Method, device and apparatus for enhancing assets in OT system, storage medium and computer program product

Abstract

The invention discloses a method for strengthening assets in an OT system. The method is characterized by comprising the following steps: collecting communication flow among the assets to identify instruction attributes; determining a state attribute of the asset according to the configuration file of the asset; determining an asset role according to the identified instruction attribute and state attribute of the asset; determining an asset working mode according to an instruction attribute identified from the communication flow between the assets; and calculating an asset criticality score within a certain time range according to the determined asset working mode and the asset role to determine whether to strengthen the asset.

Description

Technical Field

[0001] The present invention relates to industrial networks and operational technology (OT), and in particular to a method, a device and an apparatus for strengthening assets in an OT system, as well as a storage medium and a computer program product. Background Art

[0002] In recent years, more and more smart and IoT devices based on Industrial Ethernet have been used for remote monitoring and management of industrial control systems (ICS). That is, most ICS in today's operational technology (OT) are directly or indirectly connected via Industrial Ethernet. This brings many threats to them just like any other connected system. Many of these systems monitor and control complex industrial processes and critical infrastructure, providing electricity, oil production, water transportation, manufacturing, communications and other basic services. The downtime or intrusion of ICS networks may cause large-scale power outages, hundreds of thousands of users affected, or even cause national disasters.

[0003] ICS assets are digital devices used in industrial production and operation processes. This encompasses all the various components of digital critical infrastructure. There are measures to mitigate security risks to ICS assets, such as performing network segmentation, implementing least privilege, protecting remote access, or updating and patching assets. Considering that it takes a long time to prepare and test upgrades or replacements of industrial control systems, this requires high personnel capabilities and has an impact on continuous production. Currently, many people take a conservative attitude towards vulnerability repair, which allows these problems to hide in the system. Once exploited by attackers, it can cause unpredictable impacts and losses. Generally, it is unrealistic to repair all security vulnerabilities immediately. Therefore, it is necessary to assess the importance and critical status of assets in the OT environment to rate the risks and understand the impact of risks on the corresponding business. Once you have a grasp of the importance and critical status of assets, you can better understand the risk situation and develop a prioritized remediation plan to minimize the risk within a limited budget and resources.

[0004] Therefore, it is necessary to automatically identify the critical status of OT assets to analyze the business impact based on asset importance. And then a system can rate the risks based on the critical status of OT assets and the vulnerabilities found, and develop a priority remediation plan to mitigate the security risks of assets with critical control functions as soon as possible. To this end, a risk remediation method based on automatic identification of asset critical status in OT environment is proposed. Summary of the invention

[0005] The above objects are achieved by the method for strengthening assets according to technical solution 1, the device for strengthening assets according to technical solution 8, the computer device for strengthening assets according to technical solution 9 and the computer program according to technical solution 10 of the present invention. Advantageous embodiments of the present invention are provided in the dependent claims. Unless otherwise specified, the features of the independent claims can be combined with the features of the claims dependent on the corresponding independent claims, and the features of the dependent claims can be combined.

[0006] According to a first aspect of the present invention, a method for strengthening an asset is provided. The method comprises the following steps:

[0007] - Collect communication traffic between assets to identify instruction attributes;

[0008] -determine the state attributes of the asset based on the asset's profile;

[0009] - determining an asset role based on the identified instruction attributes and state attributes of the asset;

[0010] -determining asset operating modes based on command attributes identified from communication traffic between assets; and

[0011] - Calculate asset criticality scores over a timeframe based on the identified asset work modes and asset roles to determine whether to enhance the asset.

[0012] This solution enables updates and patches without affecting production processes, thus ensuring the highest availability principles in OT.

[0013] In another embodiment of the method, it is characterized in that an asset risk score is calculated based on the security of the OT system; wherein the security includes security incidents of the OT system and vulnerabilities of the assets, wherein the vulnerabilities of the assets include unpatched programs or services, and misconfiguration of security policies, accounts, and passwords.

