ISA-62443-2-2：工业物联网安全指南与IIoT网络安全挑战

需积分: 13 132 浏览量更新于2024-07-09 收藏 1.15MB PDF 举报

随着工业物联网（Industrial Internet of Things, IIoT）的日益普及，工业网络正面临着与公共互联网融合的挑战。在这个过程中，IIoT不仅提升了工厂运营效率，也暴露了新的网络安全风险，因为这些连接的设备和系统成为了黑客攻击的目标。为了应对这一趋势，国际电工委员会（International Electrotechnical Commission, IEC）发布了62443系列标准，其中62443-2-2文档专门关注工业自动化和控制系统中的网络安全。 62443-2-2标准旨在提供一套全面的指南和最佳实践，以确保工业网络的安全性。它涵盖了网络架构的设计、实施和管理，包括但不限于身份验证、访问控制、数据加密、安全审计和应急响应措施。标准强调了对已知安全漏洞的修补和未知威胁的防御，以减少潜在的破坏，保护关键基础设施免受网络攻击。在实施过程中，62443-2-2标准鼓励企业进行定期的风险评估和演练，以确保安全策略的执行效果。它还提倡采用纵深防御策略，即通过多层次的安全防护手段来抵御攻击，而不是依赖单一的安全解决方案。此外，标准强调了与其它信息安全标准如ISO/IEC 27001（信息安全管理体系）的集成，以建立一个完整的信息安全框架。然而，这份草案工作产品仅供ISA 99委员会成员审议，其内容未经正式审查或认可，可能不完整并随时可能变动。因此，企业在参考和应用时需保持警惕，务必确保遵循最新的官方发布。复制、分发或销售此文档都是未经许可的行为，需要事先得到ISA的书面授权。 62443-2-2标准对于推动工业物联网环境下的网络安全至关重要，它为工业自动化系统的保护提供了标准化的方法和实践，帮助企业降低网络安全威胁，保障工业生产过程的连续性和稳定性。同时，对于任何从事IIoT安全工作的专业人士来说，理解和遵循这一标准是提升整个工业领域网络安全水平的关键。

ISA-99.02.02, D1E4, March 2011  10  ISA99, WG10, TG01

FORWORD

This standard is part of a series that addresses the issue of security for industrial automation and control systems.

It has been developed by Working Group 10, Task Group 01 of the ISA99 committee.

This standard addresses the requirements for the operation of an effective cyber security program within the

context of the foundational requirements defined in ISA‑99.01.01.

SKELETON NOTE The forward should only be a few lines and should indicate the basic premise of the document

and why it is important. It should also indicate if this document supersedes or modifies any other document.

The following information comes from the IEC Directives.

The foreword shall appear in each document. It shall not contain requirements, recommendations, figures

or tables.

It consists of a general part and a specific part. The general part (supplied by the Central Secretariat of

ISO or by the Central Office of the IEC, as appropriate) gives information relating to the organization

responsible and to International Standards in general, i.e.

a) the designation and name of the committee that prepared the document,

b) information regarding the approval of the document, and

c) information regarding the drafting conventions used, comprising a reference to this part of the ISO/IEC

Directives.

The specific part (supplied by the committee secretariat) shall give a statement of significant technical

changes from any previous edition of the document and as many of the following as are appropriate:

d) an indication of any other international organization that has contributed to the preparation of the

document;

e) a statement that the document cancels and replaces other documents in whole or in part;

f) the relationship of the document to other documents (see 5.2.1.3);

g) in IEC, an indication of the next stability date (see ISO/IEC Directives, IEC Supplement, 2010, 3.4).

This copy of a draft work product of the ISA99 committee is provided solely for the purpose of supporting the further development of committee work products.

The content has not been formally reviewed or approved by the committee or ISA. It may not be complete and is subject to change.

This document may not be copied, distributed to others or offered for further reproduction or for sale.

ISA99, WG10, TG01  11  ISA-99.02.02, D1E4, March 2011

INTRODUCTION

NOTE The format of this document follows the ISO/IEC requirements discussed in ISO/IEC Directives, Part 2.

[14]

The ISO/IEC Directives specify       

             Error! Reference source not found.

of this document use the conventions discussed in the ISO/IEC Directives, Appendix H.

The initial content of this section is based on similar material from other standards in the ISA99 series. This is

provided only as a starting point.

Context

Industrial automation and control system (IACS) organizations increasingly use commercial-

off-the-shelf (COTS) networked devices that are inexpensive, efficient and highly automated.

These devices and networking technologies provide an increased opportunity for cyber attack

against the IACS equipment. This weakness may lead to health, safety and environmental

(HSE) consequences in deployed systems.

Organizations deploying pre-existing information technology (IT) and business cyber security

solutions to address IACS security may not fully comprehend the results of this decision.

While many business IT applications and security solutions can be applied to IACS, they need

to be applied in the correct way to eliminate inadvertent consequences. For this reason, the

approach used to define system requirements needs to be based on a combination of

functional and consequence analysis, and often an awareness of operational issues as well.

The primary goal of the ISA‑99 series is to provide a flexible framework that facilitates

addressing current and future vulnerabilities in IACS and applying necessary mitigations in a

systematic, defensible manner. It is important to understand that the intention of the ISA‑99

series is to build extensions to enterprise security that adapt the requirements for IT business

systems and combine them with the unique requirements that embrace the strong availability

needed by IACS. The ISA‑99 committee has made every effort to avoid building unique

stovepipe security architectures for IACS.

This International Standard provides interpretation guidelines for the implementation and

management of information security management for Industrial Automation and Control

Systems (IACS). The approach used is consistent with ISO/IEC 27002 (Code of practice for

information security management).

IACS security goals focus on system availability, plant protection, plant operations (even if in

a degraded mode), and time-critical system response. IT security goals often do not place the

same emphasis on these factors. They may be more concerned with protecting information

rather than physical assets. These different goals need to be clearly stated as security

objectives regardless of the degree of plant integration achieved.

This document assumes that a security program has been established in accordance with

ISA‑99.02.01 and that patch management is implemented consistent with the

recommendations detailed in ISA‑TR99.02.03.

Audience

The audience for the information in this standard includes asset owners, those responsible for

information security; system vendors, auditors, and application content providers, with a

common set of general security control objectives based on ISO/IEC 27002, IACS specific

controls, and information security management guidelines allowing for the selection and

implementation of such controls.

SKELETON NOTE For most documents in the ISA-99 series, the Introduction will probably be labeled as Clause

0, since there are sub-clauses included. This is common. The Introduction should be limited to no more than 2

pages and should contain no figures. If figures are needed, then that section should be moved to Clause 4+ or an

Annex. If you need a Clause 0, you will nee          



Numbers in square brackets refer to the Bibliography.

This copy of a draft work product of the ISA99 committee is provided solely for the purpose of supporting the further development of committee work products.

The content has not been formally reviewed or approved by the committee or ISA. It may not be complete and is subject to change.

This document may not be copied, distributed to others or offered for further reproduction or for sale.

剩余68页未读，继续阅读

binjun_charles

粉丝: 0
资源: 11

ISA-62443-2-2：工业物联网安全指南与IIoT网络安全挑战

IEC62443-4-2-DRAFT.pdf

ISA-d62443-1-1.pdf

ISA-d62443-1-2.pdf

ISA-d62443-2-1.pdf

ISA-d62443-2-3.pdf

ISA-d62443-3-1.pdf

微机原理与接口技术试题及答案A..-共13页.pdf

riscv-privileged-draft-20191214-d98903e.pdf

Zc-1.0.4-3.pdf

riscv-spec-20191213.pdf

最新资源