工業控制系統的安全事件風險評估

Risk Assessment of Industrial Control System Security Incidents

傅上哲(SHANG-CHE FU)

指導教授 ： 田筱榮

中原大學/電機資訊學院/資訊工程研究所/碩士(2020年)

https://doi.org/10.6840/cycu202000664

摘要

隨著工業控制系統的應用範圍由封閉式以本地為範圍的工業環境擴展到與資訊網路相連的開放式長距離的各類智慧化環境的運作，安全機制的不足使得工業控制系的網路成為駭客攻擊的另一種目標，如何整合智慧化環境特性資訊以及由偵測網路安全事件的系統所提供的資訊即時評估各項網路安全事件對智慧化環境的風險，是維護智慧化環境安全運作的重要議題。在本研究中，我們提出一種風險評估的方法，考量資產設備的損害程度、威脅的緊急程度及弱點的嚴重性，建立安全風險評估平台，將偵測到的網路安全事件的風險數值化，讓管理者能夠即時注意到環境中需要被關注的風險事件。我們將方法實作於開源的資安事件管理平台，並以模擬的智慧化環境及相關的攻擊情境進行測試，驗證風險評估方法可行性。

關鍵字

工業控制系統、資訊安全管理平台、風險評估

並列摘要

With the use of industrial control system expanding from closed and localized industrial operation environment to open and distant smart application environment, it becomes another security attack target due to insufficient security mechanism available. It is important to develop a risk assessment method which can provide immediate quantitative risk evaluation result based on the characteristics of the environment in concern and security events detected in real time. In this study, we proposed a quantitative risk assessment measure using the damage degree of the impacts, the urgency of the threats and the severity of the vulnerabilities as the constituents. We developed a procedure to establish a risk assessment mechanism for an ICS system. With the risk assessment mechanism, administrators of ICS systems will be able to identify whether there is security risk in the system when a security event is detected.

並列關鍵字

Industrial control system, Security Information and Event Management, Risk Assessment

參考文獻

[1] S. Li, Y. Huang, B. Tai and C. Lin, "Using Data Mining Methods to Detect Simulated Intrusions on a Modbus Network," 2017 IEEE 7th International Symposium on Cloud and Service Computing (SC2), Kanazawa, 2017, pp. 143-148, doi: 10.1109/SC2.2017.29.

[2] S. Samtani, S. Yu, H. Zhu, M. Patton, J. Matherly and H. Chen, "Identifying SCADA Systems and Their Vulnerabilities on the Internet of Things: A Text-Mining Approach," in IEEE Intelligent Systems, vol. 33, no. 2, pp. 63-73, Mar./Apr. 2018, doi: 10.1109/MIS.2018.111145022.

[3] Drias, Z., Serhrouchni, A., and Vogel, O. (2015). “Taxonomy of attacks on industrial control protocols”. In Protocol Engineering (ICPE) and International Conference on New Technologies of Distributed Systems (NTDS), 2015 International Conference on, pages 1–6. IEEE.

[4] T. H. Morris, B. A. Jones, R. B. Vaughn and Y. S. Dandass, "Deterministic Intrusion Detection Rules for MODBUS Protocols," 2013 46th Hawaii International Conference on System Sciences, Wailea, Maui, HI, 2013, pp. 1773-1781, doi: 10.1109/HICSS.2013.174.

[5] Snort [Online]. Available: https://www.snort.org/ [Accessed 27 Jul 2020]