[0014] In another embodiment of the method, it is characterized in that the time period for hardening the asset is calculated based on the asset criticality score and the asset risk score.

[0015] In another embodiment of the method, it is characterized in that a hardening plan is provided for the asset based on a time period for hardening the asset.

[0016] In another embodiment of the method, it is characterized in that a prioritized reinforcement plan is provided for the asset according to a time period for reinforcement of the asset.

[0017] In another embodiment of the method, it is characterized in that the strengthening of the assets includes updating of programs in the assets, updating of security policies of the assets, account management of the assets, and port management of the assets.

[0018] In another embodiment of the method, it is characterized in that the asset is an OT asset; and the OT asset is computer hardware, computer software, or a combination of both. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above-mentioned attributes and other features and advantages of the present invention and the manner in which they are implemented will become more apparent, and the present invention itself will be better understood, by referring to the following description of embodiments of the present invention technology in conjunction with the accompanying drawings, in which:

[0020] Figure 1 is a schematic diagram of an OT system according to an embodiment of the present disclosure.

[0021] Figure 2 A flowchart of a method for strengthening an asset according to an embodiment of the present disclosure.

[0022] Figure 3 A computer device for strengthening assets in an OT system according to an embodiment of the present disclosure.

[0023] Figure 4 A computer device for strengthening assets in an OT system according to an embodiment of the present disclosure.

[0024] Hereinafter, the above-mentioned features and other features of the present invention technology are described in detail. Various embodiments are described with reference to the figures, wherein the same reference numerals are used to refer to the same elements in all figures. In the following description, for the purpose of explanation, many specific details are set forth in order to provide a thorough understanding of one or more embodiments. It can be noted that the embodiments shown are intended to explain rather than limit the present invention. It can be apparent that such embodiments can be practiced without these specific details.

[0025] Reference numerals

[0026] 10 OT system

[0027] 101 Industrial Controller

[0028] 102a Sensor

[0029] 102b Motor

[0030] 100a Engineering Station

[0031] 100b Database Server

[0032] 100c Application Server

[0033] 104a Firewall

[0034] 104b Server for intrusion detection

[0035] 105 Network switching and routing devices

[0036] Steps S202-S216

[0037] 300 devices

[0038] 302 Collection Module

[0039] 304 First determination module

[0040] 306 Second determination module

[0041] 308 Third determination module

[0042] 310 Computing Module

[0043] 400 Computer devices

[0044] 402 Memory

[0045] 404 Handler DETAILED DESCRIPTION

[0046] In order to make the technical solutions and advantages of the present invention clearer, the present invention will be further described in detail with reference to the accompanying drawings and embodiments. The specific embodiments described herein are only used to illustrate the present invention and are not configured to limit the protection scope of the present invention.

[0047] Currently, organizations (i.e., plant owners) are only informed that some assets need to be updated. But it is unrealistic to stop the entire system for update, as this may affect critical production processes that may cause damage. In addition, there is no solution to generate remediation priorities by identifying the criticality of assets based on asset configuration, behavior, and work mode. Therefore, a method is provided to automatically identify the importance of assets in an OT environment, and then identify vulnerabilities and update times after identifying the criticality of assets from the instruction and work mode side.

[0048] Introduction of OT systems

[0049] OT systems, also known as industrial control systems (ICS), are configured to implement automatic control of industrial processes. OT systems can be wind power supply systems, automobile manufacturing plants, pharmaceutical factories, municipal sewage treatment systems, etc.

[0050] OT uses hardware and software to detect or control physical devices, processes, and events in an enterprise by directly monitoring and / or controlling them. OT systems use computers to monitor or change the physical state of a system.

[0051] Examples of OT systems include supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), computer numerical control (CNC) systems (including computerized machine tools), and scientific equipment (e.g., digital oscilloscopes).

