The tide security team (http://www.tidesec.net) plans to take "industrial control security from entry to actual combat" as a special series of industrial control, from the basic knowledge of industrial control security to the entry of industrial control security, from protocol analysis to honeypot technology, from vulnerability utilization to attack protection, and gradually uncover the mystery of industrial control security.
At present, the tentative outline is as follows. You are welcome to supervise. Because a lot of things are also learned from scratch, the inadequacies also ask the big guy to correct.
Part I overview
The concept of industrial control system is different from the traditional network, common security threats, industry differences, security standards, industrial control inspection requirements in ISO 2.0, etc
- [10] [released] industrial control safety from entry to actual combat - Overview (1)
[10] [released] industrial control safety from entry to actual combat - Overview (1)
Part II basic knowledge of industrial control
Common terms such as PLC SCADA DCS ICs, working principle, technical parameters, physical procedures and common brands of PLC
Part III introduction to industrial control safety
How to get started, purchase test equipment, build and deploy test environment, and get started with PLC programming
Part IV analysis of industrial control agreement
Common protocols, how to use scripts to detect, identification of industrial control equipment on the Internet
Part V industrial honeypot technology
The principle and function of the industrial honeypot, how to build the industrial honeypot and the introduction of the honeypot technology of Shodan
Part VI loopholes and utilization of industrial control
Common loopholes and hazards, how to use industrial control loopholes, how to dig industrial control loopholes
Part VII malicious code of industrial control system
Analysis of virus, spyware and blackmail software of industrial control system, network virus, flame and havex virus
Part VIII safety protection of industrial control
Secure network architecture, security equipment, operation and maintenance security, etc
This article is the second part of "industrial control safety from introduction to practice - Overview". It mainly introduces the current relevant standards of industrial control, several industry standards, some requirements of ISO 2.0 in industrial control safety, industrial control characteristics of power, gas and oil industries, etc.
The outline of this paper is as follows:
We collected the following standard regulations and other industrial control standards, and paid attention to the official account below, and replied to the "industrial control standard", which can get relevant information.
international standard
National standard
Guide for information security protection of industrial control system
The guide for information security protection of industrial control system is an important part of national network and information security, and is the basic guarantee for promoting the development of made in China 2025 and the integration of manufacturing industry and Internet. In October 2016, the Ministry of industry and information technology issued the guide for information security protection of industrial control system to provide guidance for industrial enterprises to formulate the implementation plan of industrial control security protection. Under the background of deepening the integrated development of manufacturing industry and Internet in China, and under the situation of prominent information security problems in domestic industrial control system, the guide is formulated to provide comprehensive guidance for industrial control security construction for industrial enterprises at a new height based on management, deep technology and business combination under the environment of multiple standards of domestic industrial control security and vigorous development of industrial control security technology 。
Action plan for information security of industrial control system (2018-2020)
The main objectives of the action plan for information security of industrial control system: by 2020, the first is to establish an industrial control security management system, with clear responsibilities of the enterprise main body, clear responsibilities of supervision and management of government departments at all levels, and basically perfect work management mechanism. Second, the awareness of industrial control safety in the whole system and industry is generally enhanced, and the awareness of industrial control safety hazards is significantly improved. Industrial control safety is regarded as an important part of production safety. Third, the capability of situation awareness, security protection and emergency response has been significantly improved. The construction of technical support system has been comprehensively strengthened. A national online monitoring network, emergency resource base, simulation test, information sharing and information notification platform (one network, one database and three platforms) has been built. Fourth, we should promote the development of industrial information security industry, enhance the industrial supply capacity, cultivate a number of leading backbone enterprises, and establish 3-5 national demonstration bases for new industrialization and industrialization (Industrial Information Security).
Guide for application of information security technology in security control of industrial control system (GB / T 32919-2016)
This standard was proposed by SAC / tc260 and managed by sac. It is applicable to the owner, user, design implementer and information security management department of industrial control system, providing guidance for the design, implementation and rectification of information security of industrial control system, as well as providing reference for information security operation, risk assessment and security inspection of industrial control system. It is convenient to regulate the safety function requirements of industrial control system and lay the foundation for safety design (including safety architecture design) and safety realization.
