工业控制系统安全指南Guide+to+Industrial+Contrl+Systems+(ICS)

Special Publication 800-82

Guide to Industrial Control Systems (ICS) Security

Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), and other control system configurations such as Programmable Logic Controllers (PLC) Recommendations of the National Institute of Standards and T echnology

Keith S touffer

Joe Falco

Karen Scarfone

C O M P U T E R S E C U R I T Y

G UIDE TO I NDUSTRIAL C ONTROL S YSTEMS (ICS)S ECURITY

Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations.

iii

G UIDE TO I NDUSTRIAL C ONTROL S YSTEMS (ICS)S ECURITY

Acknowledgments

The authors, Keith Stouffer, Joe Falco, and Karen Scarfone of the National Institute of Standards and Technology (NIST), wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content. The authors would particularly like to acknowledge Tim Grance, Ron Ross, Stu Katzke, and Freemon Johnson of NIST for their keen and insightful assistance throughout the development of the document. The authors also gratefully acknowledge and appreciate the many contributions from the public and private sectors whose thoughtful and constructive comments improved the quality and usefulness of this publication. The authors would particularly like to thank the members of ISA99. The authors would also like to thank the UK National Centre for the Protection of National Infrastructure (CPNI)) for allowing portions of the Good Practice Guide on Firewall Deployment for SCADA and Process Control Network to be used in this document as well as ISA for allowing portions of the ANSI/ISA99 Standards to be used in this document.

iv

G UIDE TO I NDUSTRIAL C ONTROL S YSTEMS (ICS)S ECURITY

Table of Contents

Executive Summary..............................................................................................................ES-1 1.Introduction......................................................................................................................1-1

1.1Authority...................................................................................................................1-1

1.2Purpose and Scope.................................................................................................1-1

1.3Audience..................................................................................................................1-1

1.4Document Structure.................................................................................................1-2

2.Overview of Industrial Control Systems........................................................................2-1

2.1Overview of SCADA, DCS, and PLCs.....................................................................2-1

2.2ICS Operation..........................................................................................................2-2

2.3Key ICS Components..............................................................................................2-3

2.3.1Control Components.....................................................................................2-4

2.3.2Network Components...................................................................................2-5

2.4SCADA Systems......................................................................................................2-6

2.5Distributed Control Systems..................................................................................2-10

2.6Programmable Logic Controllers...........................................................................2-12

2.7Industrial Sectors and Their Interdependencies....................................................2-13

3.ICS Characteristics, Threats and Vulnerabilities..........................................................3-1

3.1Comparing ICS and IT Systems..............................................................................3-1

3.2Threats.....................................................................................................................3-5

3.3Potential ICS Vulnerabilities.....................................................................................3-6

3.3.1Policy and Procedure Vulnerabilities............................................................3-7

3.3.2Platform Vulnerabilities.................................................................................3-8

3.3.3Network Vulnerabilities...............................................................................3-12

3.4Risk Factors...........................................................................................................3-14

3.4.1Standardized Protocols and Technologies.................................................3-15

3.4.2Increased Connectivity...............................................................................3-15

3.4.3Insecure and Rogue Connections.... …… 此处隐藏：56228字，全部文档内容请下载后查看。喜欢就下载吧 ……