GB/T 47683-2026Industrial internet - Specification for hazard analysis and risk assessment (English PDF)

6.2 Personnel Requirements

6.2.1 Members of the hazard analysis and risk assessment working group should be independent (as opposed to project design and operation), either from the project design personnel or the project team. Other relevant personnel in the group should cooperate with the analysis team in hazard analysis and risk assessment activities.

6.2.2 The working group members should include personnel with relevant experience in the Industrial Internet and knowledge of relevant laws and regulations to ensure the effectiveness of hazard analysis and risk assessment. The reasonableness and credibility of the risk assessment results.

6.2.3 The working group shall include personnel who have participated in functional safety and information security technology training and have the corresponding knowledge and experience.

Note. Regarding functional safety, personnel need to understand GB/T 20438 (all parts) [process industries also need to understand GB/T 21109 (all parts)] and obtain industry certification. Authoritative functional safety certification; in terms of information security, personnel need to understand GB/T 20986, GB/T 35673, and other standards for information security and industrial control system information security. Comply with relevant standards and obtain training certificates.

6.2.4 The working group should include at least one person with a relevant professional background in the industrial system to be evaluated (such as industrial control equipment, process flow, etc.). The term of service shall not be less than 3 years.

6.3 Management Requirements

6.3.1 The organization responsible for hazard analysis and risk assessment shall establish a hazard analysis and risk assessment working group and clearly define the responsibilities and independence of each member. Require.

Note. The organizers include the designers, builders, and users of the industrial system.

6.3.2 Personnel performing hazard analysis and risk assessment shall meet the requirements of 6.2.

6.3.3 The working group shall prepare a hazard analysis and risk assessment plan, which shall include the following contents.

---The objects and scope of hazard analysis and risk assessment.

Note. The scope of the assessment object, applicable laws, regulations, and standards must be clearly defined in the plan. The definition of the scope of work may also be related to the input data (such as design specifications). The level of detail (as in books, device drawings, etc.) is related to this.

---Activities required to be performed at each stage of hazard analysis and risk assessment.

---Personnel, departments, organizations, or other entities involved in hazard analysis and risk assessment activities.

---Resources needed to complete hazard analysis and risk assessment activities.

---Proposed tools and record sheets.

---The outputs that should be obtained after completing hazard analysis and risk assessment activities.

---Identification of potential personnel risks, business impact risks, and data leakage risks during the hazard analysis and risk assessment process. control.

---Schedule planning.

6.3.4 The hazard analysis and risk assessment plan shall be approved by the assessment organization before the hazard analysis and risk assessment are carried out.

6.4 Procedure Requirements

6.4.1 The preliminary preparations for conducting industrial internet hazard analysis and risk assessment should include the following.

---Establish a hazard analysis and risk assessment working group, with personnel meeting the requirements of 6.2.

---Develop a hazard analysis and risk assessment work plan that meets the requirements of 6.3.3.

---Data collection and meeting preparation, hazard analysis and risk assessment input data should include, but are not limited to. - The system's operating environment; - Business strategy and management system; - Main business functions and requirements; - Network structure and network environment, including internal and external connections; - Main hardware and software; - System and data sensitivity; - Asset list; - Network security management procedures; - Emergency response plan for cybersecurity incidents; - Design documents related to industrial control equipment and systems accessed at the edge layer, including at least design requirements and descriptions, and flowcharts (process diagrams). In industrial applications, this typically involves piping and instrumentation diagrams; for programmable electronic systems, it's usually a data flow diagram. (Engineering data sheets, layout) Drawings, utility specifications, operation and maintenance requirements; - Collection of accident and incident case studies; - Previous assessment reports and historical accident and incident analysis reports of the assessed entity; - Other relevant documents.

6.4.2 Conduct industrial internet hazard analysis and risk assessment according to Figure 2.

6.4.3 Records and Tools Hazard analysis and risk assessment records should preferably be in the form of record sheets. Industrial Internet companies can use digital and intelligent methods to achieve hazard analysis and risk assessment. Recording and rating risk analysis and assessments, establishing a historical database, and leveraging big data and other methods to determine risk frequency and severity. Value correction. Industrial internet companies with the necessary resources can develop real-time dynamic hazard analysis and risk assessment tools for information security intrusion detection and on-site... Real-time monitoring of key risk factors such as instrument and equipment failures, personnel movement, and fire and gas monitoring, combined with hazard analysis and risk assessment algorithms, achieves... Real-time hazard analysis, risk assessment, and control.