Information security technology -- basic requirements for network security level protection -- Part 5: requirements for security expansion of industrial control system
That is to say, isoprotection 2.0 changed the original standard "basic requirements for classified protection of information system security in information security technology" to "basic requirements for classified protection of network security in information security technology". The classified protection system has been built into the basic national policy and basic system of national network security in the new era. The important infrastructure systems and "cloud, material, mobile, large and industrial" are included in the protection supervision, and the Internet enterprises are included in the level protection management. In the basic requirements for network security level protection part 5 security extension requirements for industrial control system, the industrial control security is described in detail, and the industrial control hierarchical model is specially described.
GB / T 26333-2010 code for risk assessment of industrial control network security
As the first national standard of industrial control safety in China, it solves the problem of blank of industrial control safety standard in China and achieves the breakthrough of zero industrial control safety standard. This standard was issued and implemented in 2011. It can be seen from the release time that the forerunners who pay attention to the safety of industrial control are far sighted. However, this standard has not been implemented, which has become a dispensable standard in fact and a pioneer in the industry control safety standard field. The reason is that this standard has no core content (the core content refers to other standards directly). The standard is too simple and has low operability, which makes it difficult to implement this standard. It is suggested that relevant units revise this standard.
GB / T 30976.1-2014 information security of industrial control systems Part 1: evaluation specification
As the first national standard of industrial control safety in China, it solves the dilemma that there is no standard for industrial control safety in China. The assessment specification is divided into management assessment and system capability (Technology) assessment. Management assessment should identify, quantify and prioritize risks against risk acceptance criteria and organizational objectives. The results of risk assessment should guide and determine appropriate management measures and their priorities. The process of risk assessment and control measures selection needs to be implemented many times to cover different departments or industrial control systems of the organization. Management evaluation is divided into three levels, and system capability (Technology) evaluation is divided into four levels. The information security level is determined by the system capability level and management level.
During the implementation of this evaluation standard, there is not a set of effective methodology to guide users to determine their own information security level, or the government has not a set of basis for information security level evaluation. At present, the information security level can only be determined according to the user's own spontaneous needs, and then the evaluation activities can be carried out according to the level confirmed by the user.
GB / T 30976.2-2014 industrial control system information security Part 2: acceptance specification
This standard solves the blank of information security acceptance of industrial control system in our country, and solves the dilemma that there are standards for acceptance. The user of this standard is the user of industrial control system, and the acceptance specification involves professional safety test. Except for electric power, petroleum and petrochemical, most users are not able to complete the safety test in the acceptance stage. Therefore, it is necessary to check and accept with the help of the third-party evaluation force, which involves the increase of project budget. Therefore, in the process of standard publicity and implementation, it is necessary to consider the issue of acceptance standards and costs in the project approval stage.
Industry standard
Electric power industry
In the industrial control safety application, the electric power industry issued the electric power regulatory commission No. Secondly, there are corresponding standards for petrochemical, nuclear power and tobacco industries.
Regulations on safety protection of power monitoring system (Order No. 14 of national development and Reform Commission of the people's Republic of China)
Regulations on security protection of electric power monitoring system is a regulation formulated to strengthen information security management of electric power monitoring system, prevent hacker and malicious code from attacking and infringing on electric power monitoring system, and ensure safe and stable operation of electric power system. It was deliberated and approved by the director's office meeting of national development and Reform Commission on August 1, 2014 Promulgated by order No. 14 of the leather Commission, it shall enter into force as of September 1, 2014.
General scheme for safety protection of power monitoring system (GNS [2015] No. 36)
As the latest power system safety specification document in the industry, the general scheme of power monitoring system safety protection (GNS [2015] No. 36) puts forward the secondary system safety protection scheme of dispatching center above the provincial level, dispatching center at the prefecture and county level, power plant, substation and power distribution based on the principle of "safety zoning, network dedicated, horizontal isolation and vertical certification" Using firewall, intrusion detection, host reinforcement, virus protection, log audit, unified management and other means to provide a reliable environment for the safe and stable operation of the secondary system.
Basic requirements for security level protection of information system in electric power industry (tjiinformation [2012] No. 62)
In 2012, according to the relevant standards and management specifications of national information security level protection, combined with the industry's current situation and characteristics, the power industry formulated the industry's equal protection standard - "basic requirements for information system security level protection in the power industry", to guide the industry's information security level protection work.