[0052] Figure 1 FIG. 1 is a schematic diagram of an OT system according to an embodiment of the present disclosure. Figure 1As shown in , the OT system 10 may include: an industrial controller 101, field of view devices 102a, 102b, industrial hosts 100a, 100b, 100c, security devices 104a, 104b, and a network switching and routing device 105. The industrial controller 101 is coupled to the field of view devices 102a, 102b, and the industrial controller 101 is coupled to the industrial hosts 100a, 100b, 100c through the network switching and routing device 105. The industrial controller 101 is also coupled to the industrial hosts 100a, 100b, 100c through the safety devices 104a, 104b; wherein the industrial controller 101 may include but is not limited to a programmable logic controller (PLC) and a programmable automation controller (PAC); wherein the field device may include, for example, a sensor 102a and a motor 102b, wherein the sensor 102a may obtain field data such as temperature, humidity, pressure and liquid flow rate under the control of the industrial controller 101, and the motor 102b may drive movement under the control of the industrial controller 101; wherein the industrial host may include, for example, an engineer station (ES) 100a, an operator station (OS) 100a, a human-machine interface (HMI) 100c, and a control system. The OT system 10 may be a network controller 101, a data center 102a, a data center 102b, a database server 100b, and an application server 100c; wherein at least one security device may include, for example, a firewall 104a and a server 104b for intrusion detection, wherein the security fire prevention device may include, for example, a firewall 104a and the server 104b for intrusion detection may also form an intrusion detection system (IDS) to implement intrusion detection of the OT system 10; wherein the network switching and routing device 105 may include, for example, an industrial switch and an industrial router, wherein these network switching and routing devices 105 may constitute an industrial Ethernet to interconnect the internal devices of the OT system 10. In this OT system, the assets may include an industrial controller 101, field of view devices 102a, 102b, industrial hosts 100a, 100b, and 100c, security devices 104a, 104b, and a network switching and routing device 105.

[0053] The above describes a typical architecture of an OT system as an example. Those skilled in the art may recognize that the architecture of an OT system may vary based on specific application environments or deployment differences, and the embodiments of the present invention are not limited thereto.

[0054] For example, security software (which may also be referred to as a security system) may be deployed in security devices 104a, 104b in the OT system. Security software may also be implemented in computer hardware or a combination of software and hardware. Security software is used to monitor assets in a factory, thereby understanding, managing, controlling, and mitigating the risk of assets of an organization (e.g., a factory owner). Security software actively and passively detects assets to identify asset types, such as firewalls, switches, programmable logic controllers (PLCs), remote terminal units (RTUs), human-machine interfaces (HMIs), etc. Security software is used to monitor and analyze behavior by analyzing network communication traffic between assets, identifying network behavior to identify vulnerabilities of assets, and collecting security alerts and events for assets to calculate the likelihood of being attacked.

[0055] Figure 2 A flowchart of a method for strengthening an asset according to an embodiment of the present disclosure.

[0056] In step S202 , communication traffic between assets is collected to identify instruction attributes.

[0057] For example, the command attribute may indicate the behavior of the asset, such as send control command, implement control command, or collect data command. The behavior of the asset may include the process executed by the configuration file in the host.

[0058] In an embodiment, the method may further include determining that an instruction attribute of the asset is based on a control field in the communication traffic between the assets, wherein the instruction attribute indicates whether the instruction is a control instruction, an execution instruction, or a data instruction.

[0059] In step S204, the state attribute of the asset is determined according to the configuration file of the asset.

[0060] The status attributes of an asset may include an asset role, an asset working mode, or an asset criticality score. For example, an asset role may refer to an operator station 100a that receives control instructions or an engineer station 100a that sends control instructions. An asset role may also refer to a PLC 101 or a database server 100b, etc. In short, an asset role may define the function of an asset. In other words, an asset role refers to an asset that has a certain function.

[0061] The configuration file of an asset may refer to the software in the asset that is configured to implement a function. For example, the configuration file of an asset may instruct a device to monitor temperature in a manufacturing process.

[0062] In step S206 , the asset role is determined according to the identified instruction attributes and status attributes of the asset.

[0063] For example, the identified instruction attribute indicates the network behavior of the asset. For example, the status attribute of the asset indicates a character within a certain time range.

