工业控制系统信息安全保障框架2019© 绿盟科技关于绿盟科技北京神州绿盟信息安全科技股份有限公司（以下简称绿盟科技），成立于 2000 年 4 月，总部位于北京。在国内外设有 40 多个分支机构，为政府、运营商、金融、能源、互联网以及教育、医疗等行业用户，提供具有核心竞争力的安全产品及解决方案，帮助客户实现业务的安全顺畅运行。基于多年的安全攻防研究，绿盟科技在检测防御类、安全评估类、安全平台类、远程安全运维服务、安全 SaaS 服务等领域，为客户提供入侵检测 / 防护、抗拒绝服务攻击、远程安全评估以及 Web 安全防护等产品以及安全运营等专业安全服务。北京神州绿盟信息安全科技股份有限公司于 2014 年 1 月 29 日起在深圳证券交易所创业板上市交易，股票简称：绿盟科技，股票代码：300369 。特别声明为避免合作伙伴及客户数据泄露，所有数据在进行分析前都已经过匿名化处理，不会在中间环节出现泄露，任何与客户有关的具体信息，均不会出现在本报告中。2019 工业控制系统信息安全保障框架A目录1. 工控信息安全的发展 ············································································································································ 11.1 工业智能化发展概述 ·································································································································································· 21.1.1 工业控制的基本架构 ·················································································································································································· 31.1.2 工业 4.0的发展 ·························································································································································································· 41.1.3 工业互联网的发展 ······················································································································································································ 51.1.4 国内工业控制系统的发展 ········································································································································································· 61.1.5 泛在化的工业设施 ······················································································································································································ 71.2 工控信息安全的发展 ·································································································································································· 81.2.1 工控信息安全与 IT信息安全的差异 ························································································································································ 91.2.2 工控信息安全在国内的发展 ··································································································································································· 111.2.3 国外工控信息安全的发展 ······································································································································································· 181.3 工控信息安全的技术趋势 ························································································································································ 201.3.1 工控信息安全技术趋势 ············································································································································································ 201.3.2 主流工控信息安全产品介绍 ··································································································································································· 201.3.3 工控信息安全技术面临的问题和困难 ··················································································································································· 222. 工控信息安全态势 ·············································································································································· 232.1 典型工业信息安全事件 ···························································································································································· 242.2 工业控制系统恶意软件介绍 ···················································································································································· 262.2.1 恶意软件 Industroyer的介绍 ·································································································································································· 262.2.2 Dragonfly2.0恶意软件介绍 ···································································································································································· 282.2.3 新型 ICS攻击框架 “TRITON“简介 ························································································································································· 292.3 工控资产的脆弱性 ···································································································································································· 302.3.1 工控系统暴露的资产日渐增多 ······························································································································································· 302.3.2 工控漏洞的变化趋势 ················································································································································································ 382.4 工业信息安全的变化趋势 ························································································································································ 483. 