A method for calculating network security risk value of industrial control system

Abstract

The present application belongs to the field of nuclear power plant instrument control and operation technology, and particularly relates to a kind of industrial control system network security risk value calculation method. Device risk value: comprehensive evaluation is carried out to all devices under the industrial control network and the whole industrial control network, and a score is given; threat identification: identify the threat under the current network environment, including threat approach, threat ability, threat effect, threat frequency; according to the analyzed threat information, a threat score is given; vulnerability: obtain the stability of various assets under the industrial control network, and derive the overall vulnerability of the current industrial control network, such as the higher the importance of an asset in the whole industrial control network, the higher the vulnerability of the industrial control network if its stability is poor; according to the risk value of all assets, the threat score of the current industrial control network and the vulnerability, the risk value of the industrial control network is calculated. The present application can quickly locate the reason leading to the rapid increase of risk value when the industrial control security network risk value is too high.

Description

Technical Field

[0001] This invention belongs to the field of nuclear power plant instrumentation and control technology, specifically relating to a method for calculating network security risk values ​​of industrial control systems. Background Technology

[0002] Currently, there is no good way in the industrial control field to intuitively display the risk status of industrial control equipment in a network environment, so as to help implementers to have a clearer understanding of the current security status of industrial control equipment.

[0003] Current risk value calculation methods are general methods that do not take into account the special characteristics of industrial control environments. This invention provides a risk value calculation method for industrial control environments. Summary of the Invention

[0004] The purpose of this invention is to provide a method for calculating the network security risk value of an industrial control system, which can clearly understand the current security status of the industrial control network: it can clearly identify the reasons for the increase in the risk value, thereby enabling targeted solutions; it provides an accurate score for the current industrial control network security, and different measures can be taken based on the score, such as issuing different alarms; it enables the rapid identification of the reasons for the rapid increase in the risk value when the industrial control network security risk value is too high.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] A method for calculating the network security risk value of an industrial control system includes a method for calculating the risk value of a single device within an industrial control network and a method for calculating the network security risk value of the entire industrial control system.

[0007] Single-device risk value calculation method: Before calculating the risk value, the industrial control equipment data is prepared. The asset value is determined by confirming the asset types and list of industrial control equipment, estimating the network asset value, and estimating the relative value of the assets based on CIA attributes. Data of specific industrial control equipment is collected, including operation logs, operating status, working status, and online status. Based on this data, corresponding risk events are generated according to preset rules. Risk events of corresponding levels (low risk 1, medium risk 2, high risk 3) are generated based on the actual situation. All risk events are multiplied by their risk levels and then added together to obtain the final asset risk event score. Subsequently, engineering personnel perform corresponding actions on the industrial control equipment based on the event content. The risk event is handled and resolved at the asset risk event stage. If a risk event is misjudged, it is ignored here. When the abnormal state of the equipment or the alarm disappears, the corresponding risk event is eliminated, reducing the risk value. Different types of equipment have different functions and attributes, and corresponding assessments are made based on the configuration and activation status of relevant functions. Based on the above data, the risk value is calculated. Each item is scored first. The higher the asset value, the higher the score. The more asset risk events there are, the higher the score. The more detailed the asset feature configuration according to the specifications, the lower the score. If there is no relevant asset feature configuration, no risk value assessment or calculation is performed. The final single-equipment risk value is obtained by multiplying the above scores.

[0008] The overall industrial control system (ICS) network security risk value calculation method is as follows: It is calculated by comprehensively considering device risk value, threat identification, and device vulnerability. Device risk value: A comprehensive assessment of all devices and the entire ICS network is conducted, resulting in a score. Threat identification: Threats in the current network environment are identified, including threat pathways, threat capabilities, threat effects, and threat frequency; a threat score is given based on the analyzed threat information. Vulnerability: The stability of various assets within the ICS network is obtained to determine the overall vulnerability of the current ICS network. For example, the higher the importance of an asset in the entire ICS network, the higher the vulnerability of the ICS network if its stability is poor. The overall risk value of the ICS network is calculated based on the risk values ​​of all assets, the current threat score, and the vulnerability.

[0009] The asset value is determined by identifying the types and list of industrial control equipment assets: divided into network equipment, host, server, application, data and document assets.

[0010] CIA attributes: confidentiality assignment, integrity assignment, and availability assignment; divided into 5 levels: 1 Very low 20, 2 Low 40, 3 Medium 60, 4 High 80, 5 Very high 100; asset threat level consists of two parts: asset risk events and asset characteristic attributes.

[0011] Single device risk value calculation method: Query the reasons for the increase in risk value at the risk value section, including specific asset risk events and configuration related to asset characteristic attributes, and carry out targeted risk reduction measures. After the measures are completed, the device risk value is recalculated based on the latest status of the device to obtain the latest risk value.