[0064] In step S208, the asset operating mode is determined according to the instruction attributes identified from the communication traffic between the assets.

[0065] For example, the asset working mode may include simulation mode, maintenance mode, and implementation mode. For example, the asset working mode of the asset role may include a server sending control instructions in implementation mode, and a PLC collecting data instructions in maintenance mode or simulation mode.

[0066] In an embodiment, it may determine the asset operating mode based on the asset's profile and / or the communication traffic between assets.

[0067] In step S210, the asset criticality score within a certain time range is calculated according to the determined asset working mode and asset role to determine whether to strengthen the asset.

[0068] The asset criticality score defines the impact of hardening an asset for production. For example, based on the asset being in the implementation mode time range of the asset sending control instructions, the asset criticality score is 5. For example, based on the asset being in the implementation mode time range of the asset sending data instructions, the asset criticality score is 4. For example, based on the asset being in the simulation mode time range of the asset sending data instructions, the asset criticality score is 3. For example, based on the asset being in the maintenance mode time range of the asset sending control instructions, the asset criticality score is 2. For example, based on the asset being in the maintenance mode time range of the asset sending data instructions, the asset criticality score is 1. For example, based on the asset being in the maintenance mode time range of the asset not sending data, the asset criticality score is 0.

[0069] A specific example is given here. The security software collects the communication traffic between the engineer station 100a and the industrial controller 101 to identify the instruction attributes. Next, the software determines the status attributes of the industrial controller 101 based on the configuration file of the industrial controller 101. Next, the software determines that the industrial controller 101 sends a control instruction based on the identified instruction attributes and status attributes of the asset. Next, the software determines that the industrial controller 101 is in maintenance mode based on the instruction attributes identified from the communication traffic between the assets. Next, the software calculates the asset criticality score within a certain time range as 2 points to determine that the software can strengthen the industrial controller 101 within the said time.

[0070] In step S212 , an asset risk score is calculated based on the security of the OT system.

[0071] The security risk score is calculated based on security events, vulnerabilities, and original risk assessments. For example, security software can monitor and collect security events for assets, where the events include alerts, notifications, and warnings. Security software can identify and collect vulnerability status for assets. Security software can also obtain risk assessment results from security experts who perform threat and risk assessments. For example, security experts have identified and assessed the risk of assets that may be affected by a cyber attack.

[0072] In an embodiment, an asset risk score is calculated based on the security of the OT system; wherein the security includes security events of the OT system and vulnerabilities of the asset, wherein the vulnerabilities of the asset include unpatched programs or services, misconfiguration of security policies, accounts and passwords. Other vulnerabilities are listed as follows:

[0073]

[0074]

[0075] In step S214 , a time period for strengthening the asset is calculated based on the asset critical score and the asset risk score.

[0076] In an embodiment, the system can be repaired in maintenance mode. For example, the system's vulnerabilities can be strengthened in maintenance mode. The system's vulnerabilities can also be strengthened in simulation mode.

[0077] The time period for hardening an asset can be within a certain time range of maintenance mode or simulation mode.

[0078] In step S216, a reinforcement plan is provided for the asset according to the time period for strengthening the asset.

[0079] For example, it can schedule patching and updating of assets based on asset criticality scores. It can provide hardening plans to fix vulnerabilities. For example, it can immediately fix vulnerabilities in assets with high asset criticality scores.

[0080] In an embodiment, the security software may provide a prioritized hardening plan for assets based on a time period for hardening the assets.

[0081] In summary, the method may determine asset status by collecting communication traffic between assets and profiles of assets; and calculate an asset criticality score based at least on the asset status, wherein the asset status may include an asset role and an asset working mode.

[0082] The method provides the following advantages: It can calculate the update and patch priority and importance according to the asset critical status, such as the control instructions that understand the asset role more carefully and accurately. In addition, it calculates the time range dimension of simulation, maintenance and implementation mode as a factor in calculating the update and patch priority. In addition, it recommends the remediation priority arrangement of the update and patch time of the organization, rather than just notifying the patch. In addition, it performs updates and patches without affecting important production processes, thereby ensuring the highest availability principle in OT.