工控信息安全保障框架 ······································································································································ 503.1 工控信息安全的保障原则 ························································································································································ 513.2 工控信息安全保障思路 ···························································································································································· 513.2.1 边界安全防护 ···························································································································································································· 523.2.2 纵深防护 ···································································································································································································· 563.2.3 内建安全 ···································································································································································································· 582019 工业控制系统信息安全保障框架B4. 典型工业场景安全构建 ······································································································································ 594.1 电力行业工控典型安全解决方案 ············································································································································ 604.1.1 火电场景 ···································································································································································································· 604.1.2 风电场景 ···································································································································································································· 664.1.3 水电场景 ···································································································································································································· 694.1.4 核电场景 ···································································································································································································· 724.2 制造业工控典型安全解决方案 ················································································································································ 734.2.1 烟草行业 ···································································································································································································· 734.2.2 汽车制造业 ································································································································································································ 824.3 市政工控典型安全解决方案 ···················································································································································· 834.3.1 水务场景 ···································································································································································································· 834.3.2 城市燃气系统安全解决方案 ··································································································································································· 864.4 石油石化行业工控典型安全解决方案 ···································································································································· 884.4.1 油气采集工控系统安全解决方案 ··························································································································································· 885. 工控信息安全发展展望 ······································································································································ 936. 附录 缩略语中英文对照 ····································································································································· 967. 