01,21,2026 78 views
With the deep integration of informatization and industrialization, industrial control system products are increasingly adopting universal protocols, universal hardware, and universal software to connect with enterprises in various waysERPSystems, even connected to public networks such as the Internet, and threats such as viruses and trojans in traditional information networks are spreading to industrial control systems,SCADATheDCSThePLCThe information security threats faced by industrial control systems. The United States has long been20We began to pay attention to the issue of information security in industrial control systems at the policy level a year ago, and have successively formulated a series of standards and specifications. Since the outbreak of the "Stuxnet" virus in Iran, it has attracted high attention from the country, and the work of formulating relevant standards and specifications has begun, which is a long and arduous task.
1、 Current Status of Foreign Standards
2000In the year, the Electrical Commission officially releasedIEC61508electrical/electron/The functional safety of programmable electronic security systems is divided into seven parts, involving1000Multiple standards.
2006In the year, the National Institute of Standards and Technology in the United States（NIST）EstablishedNISTSP800-82SCADAGuidelines for Industrial Control System Safety.
2009In the year,IEC/TC65/WG10Industrial Process Measurement, Control, and Automation by the Electrotechnical Association/Network and System Information Security Working Group and Automation AssociationISA99Established a joint working group to organize and formulateIEC62443Industrial automation and control system information security is a series of standards aimed at addressing the challenges of information security in industrial automation and control systems, in order to mitigate the risks of information security in industrial control systems.
2011In the year,NISTformulatedNISTSP800-82The Information Security Guidelines for Industrial Control Systems aim to guide developers and integrators in establishing secure industrial control systems.
In addition, countries such as the United States, the United Kingdom, France, Germany, the Netherlands, and Sweden attach great importance to the standardization of industrial control system information security, and have issued a series of normative documents in terms of standards and regulations, from national regulations and standards to industry norms and guidelines.
2、 Current Status of Domestic Standards
2011In, the National Technical Committee for Standardization of Industrial Process Measurement and Control releasedGB/T26333-2010Specification for Industrial Control Network Security Risk Assessment.
2011In the year, the Ministry of Industry and Information Technology released451Notice on Strengthening Information Security Management of Industrial Control Systems "requires strengthening the control systems and infrastructure of major industrial sectors in the countrySCADAThe security protection work of the system.
2012In the year, the State Council issued23The document "Several Opinions on Vigorously Promoting the Development of Informatization and Effectively Ensuring Information Security" clearly proposes to carry out information security inspections of industrial control systems.
2014In, the National Industrial Process Measurement and Control Standardization Technical Committee, in conjunction with the National Information Security Standardization Technical Committee, releasedGB/T30976.1-2014Information Security of Industrial Control Systems1Partial evaluation standards andGB/T30976.2-2014Information Security of Industrial Control Systems2Partial acceptance standards.
In the industrial sector, the power industry has always been at the forefront, having successively2005The Electricity Regulatory Commission released a report in the year5Order "Regulations on Safety Protection of Secondary Power Systems", issued on2014Released by the National Development and Reform Commission in the year14Order "Regulations on Safety Protection of Power Monitoring Systems".
3、 Domestic standard planning
Under the guidance of the series of standards for information system security level protection, traditional information systems are carrying out information security work vigorously. Currently, the * department is leading the organization to formulate the series of standards for industrial control system information security level protection, including basic requirements, design technical guidelines, and evaluation requirements.
For different specific industrial control systems, various standards are also being intensively developed, such as the programmable controller submitted to the National Industrial Process Measurement and Control Standardization Technical Committee in conjunction with the National Information Security Standardization Technical Committee（PLC）System information security requirements, distributed control system（DCS）Safety protection requirements, etc.
In the industrial sector, the Information Center of the National Energy Administration and the Beijing Oil and Gas Control Center respectively take the lead in organizing the formulation of relevant professional safety protection standards.
Overall, standards in the field of information security for industrial control systems in China are gradually being established and improved. While translating and digesting similar foreign standards and specifications, domestic industrial control system manufacturing enterprises actively participate in the standard setting work and play a significant role in the localization of technical requirements. At present, the urgent task is to establish practical and effective mandatory standards for industrial control system level protection, which can constrain the information security of newly built industrial control systems while also playing a good supervisory role on existing industrial control systems. As a domestic industrial control system evaluation institution, CCID Industrial Control is actively promoting the planning and formulation of standards. In addition, various industrial industries should follow the example of the power industry and actively develop information security standards and specifications for industrial control systems that are in line with the characteristics of their respective industries, in order to guide and regulate the information security work of industrial control systems in their respective industries
