Comparative study on IEC 62443 and the baseline for classified protection of cybersecurity

doi:10.3969/j.issn.1674-1951.2021.02.012

Abstract

Abstract:

Information security problems exposed in industrial production process make industrial control security a hot spot.International serial standards IEC 62443 and the baseline for classified protection of China have proposed security requirements for industrial control systems,respectively.Focused on the information security requirements for industrial control systems,the security requirements and classified protection standards in IEC 62443-3-3 and the equivalence part in GB/T 22239—2019 are compared.Analysis and comparison carried out on these standards from application scope,safety level and specific indicators can tutor the practitioners in industrial control security.

Key words: IEC 62443-3-3, information security, industrial control, security classified protection, industrial automation and control system, safety requirement for system

CLC Number:

TP309：TK323

WANG Jian, WANG Tianyi, ZHAI Yahong, JIANG Tianlun. Comparative study on IEC 62443 and the baseline for classified protection of cybersecurity[J]. Huadian Technology, 2021, 43(2): 72-76.

Figures/Tables 7

Fig.1

Fig.2

Tab.1

Tab.2

Tab.3

Fig.3

Fig.4

References 15

[1]	欧阳劲松, 丁露. IEC 62443工控网络与系统信息安全标准综述[J]. 信息技术与标准化, 2012(3):24-27.
	OUYANG Jingsong, DING Lu. Review on IEC 62443 industrial control network & system security standardization[J]. Information Technology & Standardization, 2012(3):24-27.
[2]	王玉敏. IEC 62443系列标准概述和SAL介绍[J]. 仪器仪表标准化与计量, 2012(1):26-30.
	WANG Yumin. Overview of the IEC 62443 serial standards and the introduction of SAL[J]. Instrument Standardization & Metrology, 2012(1):26-30.
[3]	Industrial communication networks-Network and system security,part1-1：Terminology,concepts and models：IEC/TR 62443-1-1[S]. Geneva:IEC, 2009.
[4]	Industrial communication networks-Network and system security,part3-1：Security technologies for industrial automation and control systems：IEC/TR 62443-3-1[S]. Geneva:IEC, 2009.
[5]	Industrial communication networks-Network and system security,part3-3：System security requirements and security levels：IEC 62443-3-3[S]. Geneva:IEC, 2017.
[6]	信息安全技术网络安全等级保护基本要求:GB/T 22239—2019[S].
[7]	黄鹏, 肖鹏, 吴志强, 等. 基于IEC 62443-3-1的核电厂DCS身份认证技术方法[J]. 上海交通大学学报, 2018,52(S1):152-155.
	HUANG Peng, XIAO Peng, WU Zhiqiang, et al. DCS authentication technologies of nuclear power plants based on IEC 62443-3-1[J]. Journal of Shanghai Jiaotong University, 2018,52(S1):152-155.
[8]	范科峰, 周睿康, 李琳. 工业控制系统信息安全标准体系研究[J]. 信息技术与标准化, 2016(6):17-21.
	FAN Kefeng, ZHOU Ruikang, LI Lin. Research on industry control system information security standard architecture[J]. Information Technology & Standardization, 2016(6):17-21.
[9]	张谊, 王远兵, 彭浩, 等. 安全级DCS供应商信息安全管理体系构建[J]. 仪器仪表用户, 2019,26(12):64-67.
	ZHANG Yi, WANG Yuanbing, PENG Hao, et al. Establishment of security management system of safety DCS supplier[J]. Instrumentation Customer, 2019,26(12):64-67.
[10]	范科峰, 周睿康, 李琳, 等. 工业控制系统信息安全管理标准研究[J]. 中国信息安全, 2016(4):76-79.
	FAN Kefeng, ZHOU Ruikang, LI Lin, et al. Research on information security management standard of industrial control system[J]. China Infornation Security, 2016(4):76-79.
[11]	邸丽清, 高洋, 谢丰. 国内外工业控制系统信息安全标准研究[J]. 信息安全研究, 2016(5):435-441.
	DI Liqing, GAO Yang, XIE Feng. Research on the domestic and foreign standards for ICS information security[J]. Journal of Information Security Research, 2016(5):435-441.
[12]	安高峰, 朱长明, 雷晓锋, 等. 我国工业控制系统信息安全政策和标准体系架构研究[J]. 信息安全研究, 2018,4(10):959-964.
	AN Gaofeng, ZHU Changming, LEI Xiaofeng, et al. Information security policy and standard system of industrial control system in China[J]. Journal of Information Security Research, 2018,4(10):959-964.
[13]	王玉敏. IEC 62443标准中区域和管道的应用探讨[J]. 仪器仪表用户, 2012(2):23-25,36.
	WANG Yumin. Discussion the zone and conduit of IEC 62443 serial standards[J]. Instrument Standardization and Metrology, 2012(2):23-25,36.
[14]	Security for industrial automation and control systems,part2-4：Security program requirements for IACS service providers：IEC 62443-2-4[S]. Geneva:IEC, 2017.
[15]	Industrial communication network-Establishing and industrial automation and control system security program IEC 62443-2-1[S]. Geneva:IEC, 2010.

安全等级	IEC 62443-3-3	GB/T 22239—2019
SL0	没有特定或必须的信息安全保护要求	没有特定或必须的信息安全保护要求
SL1	防止随机或巧合的违规	能够防护拥有少量资源的威胁源发起的恶意攻击,并能够恢复部分功能
SL2	安全防护防止使用少量资源、通用技能、低动机的简单手段进行蓄意破坏	能够防护拥有少量资源的威胁源发起的恶意攻击,并能够在一段时间内恢复部分功能
SL3	安全防护防止使用一般资源、IACS专业技能、一般动机的复杂手段进行故意入侵	能够防护拥有较为丰富资源的威胁源发起的恶意攻击,并能够较快恢复绝大部分功能
SL4	安全防护防止使用扩展资源、IACS特殊技能、高动机的复杂手段进行故意入侵	能够防护拥有丰富资源的威胁源发起的恶意攻击,并能够迅速恢复所有功能

安全指标	安全等级
安全指标	SL1	SL2	SL3	SL4
安全通信网络	2	4	8	11
安全区域边界	5	12	20	21
安全计算环境	11	23	34	36
安全管理中心	0	4	12	13