工业控制系统安全指南Guide+to+Industrial+Contrl+Systems+(ICS)

SpecialPublication800-82GuidetoIndustrialControlSystems(ICS)SecuritySupervisoryControlandDataAcquisition(SCADA)systems,DistributedControlSystems(DCS),andothercontrolsystemconfigurationssuchasProgrammableLogicControllers(PLC)RecommendationsoftheNationalInstituteofStandardsandTechnologyKeithStoufferJoeFalcoKarenScarfoneNISTSpecialPublication800-82GuidetoIndustrialControlSystems(ICS)SecuritySupervisoryControlandDataAcquisition(SCADA)systems,DistributedControlSystems(DCS),andothercontrolsystemconfigurationssuchasProgrammableLogicControllers(PLC)RecommendationsoftheNationalInstituteofStandardsandTechnologyComputerSecurityDivisionInformationTechnologyLaboratoryNationalInstituteofStandardsandTechnologyGaithersburg,MD20899-8930IntelligentSystemsDivisionEngineeringLaboratoryNationalInstituteofStandardsandTechnologyGaithersburg,MD20899-8930June2011U.S.DepartmentofCommerceGaryLocke,SecretaryNationalInstituteofStandardsandTechnologyPatrickGallagher,DirectorCOMPUTERSECURITYGUIDETOINDUSTRIALCONTROLSYSTEMS(ICS)SECURITYReportsonComputerSystemsTechnologyTheInformationTechnologyLaboratory(ITL)attheNationalInstituteofStandardsandTechnology(NIST)promotestheU.S.economyandpublicwelfarebyprovidingtechnicalleadershipforthenation’smeasurementandstandardsinfrastructure.ITLdevelopstests,testmethods,referencedata,proofofconceptimplementations,andtechnicalanalysistoadvancethedevelopmentandproductiveuseofinformationtechnology.ITL’sresponsibilitiesincludethedevelopmentoftechnical,physical,administrative,andmanagementstandardsandguidelinesforthecost-effectivesecurityandprivacyofsensitiveunclassifiedinformationinFederalcomputersystems.ThisSpecialPublication800-seriesreportsonITL’sresearch,guidance,andoutreacheffortsincomputersecurityanditscollaborativeactivitieswithindustry,government,andacademicorganizations.Certaincommercialentities,equipment,ormaterialsmaybeidentifiedinthisdocumentinordertodescribeanexperimentalprocedureorconceptadequately.SuchidentificationisnotintendedtoimplyrecommendationorendorsementbytheNationalInstituteofStandardsandTechnology,norisitintendedtoimplythattheentities,materials,orequipmentarenecessarilythebestavailableforthepurpose.NationalInstituteofStandardsandTechnologySpecialPublication800-82Natl.Inst.Stand.Technol.Spec.Publ.800-82,155pages(June2011)iiiGUIDETOINDUSTRIALCONTROLSYSTEMS(ICS)SECURITYivAcknowledgmentsTheauthors,KeithStouffer,JoeFalco,andKarenScarfoneoftheNationalInstituteofStandardsandTechnology(NIST),wishtothanktheircolleagueswhorevieweddraftsofthisdocumentandcontributedtoitstechnicalcontent.TheauthorswouldparticularlyliketoacknowledgeTimGrance,RonRoss,StuKatzke,andFreemonJohnsonofNISTfortheirkeenandinsightfulassistancethroughoutthedevelopmentofthedocument.Theauthorsalsogratefullyacknowledgeandappreciatethemanycontributionsfromthepublicandprivatesectorswhosethoughtfulandconstructivecommentsimprovedthequalityandusefulnessofthispublication.TheauthorswouldparticularlyliketothankthemembersofISA99.TheauthorswouldalsoliketothanktheUKNationalCentrefortheProtectionofNationalInfrastructure(CPNI))forallowingportionsoftheGoodPracticeGuideonFirewallDeploymentforSCADAandProcessControlNetworktobeusedinthisdocumentaswellasISAforallowingportionsoftheANSI/ISA99Standardstobeusedinthisdocument.GUIDETOINDUSTRIALCONTROLSYSTEMS(ICS)SECURITYTableofContentsExecutiveSummary..............................................................................................................ES-11.Introduction......................................................................................................................1-11.1Authority...................................................................................................................1-11.2PurposeandScope.................................................................................................1-11.3Audience..................................................................................................................1-11.4DocumentStructure.................................................................................................1-22.OverviewofIndustrialControlSystems........................................................................2-12.1OverviewofSCADA,DCS,andPLCs.....................................................................2-12.2ICSOperation..........................................................................................................2-22.3KeyICSComponents..............................................................................................2-32.3.1ControlComponents.....................................................................................2-42.3.2NetworkComponents...................................................................................2-52.4SCADASystems......................................................................................................2-62.5DistributedControlSystems..................................................................................2-102.6ProgrammableLogicControllers....