- Other standards for information security detection of State Grid (issued by State Grid in 2017)
Other standards for information security detection of State Grid (issued by State Grid in 2017)
Petrochemical Industry
Code for design of information system of petrochemical plants (GB / T 50609-2010)
In this design specification, safety isolation is required between networks. The industry standard issued in 2010 is regarded as the industry that attaches importance to industrial control information security earlier.
Nuclear power industry
GB / T 13284.1-2008 safety systems for nuclear power plants - Part 1: design criteria
GB / T 13629-2008 code for the application of digital computers in safety systems of nuclear power plants
The design criteria provides the criteria to be followed in the safety design of nuclear power plants. The standard specifies the minimum functional and design requirements for the power source, instrument and control part of the safety system of nuclear power plant. It is applicable to those systems required to prevent or reduce the consequences of design basis events and protect public health and safety. The applicable standards are mainly for the applicability of digital computers in the safety system of nuclear power plants.
tobacco industry
YC / T 494-2014 safety code for interconnection of production network and management network of tobacco industry enterprises
This standard is mainly used to regulate the network security between production network and management network of tobacco industry enterprises.
Technical specification for network security baseline of industrial control system in tobacco industry
In order to adapt to new technology, new business and new application, the standard puts forward corresponding requirements for cloud computing, mobile Internet, Internet of things and industrial control system respectively. The security requirements of each level of content structure adjustment are general security requirements, cloud computing security extension requirements, mobile internet security extension requirements, Internet of things security extension requirements and industrial control system security extension requirements Requirement.
- Changes in the number of control items required for the safety expansion of industrial control system
Changes in the number of control items required for the safety expansion of industrial control system
ISO 2.0 requirements for safety expansion of industrial control system
Physical and environmental safety: increased the requirements for the safety protection of outdoor control equipment, such as the box or device where the control equipment is placed and the environment around the control equipment;
Network and communication security: the requirements of network architecture security protection, communication transmission and access control adapted to the network environment of industrial control system are increased, and the requirements of dial-up use control and wireless use control are increased;
Equipment and calculation safety: the safety requirements for control equipment are increased. The control equipment is mainly the real-time controller equipment used in the industrial control system to perform the control logic and data collection functions, such as PLC, DCS controller, etc;
Safety construction management: increased the requirements for product procurement and use and software outsourcing, mainly for the requirements for industrial control equipment and industrial control special information security products, as well as the requirements for confidentiality and professionalism in the outsourcing of industrial control system software;
Security operation and maintenance management: adjusted the requirements of vulnerability and risk management, malicious code prevention management and security event disposal, and more suitable for industrial scene application and industrial control system.
Application scenario of ISO 2.0 industrial control system
Concept and definition of industrial control system
Industrial control system (ICS) is a general term for several types of control systems, including data acquisition and monitoring control system (SCADA), distributed control system (DCS) and other control systems, such as programmable logic controller (PLC), which is often used in industrial departments and key infrastructure. Industrial control systems are commonly used in industries such as power, water and sewage treatment, oil and gas, chemicals, transportation, pharmaceuticals, pulp and paper, food and beverage, and discrete manufacturing (such as automotive, aerospace, and durable goods). Industrial control system is mainly composed of process level, operation level and communication network between and within all levels. For large-scale control system, it also includes management level. Process level includes controlled object, field control equipment and measuring instrument, operation level includes engineer and operator station, human-machine interface, configuration software, control server, management level includes production management system and enterprise resource system, communication network includes commercial Ethernet, industrial Ethernet, field bus, etc.
Hierarchical model of industrial control system
The standard refers to the hierarchical model division of IEC 62264-1, and abstracts the commonness of models such as SCADA system, DCS system and PLC system, forming the hierarchical architecture model as shown in Figure 2. It is divided into five levels from top to bottom, which are enterprise resource level, production management level, process monitoring level, field control level and field equipment level. The real-time requirements of different levels are different.
Enterprise resource layer mainly includes ERP system function unit, which is used to provide decision-making operation means for enterprise decision-making staff;
The production management layer mainly includes MES system functional unit, which is used to manage the production process, such as manufacturing data management, production scheduling management, etc;
The process monitoring layer mainly includes monitoring server and HMI system functional unit, which is used to collect and monitor the production process data, and realize human-computer interaction by using HMI system;
The field control layer mainly includes all kinds of controller units, such as PLC, DCS control unit, etc., which are used to control the executive equipment;
The field equipment layer mainly includes various process sensing equipment and execution equipment units, which are used to sense and operate the production process.
