessment does not interfere with ICS operations and functions;

e) Ensure that the evaluator is fully aware of the information security related policies and procedures, ICS's security policy and procedures, and Specific safety and environmental risks associated with the equipment and/or process;

f) For ICSs that cannot be directly evaluated online, they should be taken offline or in a replication system.

6.2.3 ICS Connection Management (CA-3)

This requirement includes.

a) ICS interconnection security regulations should be established to authorize ICS to connect with other external information systems;

b) The interface characteristics, security requirements, communication information characteristics, etc. of the ICS connection with other external industrial control systems shall be carried out. recording;

c) The ICS and external connections should be reviewed periodically to verify that the ICS connection meets the specified requirements;

d) that national security systems that do not have a secrecy level should be prevented from directly connecting to the external network;

e) The national security system with a confidentiality level should be prevented from directly connecting to the external network.

6.2.4 Action Plan and Time Node (CA-4)

This requirement includes.

a) Develop an action plan and time node in which to record the corrective actions to be taken to correct the assessment of safety control measures Current weaknesses and deficiencies, reducing or eliminating known vulnerabilities in the system;

b) update existing action plans and time at least quarterly based on safety assessments, consequences analysis and ongoing monitoring node;

c) The organization shall use automated mechanisms that contribute to the implementation of the plan in an accurate, timely and timely manner.

6.2.5 Security Authorization (CA-5)