"IEC 62434-1-1: 工业网络安全标准，国际标准，英文高清彩色版本"

需积分: 0 185 浏览量更新于2024-01-15 收藏 1.4MB PDF 举报

IEC 62434-1-1是一项工业网络安全标准，被视为工业网络安全的基石和指导。它是国际电工委员会（IEC）颁布的一项国际标准，其英文版本提供了高清彩色的应用。该标准的技术规范为IEC/TS 62443-1-1，最新版本为1.0，发布于2009年7月。 IEC 62434-1-1关注工业通信网络的安全性，特别是网络和系统的安全性。它提供了术语、概念和模型，是工业网络安全的重要指南。该标准涵盖了工业通信网络的各个方面，包括通信协议、硬件设备、软件系统和数据传输等。它强调网络和系统安全的重要性，提供了一套统一的标准和方法来保护工控系统免受网络攻击和安全威胁。 IEC 62434-1-1的目标是提供一个统一的工业网络安全框架，以确保工控系统的安全性和可靠性。它定义了一些重要的术语，例如攻击、威胁、风险和安全控制等，为工业网络安全提供了明确的定义和范围。同时，它也提供了一些重要的概念和模型，如安全防御策略、风险评估和安全管理体系等，为工业网络安全提供了指导原则和最佳实践。 IEC 62434-1-1的实施对于工控系统的安全至关重要。它建立了一套标准的安全要求和措施，以确保工业通信网络的安全性。通过采用该标准，工业控制系统可以更好地抵御各种网络攻击和安全威胁，提高系统的可靠性和稳定性。此外，该标准还鼓励组织建立完善的安全管理体系，包括安全培训、漏洞管理和事件响应等，以便及时应对安全事件和威胁。 IEC 62434-1-1在国际范围内得到了广泛的认可和应用。许多国际组织和机构都采用了该标准，作为工业网络安全的主要参考依据。该标准在国际电工委员会的指导下，由全球各领域的专家共同制定和完善，具有权威性和可信度。通过遵循该标准，组织可以提高自身的安全能力，并为客户和利益相关方提供更可靠和安全的产品和服务。总之，IEC 62434-1-1是一项重要的工业网络安全标准，其英文高清彩色版本为IEC/TS 62443-1-1。该标准提供了术语、概念和模型，为工业网络安全提供了明确的定义和指导原则。通过实施该标准，可以提高工业控制系统的安全性和可靠性，保护系统免受各种网络攻击和安全威胁。同时，该标准的国际应用和认可证明了其权威性和可信度，对于组织和行业发展具有重要意义。

TS 62443-1-1 © IEC:2009(E) – 13 –

3.2.20

channel

pecific communication link established within a communication conduit (see 3.2.27 )

3.2.21

ciphertext

data that has been transformed by encryption so that its semantic information content (i.e., its

meaning) is no longer intelligible or directly available

3.2.22

client

device or application receiving or requesting services or information from a server application

[11]

3.2.23

communication path

logical connection between a source and one or more destinations, which could be devices,

physical processes, data items, commands, or programmatic interfaces

NOTE The communication path is not limited to wired or wireless networks, but includes other means of

communication such as memory, procedure calls, state of physical plant, portable media, and human interactions.

3.2.24

communication security

a) measures that implement and assure security services in a communication system,

particularly those that provide data confidentiality and data integrity and that authenticate

communicating entities

b) state that is reached by applying security services, in particular, state of data confidentiality

integr

ity, and successfully authenticated communications entities

[10]

NOTE This phrase is usually understood to include cryptographic algorithms and key management methods and

processes, devices that implement them, and the life-cycle management of keying material and devices. However,

cryptographic algorithms and key management methods and processes may not be applicable to some control

system applications.

3.2.25

communication system

arrangement of hardware, software, and propagation media to allow the transfer of messages

from one application to another [9]

3.2.26

compromise

unauthorized disclosure, modification, substitution, or use of information (including plaintext

cryptographic keys and other critical security parameters) [12]

3.2.27

conduit

logical grouping of communication assets that protects the security of the channels it contains

NOTE This is analogous to the way that a physical conduit protects cables from physical damage.

3.2.28

confidentiality

assurance that information is not disclosed to unauthorized individuals, processes, or devices

– 14 – TS 62443-1-1 © IEC:2009(E)

3.2.29

control center

central location used to operate a set of assets

NOTE 1 Infrastructure industries typically use one or more control centers to supervise or coordinate their

operations. If there are multiple control centers (for example, a backup center at a separate site), they are typically

connected together via a wide area network. The control center contains the SCADA system, host computers and

associated operator display devices plus ancillary information systems such as an historian.

NOTE 2 In some industries the term “control room” may be more commonly used.

3.2.30

control equipment

class that includes distributed control systems, programmable logic controllers, SCADA

systems, associated operator interface consoles, and field sensing and control devices used to

manage and control the process

NOTE The term also includes fieldbus networks where control logic and algorithms are executed on intelligent

electronic devices that coordinate actions with each other, as well as systems used to monitor the process and the

systems used to maintain the process.

3.2.31

control network

time-critical network that is typically connected to equipment that controls physical processes

(see 3.2.97)

NOTE The control network can be subdivided into zones and there can be multiple separate control networks

within one company or site.

3.2.32

cost

value of impact to an organization or person that can be measured

3.2.33

countermeasure

action, device, procedure, or technique that reduces a threat, a vulnerability, or an attack by

eliminating or preventing it, by minimizing the harm it can cause, or by discovering and

reporting it so that corrective action can be taken [10]

NOTE The term “control” is also used to describe this concept in some contexts. The term countermeasure has

been chosen for this document to avoid confusion with the term “control” in the context of process control.