参考文献 ····························································································································································· 978. 作者信息 ····························································································································································· 982019 工业控制系统信息安全保障框架1工控信息安全的发展1. 工控信息安全的发展1工控信息安全的发展2019 工业控制系统信息安全保障框架2工控信息安全的发展1.1 工业智能化发展概述工业控制系统的发展历程如图所示。工业控制系统发展历程18世纪离心调速器（机械控制器）20世纪50 60年代集中式控制系统19世纪-20世纪50年代电动，气动单元，模拟式仪表20世纪70年代分散式控制系统20世纪90年代后期现场总线控制系统图 1.1 工业控制发展历程 工业控制系统最早可以追溯到 18世纪。詹姆斯 瓦特在改良蒸汽机的工作中，给蒸汽机加装了一个节流控制器，即离心调速器。离心调速器通过一根与蒸汽机共同转动的轴来获得反馈信号，通过离心力来调节飞球的位置，进而调节蒸汽节流器以控制蒸汽机转速。这种离心调速器被认为是自动调节与自动控制的开始。从离心调速器出现以后的一个多世纪的时间里，绝大部分的工业控制系统所关注的重点是对蒸汽系统中的温度，压强，液面以及机器转速的控制。随着工业系统的发展以及第二次世界大战中军事上的诸多控制问题的需要，从 19世纪中期到 20世纪中期，控制理论和控制系统有了全面的发展，相继出现了气动控制装置，继电器控制装置，伺服系统，反馈回路控制部件等工业控制设备，同时，负反馈，控制系统稳定性等理论也相继出现。到了 20世纪 50 60年代，计算机技术进入到工业控制系统中，工业控制系统中的模拟控制电路逐渐被数字控制电路所取代，可编程逻辑控制器（ Programmable Logic Controller, PLC）逐步替代继电器控制电路。由于系统全面数字化，控制系统可以使用更加先进复杂的控制算法来实现更加复杂的控制过程，工业控制系统发生了质的飞跃。但是到目前为止，工业控制系统还是集中式控制系统。到了 20世纪 70年代中期，由于工业设备大型化，工艺流程连续性要求的增加，以及需要控制的参2019 工业控制系统信息安全保障框架3工控信息安全的发展数增多，集中式控制系统已经无法满足工业控制系统的需要。因此，集中式控制系统逐渐被分布式控制系统所取代。越来越多的工业控制领域，包括机械制造，石油化工，冶金，汽车，轻工业等都逐渐采用了分布式控制系统。到了 20世纪 90年代后期出现了集计算机技术，网络技术，控制技术于一体的现场总线控制系统（Fieldbus Control System, FCS）。相比于分布式控制系统，现场总线控制系统具有更高的可靠性，更强的功能，更灵活的结构，更强的适应性等特点。1.1.1 工业控制的基本架构工业控制系统（ ICS）是一个通用术语，它包括多种工业生产中使用的控制系统，如监控和数据采集系统（SCADA ），分布式控制系统（DCS），还有其他较小的控制系统如可编程逻辑控制器（PLC ）等。工业控制系统的逻辑架构如下图所示：图 1.2 工业控制系统架构图 工业控制系统的现场设备层主要用于采集现场仪表的模拟量和数字量，不同场景下定义不同，如压2019 工业控制系统信息安全保障框架4工控信息安全的发展力、温度、湿度等内容。现场控制层主要通过控制器采集各个现场仪表的数据，通过内部既定的逻辑来对仪表的运行状态进行监视。在有闭环控制的场景下，实现对采集量的调整和处理。监督控制层是基于IT计算机的计算环境，通过与控制器之间的多种连接方式实现对控制器数据的采集、处理和展示。组态软件通过对业务对象的数据指标进行配置实现对业务逻辑的控制。同时，为了适配不同应用场景下的展示，可以通过画面组态的方式把采集的 I/O点与业务应用场景进行对应，对于生产的历史数据进行分析和呈现。生产管理层主要完成对生产计划的处理，业务工艺指令的调优及调度指令的控制等，更加偏重于计划任务的管理。1.1.2 工业 4.0 的发展德国于 2013年在汉诺威工业博览会上提出“工业 4.0”的概念，预计投资 2亿欧元，推动以信息物理系统（ CPS）为基础，以生产高度数字化、网络化、机器自组织为标志的工业革命。通过提升制造业的计算机化、数字化与智能化，建立具有适应性与资源效率的智能工厂（ Smart Factory），并在商业流程及价值流程中整合客户以及商业伙伴。从工业发展的历程来看，蒸汽机技术推动机械化生产的普及，使人类社会进入工业 1.0时代；电力的出现推动规模化生产，从此工业进入 2.0时代；信息化技术的应用，使得自动化生产成为可能，工业进入 3.0时代；而物联网等新技术与工业技术的深度融合，使得工业进入智慧化的时代，即工业 4.0。工业 4.0是在个性化智能产品的需求驱使下，并在物联网、大数据等新技术的有力支撑下出现的新一代变革。工业 4.0具备三个主要特征： 垂直整合：各机器及生产线的自控系统、工厂的制造执行系统（MES）、以及 ERP等系统的整合，打破信息化系统与自动化系统之间的历史鸿沟，使工厂与企业的生产制造能力得以优化； 水平整合：企业内部及跨企业边界的各业务系统之间的整合，使得信息的共享、业务功能的组合可以跨越组织的边界，使价值链的整体竞争力得以提升； 端到端价值链的数字化整合：这是实现“智能制造云”的愿景，用户只要提交需求，就可以获得所需的产品，而云端相关价值链各企业的制造与业务能力都以 API的方式发布，使得快速柔性组合与安全调度执行成为可能，最大化发挥生态系统的设计、制造、服务等多方面的综合能力。2019 工业控制系统信息安全保障框架5工控信息安全的发展随着物联网等技术的成熟，传统工业将经历企业内的厂际互联（M2M ），到价值链上所有企业互联（B2B），再到消费者与相关工厂间互联（ C2M），逐步完成向着工业 4.0的变革。工业 4.0的转型将为企业带来全面的业务价值与能力的提升，主要集中在加速产品创新，优化生产运营及交付全新服务三个方面。具体而言： 企业具备生产制造的高灵活性和更能适应市场的生产流程； 在完善全面产品生命周期管理，企业生产价值链互联互动之后，企业已经具备专业化的聚焦特定用户需求的能力； 提升以价值链为单位的整体竞争能力； 通过新的服务与业务模型开创新市场。工业 4.0可以促使制造型企业以前所未有的速度应对客户需求。这些技术将提升生产流程的柔性，速度，效率和质量。此外，工业 4.0将催生新的商业模式、生产流程和其他创新。随着越来越多的制造型企业通过投资工业 4.0技术实现或者增强其产品定制化程度，更高级别的大规模定制将成为可能。1.1.3 工业互联网的发展工业互联网是全球工业系统与高级计算、分析、传感技术以及互联网的高度融合。它通过智能机器间的连接并最终将人机连接，结合软件和大数据分析等技术，重构全球工业，激发生产率，让世界更快速、更安全、更清洁且更经济。在传统的工业控制系统中，虽然目前大部分的工控场景都实现了 IT化，但是各工业企业之间的信息交互较少，也很少有工业企业与用户，供应商之间的实时的信息交互。因此，传统的工业企业之间，企业与用户之间的协调效率较低。而工业互联网可以有效的整合工业系统中的信息资源，有效降低工业生产的成本，提高生产效率，并能够实现工业生产的个性化，智能化。工业互联网平台是面向制造业数字化、网络化、智能化需求，构建基于海量数据采集、汇聚、分析的服务体系，支撑制造资源泛在连接、弹性供给、高效配置的工业云平台。其本质是通过构建精准、实时、高效的数据采集互联体系，建立面向工业大数据存储、集成、访问、分析、管理的开发环境，实现工业技术、经验、知识的模型化、标准化、软件化、复用化，不断优化研发设计、生产制造、运营管理等资源配置效率，形成资源富集、多方参与、合作共赢、协同演进的制造业新生态。关于工业互联网平台有四个定位：2019 工业控制系统信息安全保障框架6工控信息安全的发展第一，工业互联网平台是传统工业云平台的迭代升级。从工业云平台到工业互联网平台演进包括成本驱动导向、集成应用导向、能力交易导向、创新引领导向、生态构建导向五个阶段。工业互联网平台在传统工业云平台的软件工具共享、业务系统集成基础上，叠加了制造能力开放、知识经验复用与开发者集聚的功能，大幅提升了工业知识生产、传播、利用的效率，形成了海量的开放 APP应用与工业用户之间相互促进、双向迭代的生态体系。第二，工业互联网平台是新工业体系的“操作系统”。工业互联网的兴起与发展将打破原有封闭、隔离又固化的工业系统。扁平、灵活而高效的组织架构将成为新工业体系的基本形态。工业互联网平台依托高效的设备集成模块、强大的数据处理引擎、开放的开发环境工具、组件化的工业知识微服务，向下对接海量工业装备、仪器、产品，向上支撑工业智能化应用的快速开发与部署，发挥着类似于微软Windows、谷歌 Android系统和苹果 iOS系统的重要作用。第三，工业互联网平台是资源集聚共享的有效载体。工业互联网平台将信息流、资金流、人才创意、制造工具和制造能力在云端汇聚，将工业企业、信息通信企业、互联网企业、第三方开发者等主体在云端集聚，将数据科学、工业科学、管理科学、信息科学、计算机科学在云端融合，推动资源、主体、知识集聚共享，形成社会化的协同生产方式和组织模式。第四，工业互联网平台是打造制造企业竞争新优势的关键抓手。当前， GE、西门子等国际领军企业围绕“智能机器 +云平台 +工业 APP”功能架构，整合“平台提供商 +应用开发者 +海量用户”等生态资源，抢占工业数据入口主导权，培育海量开发者，提升用户粘性，不断建立、巩固和强化以平台为载体，以数据为驱动的工业智能化新优势，抢占新工业革命的制高点。1.1.4 国内工业控制系统的发展新中国成立尤其是改革开放以来，我国制造业持续快速发展，建成了门类齐全、独立完整的产业体系。2013 年以来，我国相继出台了一系列政策鼓励工业云的发展。 2015年，我国提出了中国制造2025的制造战略计划，旨在实现我国制造业从制造大国向制造强国的转变。但是我国仍处于工业化进程中，与先进国家相比还有较大差距：制造业大而不强，自主创新能力弱，关键核心技术与高端装备对外依存度高，以企业为主体的制造业创新体系不完善；产品档次不高，缺乏世界知名品牌；资源能源利用效率低，环境污染问题较为突出；产业结构不合理，高端装备制造业和生产性服务业发展滞后；信息化水平不高，与工业化融合深度不够；产业国际化程度不高，企业全球化经营能力不足。