A scada system information security risk assessment method and system

Abstract

The invention provides an SCADA system information security risk assessment method and system. The method includes the following steps: according to a causal relationship between each vulnerability factor and each threat factor in an SCADA system to be assessed, combining each vulnerability factor and each threat factor to obtain threat-vulnerability combinations; according to a corresponding relationship between each threat-vulnerability combination and each asset factor in the SCADA system to be evaluated, combining each threat-vulnerability combination and each asset factor to obtain each risk scenario; and according to the first influence degree of the vulnerability factors on a vulnerability risk indicator of the SCADA system to be assessed in each risk scenario, the second influencedegree of the threat factors on a threat risk indicator, and the third influence degree of the asset factors on an asset risk indicator, obtaining risk assessment results of the risk scenarios. According to the scheme of the invention, the risk assessment results can be quantitatively obtained, and thus the risk assessment results can be more accurate.

Description

technical field [0001] The invention belongs to the technical field of risk assessment, and more specifically relates to a method and system for assessing the risk of information security in a SCADA system. Background technique [0002] SCADA (Supervisory Control And Data Acquisition System, Data Acquisition and Monitoring Control) system is a data acquisition, monitoring and control system for production systems with long-distance distribution and scattered production units. At present, it has been widely used in fields such as electric power, metallurgy, petroleum, chemical industry, gas pipeline network and intelligent production workshop. A typical SCADA system includes man-machine interface, monitoring system, remote terminal control system, field controller and communication network. [0003] SCADA system is a highly networked, automated and intelligent comprehensive system, which may include on-site communication network, remote communication network and Internet, et...

AI Technical Summary

Problems solved by technology

[0008] In order to overcome the problems of the above-mentioned existing SCADA system information security risk assessment method, such as complex assessment process, two major calculations, and inaccurate assessment results, or at least partially solve the above problems, the present invention provides a SCADA system information security risk assessment method and system

Images