[0083] Figure 3 A device 300 for strengthening assets in an OT system includes a collection module 302 for collecting communication traffic between assets to identify instruction attributes; a first determination module 304 for determining the status attributes of an asset based on a configuration file of the asset; a second determination module 306 for determining the asset role based on the identified instruction attributes and status attributes of the asset; a third determination module 308 for determining the asset working mode based on the instruction attributes identified from the communication traffic between the assets; and a calculation module 310 for calculating the asset criticality score within a certain time range based on the determined asset working mode and asset role to determine whether to strengthen the asset.

[0084] Figure 4 The computer device 400 for hardening assets in an OT system according to an embodiment of the present disclosure includes a memory 402 and a processor 404, wherein an application program executable by the processor is stored in the memory 402 for causing the processor 404 to perform the method.

[0085] In addition, a computer-readable storage medium is provided, characterized in that computer-readable instructions are stored in the computer-readable storage medium for executing the method.

[0086] In addition, a computer program product is provided, characterized in that the computer program product is tangibly stored on a computer-readable medium and contains computer-readable instructions, which, when executed, cause at least one processor to perform the above steps in the method for strengthening assets in an OT system.

[0087] It should be noted that all steps and modules in the above-mentioned process and structure diagram are not required, and some steps or modules can be omitted according to actual needs. The execution order of each step is not fixed, and can be adjusted as needed. The division of each module is only for the convenience of description of the functional division. In the actual implementation scheme, a module can be divided into multiple modules, and the functions of multiple modules can also be implemented by one module, and these modules can be in the same device or in different devices.

[0088] The hardware modules in various embodiments may be implemented mechanically or electronically. For example, a hardware module may include a specially designed permanent circuit or logic device (e.g., a dedicated processor such as an FPGA or ASIC) for performing certain operations. A hardware module may also include a programmable logic device or circuit (e.g., including a general-purpose processor or other programmable processor) temporarily configured by software for performing certain operations. Whether a hardware module adopts a mechanical approach or a dedicated permanent circuit or a temporarily configured circuit (e.g., configured by software) may be decided based on cost and time considerations.

[0089] The present invention also provides a machine-readable storage medium, which stores instructions for making a machine perform the method described herein. Specifically, a system or device equipped with a storage medium can be provided, and the software program code for realizing the function of any one of the above-mentioned embodiments is stored on the storage medium, and the computer (or CPU or MPU) of the system or device is read out and executes the program code stored in the storage medium. In addition, some or all of the actual operation can be performed by the instructions based on the program code of the operating system operating on the computer. The program code read out from the storage medium can also be written into the memory arranged in the expansion board inserted into the computer or written into the memory arranged in the expansion unit connected to the computer, and then some or all of the actual operation is performed by the instructions based on the program code of the CPU installed on the expansion board or the expansion unit, so as to realize the function of any one of the above-mentioned embodiments.

[0090] The storage medium for providing the program code can be implemented as a floppy disk, a hard disk, a magneto-optical disk, an optical disk (e.g., CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer or a cloud through a communication network.

[0091] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement and improvement made within the spirit and principle of the present invention should fall within the protection scope of the present invention.

[0092] It should be noted that not all steps and modules in the process and system structure diagram mentioned above are required, and some steps or modules can be omitted according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the foregoing embodiments can be a physical structure or a logical structure, that is, some modules can be implemented by the same physical entity, or some modules can be implemented by multiple physical entities or can be implemented together by some components in multiple independent devices.

[0093] In the above embodiments, the hardware unit can be implemented mechanically or electrically. For example, the hardware unit may include permanent dedicated circuits or logic (e.g., a dedicated processor, such as an FPGA or ASIC) for performing the corresponding operation. The hardware unit may also include programmable logic or circuits (e.g., a general purpose processor or other programmable processor) that can be temporarily configured by software to perform the corresponding operation. The specific implementation method (mechanical method or dedicated permanent circuit or temporarily configured circuit) can be determined based on cost and time considerations.