According to the architecture model of industrial control system, different levels of business application, real-time requirements and different communication protocols between different levels, the industrial control security products or solutions that need to be deployed are different, especially the boundary involving industrial control protocol communication needs to be deployed with industrial control security products for protection, which not only supports fine-grained access control of industrial control protocol, but also meets the requirements of The requirement of real-time at all levels.
Typical hierarchical architecture model of industrial control system
The standard specially indicates that with the development of industry 4.0 and information physical system, the above hierarchical architecture can not be fully applied. Therefore, for the actual development of different industries and enterprises, it is allowed to merge some levels, and can be judged according to the actual scenarios of users.
- Mapping of related content
Mapping of related content
Considering the complexity of industrial control system, the diversity of network, and the flexibility of classification of protection objects, the use of the basic requirements of security classification protection brings selection requirements. This standard gives the mapping relationship of the relevant contents of this standard at all levels, which can be referred to in practical application:
constraint condition
The industrial control system usually requires high reliability and availability, so the following constraints shall be met when the industrial control system is protected according to the level protection:
[] in principle, the safety measures shall not adversely affect the basic functions of the industrial control system with high availability. For example, accounts used for basic functions should not be locked, even for a short time;
[] the deployment of security measures shall not significantly increase the delay and affect the system response time;
[] for the high availability control system, the failure of safety measures shall not interrupt the basic functions, etc;
[] when it is assessed that there is a significant impact on availability and it is unable to implement and implement the relevant provisions of the safety level protection requirements, a safety statement shall be made to analyze and explain the possible impact and consequences of the implementation of this provision, as well as the compensation measures used.
Electric power industry
General introduction
As the forerunner of information security construction in industrial control field, electric power industry has accumulated a lot of experience in information security construction.
During the construction of power monitoring system security protection system, electric power enterprises always adhere to the principle of independent control, and study a number of special security protection technologies, such as information isolation and exchange, vertical encryption authentication, etc., thus forming a number of information security industry technical specifications and standards;
Independent research and development for key products, and unified organization for strict testing, to ensure the safety of key systems independently controlled;
Each electric power enterprise has successively established the information security related organization system, and established a relatively perfect information security management system, including the overall information security protection strategy, management method, information notification and emergency response system, covering the main aspects of information security activities;
This paper summarizes and forms the information security protection strategy of "security zoning, network specific, horizontal isolation, vertical authentication", establishes a multi-level protection system, and achieves multi angle and all-round protection of physical, network, terminal and data.
Introduction to industrial control system
The equipment and systems involved in the power industry are very complex, but from the perspective of information security, the scenarios we need to focus on can be mainly divided into: dispatching center above the provincial level, local and county-level dispatching center, substation, power plant, power distribution.
1. Power monitoring system: specifically including power data acquisition and monitoring system, energy management system, substation automation system, converter station computer monitoring system, power plant computer monitoring system, distribution automation system, microcomputer relay protection and safety automation device, wide area phasor measurement system, load control system, water dispatching automation system and water elevator level dispatching automation System, electric energy measurement system, auxiliary control system of real-time electric power market, electric power dispatching data network, etc.
2. Electric power dispatching data network: electric power dispatching data network (hereinafter referred to as dispatching network) is a special data network for dispatching production built on the electric power SDH communication transmission network. It is the basic platform for realizing dispatching real-time and quasi real-time business data transmission, and meets the requirements of security, real-time and reliability of carrying business. At present, the dispatching network covers provincial regulation, 25 land dispatching, ultra high voltage companies, 500kV and 220kV substations and unified power plants.
3. Control area: it refers to the security area composed of real-time sub network with real-time monitoring function and vertical connection using power dispatching data network or various business systems with special channels, such as SCADA, energy management system (EMS), etc.
4. Non control area: it refers to the safe area composed of all business systems of non real-time sub network which are connected vertically and use electric power dispatching data network, which are online operation but not directly involved in the control within the scope of production control, such as dispatcher simulation training system, electric energy measurement system, electric power market operation system, etc.
5. Power monitoring system: adhere to the principle of "safety zoning, network dedicated, horizontal isolation, vertical certification" to ensure the safety of power monitoring system.
