With the integration of industrialization and information technology, industrial control system evolves from traditional closed system to open network system, from information island to process control and enterprise information system integration, industrial control system scale is getting bigger and bigger, the process is becoming more and more complex, and the information security threat is increasing. In recent years, attacks on the industrial control system have risen sharply, and network security incidents have “erupted”, resulting in a series of serious consequences. In short, the more important the system, the more likely it is to attack, and the worse the consequences. In 2010, the Siemens PLC terminal damaged more than 1,000 centrifuges and paralyzed the nuclear power plant. In 2015, a massive power outage in Ukraine infiltrated the control system and paralyzed 30 substations for six hours, affecting 1.4 million users. In 2018, Intel chip “dissolution” and “ghost” vulnerabilities occurred, which were used to attack and obtain the user’s account password, communication information and other privacy. Thus, the security events of key industrial infrastructure will lead to major economic losses, have a huge impact on social stability, and are related to national security, economic development and social stability.
At present, the connotation and extension of industrial security has changed, from multidimensional perspective, its technical means, including physical security, functional security, information security, system layer, monitoring layer, control layer and devices, infrastructure security, real-time control behavior safety, disaster system safety, business process, operation and maintenance involves technical level and management level, business process covers the design, development, implementation, operation, end, life cycle, covering oil, chemical, power, metallurgy, rail transit, municipal, water treatment and other industries. In essence, the security of the future must focus on the unified security of information and data, personnel and property, equipment assets and community environment.
In May 2016, the world’s first truly industrial worm PLC virus exploded, which could have catastrophic consequences for critical infrastructure, by creating exponentially growing attacks and being difficult to detect and stop. The vulnerability is not a problem with S7 itself, but with the design of the entire system architecture. Against this attack, replacing the hardware in S7 is needed to be able to detect higher frequencies and to install low-pass filters around the actuator and PLC. In August 2017, hackers attempted to cause an explosion in a Saudi petrochemical plant, not simply destroying data or closing the plant, but to disrupt the company’s operations and cause the explosion. In other words, the design idea of physical security, functional security and information security of the industrial control system has had huge hidden dangers, and the traditional industrial security concept can no longer guarantee the safe and stable operation of the industrial system.
Differences between ICS Security and Traditional Network Security:
Different safety requirements;
Differences between security patches and upgrade mechanism;
Real-time differences;
Differences in security protection priorities;
Differences in the adaptability of security protection technology.
The connotation, requirements and objectives of information security of industrial control system determine the need for some special information security technologies and measures that can be used or configured in IED, PLC, RTU, controller, communication processor, SCADA system and various practical and various types of programmable digital equipment, in order to achieve the security function objectives of ensuring the production, control and management of industrial control system. The basic techniques of information security in all automated control systems are access control and user identity authentication. On this basis, some technologies to protect the security of communication data messages are developed by means of detection, channel encryption, packet verification and authentication. In order to realize the information security of the industrial control system under the premise of functional security, it is necessary to build a multi-directional management and overall security protection technology system of the information security of the industrial control system.
Industrial Production Safety:
“Industrial safety” mentioned some topics can be attributed to the big category of “industrial production”, “industrial production” or “industrial production” refers to the modern production mode and advanced production tools and equipment processing into various raw materials to meet the use requirements, and has certain performance indicators of products, to meet the application needs of different occasions, different users. The core goal of industrial production is to produce a predetermined number of products that meet the required quality (i. e., function and performance indicators) and do not exceed the predetermined cost within a predetermined time. Here, the quantity, quality, cost of products, is the three basic requirements for industrial production, and around these three requirements, people from the product design, production equipment, process, materials, production process control, production operator knowledge and skills and other aspects of continuous improvement, and strive to achieve perfect industrial production. To sum up, industrial production cannot be separated from material, energy, information, time and space. The main task of industrial control is to comprehensively coordinate these production factors to achieve the core goal of industrial production.
With the continuous development and progress of society, people have more and more requirements for industrial production, in addition to the above basic requirements, the diversity of products, production process for resource consumption, environmental pollution and damage, damage to production personnel, damage to production equipment, and other aspects are put forward higher requirements. Therefore, the concept of industrial safety is gradually formed, and has received more and more attention to the industry. The basic concept of industrial safety is still developed around the core goal of industrial production, and the higher level of requirements include equipment safety, personnel safety, environmental safety and business safety and many other aspects of the content. It can be said that industrial security is a multi-dimensional problem with many goals, and its most important part is to make industrial control and a series of means and technologies more reliably play a role.
At the end:
Throughout the future development trend of industrial security, it will be covering industrial system design, development, implementation, operations, end horizontal life cycle, and control layer, network layer, system layer, management and longitudinal operations, from the perspective of large system engineering, using game theory methodology, through the depth of integration and multidimensional security technology, to ensure the availability of industrial system as the goal, the comprehensive use of physical security, functional security, information security and other technical means and management measures, to realize the safe and stable operation of industrial system.
With the continuous progress of science and technology, the production process is increasingly becoming digital, networked and intelligent, which is the general trend of the future development of industrial production. Information security, in some ways, is the fundamental guarantee to achieve all this.