[0012] Equipment risk value: First, obtain the risk value of all devices under the industrial control network, including host protection software, boundary devices and traffic auditing devices, generate the risk value of each device, and calculate an average value for all devices.

[0013] Threat pathways: The methods and processes used to threaten assets, including Trojans, worms, and computer viruses.

[0014] Threat effects: The impact on the network system after a successful threat, including unauthorized access, deception, and denial of service.

[0015] Threat capability: The ability to impact or cause damage to assets within an industrial control network.

[0016] Threat frequency: The likelihood of a threatening activity occurring, judged by statistical data: 1: Very low, impossible; 2: Low, very low frequency; 3: Medium, >1 time / half a year; 4: High, >=1 time / month; 5: Very high, >=1 time / week.

[0017] The stability of various assets refers to whether they frequently go offline.

[0018] The beneficial effects achieved by this invention are as follows:

[0019] This invention helps personnel implementing industrial control networks quickly understand network risks and rapidly pinpoint their causes, enabling targeted problem-solving. It reduces the time required for problem identification and improves work efficiency. It provides clear data scoring for the security status of industrial control networks, allows for the definition of alarm risk thresholds, and issues alerts, enabling personnel to detect problems early and minimize losses. It provides a clear understanding of the specific characteristics of industrial control networks and addresses their unique features.

[0020] 1. Starting with the risk value of a single device, record the risk value of each device, and finally calculate the risk value of the entire industrial control network.

[0021] 2. The equipment is divided into host protection software, boundary devices, and traffic auditing devices, which comprehensively consider the operation of industrial control networks from multiple perspectives.

[0022] 3. Individual devices are considered from the perspectives of asset value, asset risk events, and asset characteristics and attributes. The overall cybersecurity risk value of the industrial control system is comprehensively considered from multiple perspectives, including asset risk value, threat identification, and vulnerability.

[0023] 4. Throughout the risk value calculation process, the specific characteristics of the industrial control scenario were taken into account, and the results were obtained by analyzing specific equipment data in the industrial control network. Attached Figure Description

[0024] Figure 1 This is a method for calculating the risk value of a single device.

[0025] Figure 2 Risk value for a single device;

[0026] Figure 3 A method for calculating the overall network security risk value of an industrial control system;

[0027] Figure 4 This represents the overall cybersecurity risk value of the industrial control system. Detailed Implementation

[0028] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0029] The method for calculating the network security risk value of industrial control systems is divided into two parts: the method for calculating the risk value of specific devices under the industrial control network, and the method for calculating the network security risk value of the overall industrial control system.

[0030] Single device risk value calculation method:

[0031] Method for calculating the risk value of industrial control equipment: First, before calculating the risk value, specific data on the industrial control equipment needs to be prepared, such as... Figure 1 As shown.

[0032] Asset valuation involves identifying and listing the types of industrial control equipment assets, primarily categorized into six aspects: network equipment, mainframes, servers, applications, data, and documentation assets. Network asset valuation, and CIA (Corporate Identity Advisory) valuation, involves estimating the relative value of assets, which is related to their importance and value and impact within the industrial control network.

[0033] CIA attributes: confidentiality, integrity, and availability; mainly divided into 5 levels: 1 Very low (20), 2 Low (40), 3 Medium (60), 4 High (80), 5 Very high (100).

[0034] Asset threat consists of two parts: asset risk events and asset characteristic attributes.

[0035] Before calculating the risk value, data from specific industrial control equipment is collected for asset risk events, including but not limited to operation logs, operating status, working status, and online status. Based on this data, corresponding risk events are generated according to preset rules, with risk events categorized as low-risk (1), medium-risk (2), and high-risk (3) according to the actual situation. All risk events are multiplied by their respective risk levels and then summed to obtain the final asset risk event score (maximum 100 points). Subsequent engineering personnel can then handle the industrial control equipment according to the event content and click "Resolve" at the asset risk event location (if there is a misjudgment of the risk event, it can also be ignored here). When the abnormal state or alarm of the equipment disappears, the corresponding generated risk event will be eliminated, thereby reducing some of the risk value.

[0036] Asset characteristics and attributes: Different types of equipment have different functions and attributes. An assessment can be conducted based on the configuration and activation status of the relevant functions.

[0037] Based on the above data, a risk value is calculated. First, each of the three items is scored: the higher the asset value, the higher the score; the more asset risk events, the higher the score; the more detailed the asset feature configuration according to regulations, the lower the score; if there is no relevant asset feature configuration, no risk value assessment is performed. The scores are then multiplied together as follows: Figure 2 As shown, the final risk value for a single asset device is obtained.