6. Power system is often divided into production control area and management information area. Production control area can be divided into control area (also known as safety area I) and non control area (also known as safety area II).
7. Primary power system: primary power system refers to the high-voltage electrical equipment directly used in the production process of production, transmission and distribution of electric energy. It includes generator, transformer, circuit breaker, disconnector, automatic switch, contactor, knife switch, bus, transmission line, power cable, reactor, motor, etc. The primary circuit or primary wiring system refers to the electrical circuit which is connected by primary equipment to form power generation, transmission, distribution or other production processes.
8. Power secondary system: secondary system refers to the low-voltage electrical equipment required for monitoring, control, regulation and protection of the work of primary equipment, as well as providing operation conditions or production command signals for operation and maintenance personnel. Such as fuse, control switch, relay, control cable, etc. The electrical circuit which is connected by the secondary equipment to monitor, control, adjust and protect the primary equipment is called the secondary circuit or secondary wiring system.
According to the characteristics of power secondary system, it is divided into production control area and management information area. Production control is divided into control area (safety area I) and non control area (safety area II). Information management is divided into production management area (Safety Area III) and management information area (Safety Area IV). Different safety protection requirements are determined for different safety zones, among which safety zone I has the highest safety level, followed by safety zone II, and so on.
Major security risks
The security configuration policy of industrial control host and device is not established. Most industrial hosts are not equipped with anti-virus or white list software, and there are a large number of USB storage device use records in the system, access control is not implemented through the host peripheral security management technology, and the key equipment of industrial control system is not using multi factor authentication. Unreasonable configuration of security devices, improper configuration of firewall rules and routers are easy to cause communication security risks. Firewall with incorrect configuration of access control rules may allow unnecessary network data transmission, such as data exchange between enterprise network and control network, which may lead to malicious attacks or malicious code propagation in the system network, and important industrial data is easy to be eavesdropped.
Power system has strict time sequence requirements, and transmission delay is easy to occur. SCADA and automatic control system have high timeliness for the direct operation of the controlled object, and it is not allowed to have significant delay and system vibration. Taking the operation of substation as an example, the delay of trigger circuit switch may lead to power fluctuation or even power failure. If malicious attackers frequently launch common requests, even if the firewall can block unauthorized requests, but in the case of insufficient data processing capacity and limited bandwidth, it will cause network delay, which is difficult to meet the real-time requirements of transmission.
There is a lack of verification mechanism for applications of various businesses of the system. Most of the power industry control equipment lacks the authentication mechanism. Even if there is, most of them are the default user names and passwords of the equipment suppliers, which are easy to be guessed or cracked. Generally, the passwords will not be changed regularly. At the same time, the resources of the application system (such as files, database tables, etc.) are at risk of unauthorized use. The lack of redundant configuration of key equipment and components leads to the insufficient ability of application program to detect, handle and recover faults, the lack of verification of program interface input or injection attack, such as SQL injection attack, etc., and the risk of system database leakage.
The management information area accumulates a large number of power sensitive data, which has the risk of leakage or tampering. Not only the electricity data of residents, but also the personal information is stored in the power database. The data of power dispatching, maintenance, operation and maintenance are easy to be queried in batches, so as to export personal sensitive information. The lack of filtering mechanism for sensitive characters will bring security risks. At the same time, the power data is usually not backed up regularly. If the data is changed or deleted due to human error, or the database itself fails, or the server goes down, the data storage security is difficult to guarantee.
Petrochemical Industry
Business introduction
Petrochemical enterprises complete the whole production process of oil and gas from exploration to processing of finished products and end-user sales, which is composed of oil and gas fields, oil and gas transportation, refining and chemical processing, oil and gas storage and transportation and oil and gas sales. It is an important capital and technology intensive enterprise in China, which needs mutual cooperation and cooperation of multiple specialties.
The petroleum industry mainly includes the exploitation, storage, refining and transportation of petroleum. Petroleum refining is the process of processing crude oil into various petroleum products through petroleum refining. The main production units in petroleum refineries usually include crude oil distillation (atmospheric and vacuum distillation), thermal cracking, catalytic cracking, hydrocracking, petroleum coking, catalytic reforming and other links, mainly producing steam Oil, jet fuel, kerosene, diesel oil, fuel oil, lubricating oil, petroleum wax, petroleum asphalt, petroleum coke and various petrochemical raw materials.