3.2.34

cryptographic algorithm

algorithm based upon the science of cryptography, including encryption algorithms,

cryptographic hash algorithms, digital signature algorithms, and key agreement algorithms

3.2.35

cryptographic key

input parameter that varies the transformation performed by a cryptographic algorithm [10]

NOTE Usually shortened to "key".

TS 62443-1-1 © IEC:2009(E) – 15 –

3.2.36

bersecurity

actions required to preclude unauthorized use of, denial of service to, modifications to,

disclosure of, loss of revenue from, or destruction of critical systems or informational assets

NOTE The objective is to reduce the risk of causing personal injury or endangering public health, losing public or

consumer confidence, disclosing sensitive assets, failing to protect business assets or failing to comply with

regulations. These concepts are applied to any system in the production process and include both stand-alone and

networked components. Communications between systems may be either through internal messaging or by any

human or machine interfaces that authenticate, operate, control, or exchange data with any of these control

systems. Cybersecurity includes the concepts of identification, authentication, accountability, authorization,

availability, and privacy.

3.2.37

data confidentiality

property that information is not made available or disclosed to any unauthorized system entity,

including unauthorized individuals, entities, or processes [8]

3.2.38

data integrity

property that data has not been changed, destroyed, or lost in an unauthorized or accidental

manner [10]

NOTE This term deals with constancy of and confidence in data values, not with the information that the values

represent or the trustworthiness of the source of the values.

3.2.39

decryption

process of changing cipher text into plaintext using a cryptographic algorithm and key (see

3.2.47) [10]

3.2.40

defence in depth

provision of multiple security protections, especially in layers, with the intent to delay if not

prevent an attack

NOTE Defence in depth implies layers of security and detection, even on single systems, and provides the

following features:

• attackers are faced with breaking through or bypassing each layer without being detected;

• a flaw in one layer can be mitigated by capabilities in other layers;

• a system security becomes a set of layers within the overall network security.

3.2.41

demilitarized zone

perimeter network segment that is logically inserted between internal and external networks

NOTE 1 The purpose of a demilitarized zone is to enforce the internal network’s policy for external information

exchange and to provide external, untrusted sources with restricted access to releasable information while shielding

the internal network from outside attacks.

NOTE 2 In the context of industrial automation and control systems, the term “internal network” is typically applied

to the network or segment that is the primary focus of protection. For example, a control network could be

considered “internal” when connected to an “external” business network.

3.2.42

denial of service

prevention or interruption of authorized access to a system resource or the delaying of system

operations and functions [10]

NOTE In the context of industrial automation and control systems, denial of service can refer to loss of process

function, not just loss of data communications.

3.2.43

digital signature

result of a cryptographic transformation of data which, when properly implemented, provides

the services of origin authentication, data integrity, and signer non-repudiation [11]

3.2.44

distributed control system

type of control system in which the system elements are dispersed but operated in a coupled

manner

NOTE 1 Distributed control systems may have shorter coupling time constants than those typically found in

SCADA systems.

NOTE 2 Distributed control systems are commonly associated with continuous processes such as electric power

generation, oil and gas refining, chemical, pharmaceutical and paper manufacture, as well as discrete processes

such as automobile and other goods manufacture, packaging, and warehousing.

3.2.45

domain

environment or context that is defined by a security policy, security model, or security

architecture to include a set of system resources and the set of system entities that have the

right to access the resources [10]

3.2.46

eavesdropping

monitoring or recording of communicated information by unauthorized parties

3.2.47

encryption

cryptographic transformation of plaintext into ciphertext that conceals the data’s original

meaning to prevent it from being known or used (see 3.2.39) [10]

NOTE If the transformation is reversible, the corresponding reversal process is called "decryption," which is a

transformation that restores encrypted data to its original state.

3.2.48

enterprise

business entity that produces or transports products or operates and maintains infrastructure

services

3.2.49

enterprise system

collection of information technology elements (i.e., hardware, software and services) installed

with the intent to facilitate an organization’s business process or processes (administrative or

project)

3.2.50

equipment under control

equipment, machinery, apparatus or plant used for manufacturing, process, transportation,

medical or other activities [13]

3.2.51

field I/O network

communications link (wired or wireless) that connects sensors and actuators to the control

equipment

3.2.52

firewall

inter-network connection device that restricts data communication traffic between two

connected networks [10]

剩余82页未读，继续阅读

Jesse2_Wang

粉丝: 0
资源: 2

"IEC 62434-1-1: 工业网络安全标准，国际标准，英文高清彩色版本"

电磁兼容标准IEC 61850标准系列： IEC 61850-1、IEC 61850-3 、IEC 61850-4 、IEC 61850-5 、IEC 61850-6 、IEC 61850-10

IEC 61850-8-1 IEC 61850-9-1 IEC 61850-9-2

IEC62311-1-2017 中英文版本，IEC 62133-2-2017 中英文版，IEC62133-2012 中英文版

【最新版_】 IEC 60601-1 对比 IEC 60601-1-11差异分析 .rar

【最新版_】 IEC 60601-1 对比 IEC 60601-1-11差异分析 .pdf

IEC62196-1 -3 IEC 62196-1-2014 插头、插座、车辆连接器和车辆插孔--电动车辆的传导充电

IEC61967-1到IEC61967-6标准大全

iec61162-1{ed2_0}en_IEC61162-1_

IEC870-5-101.rar_101报文_5-101_IEC870-5-104_iec 60870-5-101_iec101

IEC62056-61.rar_IEC62056_IEC62056-_IEC62056-42_meter_reading

最新资源