6.5 Documentation Requirements

6.5.1 All hazard analysis and risk assessment activities should be documented.

6.5.2 Documents should be clearly structured, accurately expressed, unambiguous, interpretable, and traceable.

6.5.3 Hazard analysis and risk assessment reports should include. project background, basis for analysis and assessment, purpose of analysis and assessment, scope of analysis and assessment, and content. Content, analysis and evaluation methods, analysis and evaluation process, analysis and evaluation conclusions and recommendations, hazard analysis and risk assessment worksheets, analysis and evaluation tools The necessary data used and analyzed, such as analysis drawings, sources of evaluation criteria, and analysis and evaluation assumptions and their sources.

7.1 General Requirements

7.1.1 When conducting hazard analysis and risk assessment for the edge layer, network layer, platform layer, and industrial application layer of the Industrial Internet, the first step should be to determine... Set safety goals.

7.1.2 Determining security objectives typically involves identifying the applicable risk matrix and tolerable risks.

Note. When the residual risk is less than or equal to the tolerable risk, it indicates that the risk has reached an acceptable level, and no additional risk reduction measures are needed; residual risk... When the risk exceeds the tolerable level, it indicates that the risk has not been reduced to an acceptable level, and risk reduction measures need to be increased until the residual risk is less than or equal to the tolerable level. risk.

7.2 Determine the applicable risk matrix

7.2.1 The risk analysis and risk assessment of each level of the Industrial Internet should assess its risk level according to the applicable risk matrix, and be carried out in a timely manner. Corresponding records. The risk level assessment process includes initial hazard analysis and risk assessment, and residual hazard analysis and risk assessment.

7.2.2 The risk matrix has two main parameters. the probability of an event occurring and the severity of its consequences.

7.2.3 The probability of an event occurring should be classified according to industry experience, industry standards, and company documents. Example. See Table 1. Table

1.Event Probability Ranking (Example) Probability grading frequency range (F) description 1.F<=10^-5 has no international precedent. 2.10^-4 >= F > 10^-5 This is unlikely to occur in reality (there is no precedent for this in the domestic industry). 3.10^-3 >= F > 10^-4 is not expected to occur, but it may happen under special circumstances (there have been precedents in the domestic industry). 4 10^-2>=F >10^-3 This is unlikely to happen within the lifecycle of a specific analytical object, but there are multiple similar platforms/systems. At that time, it may occur on one of the platforms/systems. 5.10^-1 >= F > 10^-2 indicates that the event is likely to occur at least once during the lifecycle of the analyzed object (and is expected to occur). 6.F >10-

7.3 Determine tolerable risks

7.3.1 Tolerable risks should comply with national laws, regulations, standards, and the company's tolerable risk guidelines.

Note. Tolerable risk is the goal of safety work. From an engineering application perspective, there is no absolute safety or "zero risk"; any safety project needs to first define [the appropriate risk level]. Define a relative or acceptable risk target. One principle that can be referenced for tolerable risk is ALARP.

7.3.2 For each category of consequences and its severity level, a corresponding tolerable risk frequency should be defined. Example. Tolerable risks of personal injury consequences are shown in Table 4; tolerable risks of economic loss consequences are shown in Table 5; tolerable risks of business continuity impact consequences are shown in Table 5. See Table 6.

7.3.3 Tolerable risk depends on many factors, such as the severity of the injury, the number of people exposed to the hazard, and the ratio of one to multiple people exposed to the hazard. The frequency and duration of exposure. For a specific application, the composition of tolerable risk must consider the following set of determinants.

---International and national standards;

---National and local policies and regulations;

---Corporate policies, system documents, and standards;

---Investment in relevant parties such as community organizations, local judicial authorities, and insurance companies with good engineering practices.

8.2 Identification and Analysis of Information Security Risk Factors

8.2.1 The process of identifying and analyzing information security risk factors shall be performed in accordance with GB/T 20984 and GB/T 20986.Information security risk factor identification... Differentiation and analysis include.

---Asset identification;

---Security threat identification and probability analysis;

---Vulnerability identification and severity analysis;

---Information security risk identification and analysis of its likelihood and scope of impact.

8.2.2 Security threats to industrial systems generally include. information leakage, malicious tampering (such as malicious modification of control commands), unauthorized access, and identity theft. Impersonation, denial, denial of service, unauthorized escalation of privileges, virus infection, unauthorized physical access, disaster, power outage, etc.

8.2.3 Edge-layer security threats should be identified, including.

---The risk of terminal "zombification" or control logic tampering caused by terminal intrusion; Note

1.Typical examples of this type of threat include terminal hosts being infected with bots, leading to the "zombie" phenomenon of the terminal, and being implanted with logic bombs.