Introduction of petrochemical industry control system
The petrochemical industry involves the three-layer network structure of Internet, group network, management network and production network, including oil production, refining, oil transportation and other production links. Production areas are generally divided into production areas based on different production processes and units. Industrial control systems in each production area generally include: distributed control system (DCS), programmable logic controller (PLC), safety instrument system (SIS), compressor control system (CCS), fire and combustible gas alarm system (FGS), SCADA system, etc. The industrial control system of petrochemical industry pays attention to safe, stable, long-term, full load and high-quality operation, which is interrelated and interdependent.
System deployment architecture of petrochemical industry
Typical events in petrochemical industry
In 2011, the control system of a petrochemical plant in China was infected with Conficker virus, which caused the communication between the control system server and the controller to be interrupted in varying degrees.
In 2012, Kaspersky laboratory first found flame virus, which is said to have been dormant for at least 5-8 years before it was found. Flame virus is mainly used to obtain business intelligence of Iranian oil sector, and at least has infected corresponding computer systems of Iran, Palestine, Syria, Lebanon, Saudi Arabia and other countries in the Middle East and North Africa..
In 2014, hackers first invaded the network system of an oil pipeline management department in Turkey, then installed a malicious software, shut down the alarm, cut off the communication, and greatly boosted the crude oil in the pipeline. Due to the increasing pressure in the pipeline, the oil pipeline finally exploded, and the flame height of the explosion even reached 150 feet.
Major security risks
Most of the products produced by petrochemical enterprises are inflammable, explosive, toxic and highly corrosive substances. The operation process is very complex. There are many kinds of high-temperature and high-pressure equipment, which have strict requirements for operation. Once there is a safety problem in the production system, there may be fire and explosion on the production site, which may cause damage to the production device, and may cause casualties. Accidents lead to the leakage and diffusion of production raw materials, which may cause air, water and soil pollution for a long time in a large range, and have a serious impact on local people's lives and surrounding environment.
There are many information systems in various units of petrochemical industry, covering a wide range; there are many domestic and foreign software brands of industrial control system, so it is difficult to form a unified protection standard strategy to deal with safety problems; in terms of control system in the petroleum industry, the petroleum refining industry uses a large number of foreign DCS systems such as Honeywell PKS, Yokogawa CENTUM VP, etc. In addition, when the software is facing the network application, it must open the port. Once it is maliciously attacked and utilized, the result is unimaginable.
There are many device brands, so it's difficult to operate safely. DCS is used for refining and chemical industry, PLC is used for storage, SCADA system is used for pipeline transportation, the brands of industrial control system in each production area are different, it is difficult to manage uniformly, and there are many kinds of control equipment, the localization rate is low, the system operation and maintenance are difficult, so it is impossible to achieve safety and independent control.
There is no isolation protection between each layer of network. The enterprise's control network system is complex and diverse, lack of necessary security boundary and regional function division, process control layer and data acquisition layer, advanced control (APC) system and process control network, controller and operator station (engineer station), lack of access control measures. Once a virus or Trojan appears in a node of the system, it will quickly spread to the whole network.
The engineer station lacks identity authentication mechanism. In general, the engineer station only has the administrator account, and the configuration behavior of the operator station and DCS controller is usually lack of identity authentication. Because of having the highest operation authority, the control logic and process can be modified arbitrarily, there is a major hidden danger of direct configuration of field equipment.
APC system itself is not equipped with any safety protection. During the installation, debugging and modification of project engineers, APC system needs frequent data exchange with the outside, so the risk of virus infection is high. Once the APC system is infected with Trojans, viruses and other problems, the security of the real-time running control system will not be guaranteed.
Gas industry
Business introduction
Urban gas is widely used in many fields, such as residential life, industry and commerce, power generation, transportation, distributed energy and so on. It is an indispensable energy for urban development. The safe and reliable operation of natural gas long-distance pipeline system is directly related to the development of national economy and the safety of people's life and property.
SCADA system is the core of the long-distance natural gas industrial control system. The safety of this system is directly related to the production safety. With the rapid development of information technology, the security problem of information system is also serious. For example, attacks from network space will directly threaten the security of SCADA system by using public network, and then cause physical damage to the pipeline system, and even lead to production accidents.