[0094] Although the technology of the present invention has been described in detail with reference to certain embodiments, it should be understood that the technology of the present invention is not limited to those precise embodiments. In fact, in view of the disclosure of the exemplary modes described for practicing the present invention, many modifications and variations can be made by those skilled in the art without departing from the scope and spirit of the present invention. Therefore, the scope of the present invention is indicated by the appended claims, rather than by the foregoing description. All changes, modifications and variations that fall within the equivalent meaning and scope of the claims will be considered to be within the scope of the claims.

Claims

1. A method for hardening assets in an OT system, characterized in that collecting (S202) communication traffic between the assets to identify instruction attributes; Determining (S204) a status attribute of the asset according to the configuration file of the asset; determining (S206) an asset role according to the identified instruction attributes and state attributes of the asset; determining (S208) an asset operating mode based on instruction attributes identified from the communication traffic between the assets; as well as An asset criticality score within a certain time range is calculated ( S210 ) according to the determined asset working mode and asset role to determine whether to strengthen the asset.

2. The method according to any one of claims 1, characterized in that Calculate asset risk scores based on the safety of OT systems (S212); The security includes security incidents of the OT system and vulnerabilities of the assets, wherein the vulnerabilities of the assets include unpatched programs or services, and misconfiguration of security policies, accounts, and passwords.

3. The method according to any one of claims 1 to 2, characterized in that A time period for strengthening the asset is calculated (S214) based on the asset key score and the asset risk score.

4. The method according to any one of claims 1 to 3, characterized in that A reinforcement plan is provided (S216) for the asset according to a time period for reinforcing the asset.

5. The method according to any one of claims 1 to 3, characterized in that A prioritized hardening plan is provided for the assets according to a time period for hardening the assets.

6. The method according to any one of claims 1 to 5, characterized in that The strengthening of the asset includes updating of the program in the asset, updating of the security policy of the asset, account management of the asset, and port management of the asset.

7. The method according to any one of claims 1 to 6, characterized in that: The asset is an OT asset; and The OT assets are computer hardware, computer software, or a combination of both.

8. A device (300) for hardening assets in an OT system, characterized in that The device comprises: A collection module (302) for collecting communication traffic between the assets to identify instruction attributes; A first determination module (304) is used to determine a status attribute of the asset according to a configuration file of the asset; a second determination module (306) for determining an asset role based on the identified instruction attribute and status attribute of the asset; a third determination module (308) for determining an asset operating mode based on instruction attributes identified from communication traffic between the assets; as well as A calculation module (310) is used to calculate the asset criticality score within a certain time range according to the determined asset working mode and asset role to determine whether to strengthen the asset.

9. The device according to claim 8, characterized in that The device further comprises: A calculation module for calculating an asset risk score based on the security of the OT system; The security includes security incidents of the OT system and vulnerabilities of the assets, wherein the vulnerabilities of the assets include unpatched programs or services, and misconfiguration of security policies, accounts, and passwords.

10. The device according to claim 8, characterized in that The device further comprises: A calculation module is used to calculate a time period for strengthening the asset based on the asset key score and the asset risk score.

11. The device according to claim 8, characterized in that The device further comprises: A module is provided that provides a hardening plan for the asset based on a time period for hardening the asset.

12. A computer device (400) for hardening assets in an OT system, comprising a memory (402) and a processor (404), wherein an application program executable by the processor is stored in the memory (402) so that the processor (404) executes the method according to any one of claims 1 to 7.

13. A computer-readable storage medium, characterized in that: Computer-readable instructions are stored in the computer-readable storage medium for executing the method according to any one of claims 1 to 7.

14. A computer program product, characterized in that The computer program product is tangibly stored on a computer-readable medium and contains computer-readable instructions which, when executed, cause at least one processor to perform the steps of the method for hardening assets in an OT system according to any one of claims 1 to 7.

Images