---Industrial control networks are interconnected, and security threats and attacks on the upper-level management network may penetrate and extend to the control network; Note

2.The difficulties in implementing security protection for industrial control systems include. the stringent requirements of industrial control systems for real-time performance and reliability, which make traditional... IT information security technologies are difficult to apply directly to industrial sites; to meet real-time and reliability requirements, industrial control equipment generally does not use, or rarely does. Security measures are in place; physical isolation has become the only security barrier for most industrial control equipment. The "interconnectivity" of the Industrial Internet enables industrial control... The control system and equipment were exposed to external public networks, which compromised the security of physical isolation.

---Security vulnerabilities caused by the failure to update the software and hardware of industrial control systems and equipment in a timely manner; Note

3.Industrial control systems and equipment generally operate for decades and are rarely upgraded in terms of software and hardware due to various factors, making it difficult to eliminate security vulnerabilities in a timely manner.

---The lack of effective control measures for remote maintenance of industrial control systems may lead to the leakage or destruction of production data;

9.2 Content and Requirements

9.2.1 All potentially hazardous events and their causes that may pose risks at the industrial internet edge layer should be identified (including human error, equipment failure, network...). (Network failures, network security threats, etc.), and the analysis should be conducted after excluding the effects of industrial process safety protection measures and information security protection facilities. The likelihood of hazardous events occurring. Risk analysis and assessment at the industrial internet edge layer should include the following.

---Regarding new technologies and methods used in the edge layer of the Industrial Internet, their potential impact can be assessed from dimensions such as technology maturity and personnel capabilities. Analyze new dangers/threats;

--- Potential new dangers/threats arising from artificial intelligence (e.g., data poisoning, algorithmic errors, strategy errors, computing power collapse, etc.), and contingency plans. Are there dedicated measures to switch to traditional control methods, and are they directly applied to safety function loops?

---New dangers/threats that may arise from network connectivity (e.g., connection loss, authentication failure, data transmission errors, synchronization errors, unauthorized access) (Is there a specific measure to prevent and control potential faults such as malicious duplication or unauthorized access?)

--- Potential new dangers/threats associated with remote access (e.g., remote access tampering, unauthorized access, identity spoofing, access delays, Trojan horse planting) (e.g., access control), are there specific measures to cut off or block remote access, or switch to backup local functions?

---Due to inherent security design flaws in industrial control equipment, its access control mechanism is weak, resulting in a reduction in overall system security;

---Vulnerabilities exist in the network protocols and application software used by industrial control equipment;

---The industrial control network system has design and configuration flaws; Incomplete link-layer security policy configurations and simplistic protection mechanisms in industrial control network equipment and network switching devices can lead to intrusions through the network. To launch malicious attacks such as MAC flooding attacks and ARP spoofing;

---Security of external interfaces. Inadequate authentication and authorization policies for external communication can lead to unauthorized access, data leakage, and system instability. The system was maliciously controlled;

---Physical security at the edge layer. Damage to equipment caused by inadequate physical access control, intrusion prevention measures, or improper management of the device's operating environment. Bad, data breaches, and system outages;

---Supply chain security. Equipment, software, or services provided by suppliers may have backdoors or be compromised, creating entry points for attacks and compromised information. Information leak.

9.2.2 For dangerous incidents caused by information security incidents, the threat level should be calculated based on the frequency of information security threats and their vulnerabilities. The probability of information security incidents occurring due to vulnerabilities and the probability of dangerous incidents arising from such incidents are considered, and a comprehensive calculation is performed. Calculate the probability of a dangerous event occurring.

Note. Vulnerabilities can also be categorized by their impact level, with different levels representing the extent of damage to assets caused by exploited vulnerabilities. Vulnerability Examples of sexual influence levels are as follows:

1.If threatened and exploited, the damage to assets will be negligible;

10.2 Content and Requirements

10.2.1 Based on security threat identification, all potentially dangerous events that could lead to network layer risks and their causes should be identified, and industrial processes should be excluded from consideration. Under the influence of process security protection measures and information security protection facilities, the probability of dangerous events occurring is analyzed.

10.2.2 The effectiveness of industrial process safety protection measures and information security protection facilities should be excluded, and potential inherent vulnerabilities of network layer facilities should be identified. Analyze the likelihood of failures, erroneous behaviors, and unintended human intervention.

10.2.3 For each hazardous event identified in

10.2.1 and 10.2.2, its consequences on edge layer access devices/industrial control systems should be analyzed. The impact should be analyzed. When assessing the consequences, the role of information security protection facilities and industrial process safety measures should be excluded, and a comprehensive analysis of the events from their inception to their aftermath should be conducted. By analyzing the event chain during the occurrence of the event, the severity level of the final consequence can be determined.

10.2.4 The original risk of each hazardous event should be determined based on the risk matrix.

10.2.5 Relevant information should be determined...