Industrial control system
At present, with the wide application of modern computer technology and automation technology in the pipeline gas industry, urban gas enterprises have established the corresponding SCADA system of urban gas pipeline network, which realizes the remote management, centralized control, automatic real-time data acquisition, accident alarm, parameter adjustment, gas volume adjustment and other management functions of gas transmission pipeline, gas transmission station and gas reserve station It reduces management cost and production risk, and saves human resources. Most urban gas enterprises adopt SCADA system, which integrates PLC and RTU control equipment. Operators can complete the monitoring and operation management of gas transmission and distribution system through SCADA system in dispatching control center.
SCADA system of urban gas pipeline network is generally divided into dispatching control center, transmission network (wired + wireless backup) and station control system according to area and function. The dispatching control center mainly includes SCADA server, database server, web server, communication server and workstation (operator workstation, engineer workstation, video workstation). The dispatching control center generally realizes data interaction with external system through communication server or special server. The dispatching control center and its subordinate station control are interconnected through optical fiber special line and wireless network of operators (such as GPRS, CDMA, etc.) to realize redundant line backup at the same time. The station control system is mainly divided into three types according to its functions: gate station, pressure regulating station and valve chamber.
Major risks
At present, the SCADA system of urban gas pipeline network mainly has the following industrial control safety problems.
1. Communication protocol vulnerability
The highly integration of automation and information technology and the development of the Internet of things make Modbus protocol, PROFIBUS protocol, OPC protocol and other industrial protocols more and more widely used in industrial control network. The openness of the protocol makes it vulnerable to attack, while the traditional it firewall cannot find and prevent the security problems.
2. Industrial equipment leak
A large number of products such as Siemens and Honeywell are used in SCADA system of urban gas pipeline network in China. However, due to the loopholes in these products, script attacks can be used to change the operation instructions, thus affecting the normal production.
3. Operating system vulnerability
The engineer station / operator station / HMI of SCADA system of urban gas pipeline network are all based on Windows platform. In order to ensure the relative independence of process control system and consider the stable operation of the system, usually the field engineer station / operator station / HMI will not install any patches to the windows platform after the system is running, which has great security risks.
4. Security policy and management process vulnerabilities
It is a common phenomenon in many industrial control systems to pursue availability at the expense of security. The lack of complete and effective security policies and management processes also poses a certain threat to the information security of industrial control systems. For example, in the industrial control system, the use of mobile storage media and lax access control strategies, including laptops, USB flash drives and other devices.
https://www.kiwisec.com/news/detail/5c1c603bdb30c341099f28ab.html
https://www.venustech.com.cn/article/new_type/52.html
https://www.secrss.com/articles/3526
http://www.winicssec.com/Wap/Index/show/catid/57/id/456.html
http://plcscan.org/blog/2016/03/ics-standards-development-and-thoughts/
https://zhuanlan.zhihu.com/p/30273367
We collected the standard regulations and other industrial control standards mentioned in the article, and paid attention to the official account below, and replied to the "industrial control standard", which could get relevant information.
Tide security team was formally established in January 2019. It is a security team under the banner of new information, aiming at the research of Internet attack and defense technology. At present, it has gathered more than ten professional security attack and defense technology researchers, focusing on network attack and defense, web security, mobile terminals, security development, IOT / Internet of things / industrial control security and other directions.
Since its establishment, the tide security team has continuously submitted vulnerabilities to CNCERT, cnvd, vulnerability box, Mendian, various large SRC and other vulnerability submission platforms. The two vulnerability mining teams successively established in the vulnerability box have ranked in the top ten among more than 300 security teams in the country. In terms of product research and development, tide has independently developed an asset retrieval system for Internet infrastructure, that is, tide network space search platform. The platform combines network security technology and big data analysis and processing technology to carry out network security threat monitoring and network security situation analysis for Internet infrastructure. The tide security team has developed multiple security platforms by itself, such as wdscanner, Mars platform, tidal fingerprint identification system, internal SRC platform, security network classroom, security test case database, social work database, mosec mobile terminal detection platform, vulnerability knowledge database, agent resource pool, dictionary weight database, etc. the team members are on freebuf, Jianshu, CSDN, 51CTO, cnblogs, etc All stations set up columns or blogs to study security technology and share experience and skills.
For more Tide security teams, please pay attention to the official website of the team: http://www.TideSec.net or official account.