[0038] The risk value section allows you to check the reasons for the increased risk value, such as specific asset risk events or configuration details related to asset characteristics and attributes. You can then take targeted risk reduction measures. After the measures are completed, the equipment risk value will be recalculated based on the latest status of the equipment to obtain the latest risk value.

[0039] Methods for calculating the overall network security risk value of industrial control systems:

[0040] The risk value calculation method for industrial control networks is derived from a comprehensive calculation of equipment risk value, threat identification, and equipment vulnerability.

[0041] Equipment Risk Value: A comprehensive assessment of all devices and the entire industrial control network (ICS) is conducted to generate a score. This involves first acquiring all devices within the ICS, including host protection software, boundary devices, and traffic auditing devices, generating a risk value for each device, and then calculating an average risk value across all devices.

[0042] Threat identification: Identifying threats in the current network environment, typically analyzing the threat situation of industrial control networks from four aspects: threat pathways, threat capabilities, threat effects, and threat frequency.

[0043] Threat pathways: The methods and processes used to threaten assets, such as Trojans, worms, and computer viruses.

[0044] Threat effects: The impact on the network system after a successful threat, such as unauthorized access, deception, or denial of service.

[0045] Threat capability: The ability to impact or cause damage to assets within an industrial control network.

[0046] Threat frequency: The likelihood of a threatening activity occurring. Determined by statistical data. (1: Very low, almost impossible; 2: Low, very infrequent; 3: Moderate, >1 time / 6 months; 4: High, >=1 time / month; 5: Very high, >=1 time / week).

[0047] Based on the analyzed threat information, a threat score is given from the perspective of the threats mentioned above.

[0048] Vulnerability: By assessing the stability of various assets within the industrial control network (whether they frequently go offline), the overall vulnerability of the current industrial control network can be determined. For example, the higher the importance of an asset in the entire industrial control network, the higher the vulnerability of the industrial control network if its stability is poor.

[0049] In summary, based on the risk values ​​of all assets, the current threat score and vulnerability of the industrial control network, the risk value of the industrial control network is calculated as follows: Figure 4 As shown.

[0050] The specific implementation method is explained by the calculation method of risk value of specific equipment in industrial control network and the calculation method of network security risk value of industrial control system as a whole. The first part explains the implementation method from the perspective of host protection software, boundary device and traffic audit device. The second part explains the implementation method with the above specific examples.

[0051] (1) Calculation method of risk value of specific equipment under industrial control network

[0052] 1. Host protection software

[0053] Host protection software refers to the protection software running on the operator machine in an industrial control network environment. To calculate the risk value of the device, the protection software needs to collect the operation and protection data of the operator machine.

[0054] a. Asset value: Based on the importance of the host machine and its importance in the industrial control network, its asset value is rated as high (80) points.

[0055] b. Asset Risk Events: Host protection software can collect the operating logs, protection dates, and Windows logs from the operating machine. These logs can be analyzed according to preset rules to generate corresponding risk events. For example, setting CPU usage thresholds to 90%, memory usage thresholds to 90%, and disk usage thresholds to 90% defines this type of risk event as low risk. When data matching these preset rules is found in the collected logs, a low-risk event of this type is recorded. If subsequent log collections show related usage values ​​falling below the thresholds, the previously generated low-risk event is ignored.

[0056] Setting user permission changes as a medium-risk event allows you to collect relevant data in Windows logs. When a user's permissions change or a new user is added, a medium-risk event is recorded. Setting running a risky executable file as a high-risk event allows you to perform relevant rule analysis on the collected logs and generate a high-risk event.

[0057] Taking all risk events into account, the risk event is given a score of 55.

[0058] c. Asset Characteristics: For host protection software, this refers to whether the software's protection functions are enabled, such as network protection and virus protection. The more comprehensive the enabled functions, the lower the risk score for this item. A score of 30 points is assigned based on its protection status.

[0059] Considering the overall asset value, asset risk events, and asset characteristics, the comprehensive risk value of this operating machine is: 80*(55+30) / 2 / 100=34.

[0060] 2. Boundary equipment

[0061] Border devices include firewalls, switches, etc. The following example uses a firewall:

[0062] a. Asset Value: The integrated firewall is rated as very high (100) in terms of asset value in the entire industrial control network.

[0063] b. Asset risk events: By collecting firewall operation logs and protection logs, relevant risk events are generated according to preset rules.

[0064] For example: If the firewall detects a DDoS attack, a new high-risk DDoS attack event is added.

[0065] Identifying application-layer attacks: Firewalls can identify and block attacks on target applications or services, such as HTTP request flooding, SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). These types of attacks are considered low-risk events.

[0066] Based on the firewall logs and protection data, relevant asset risk events are generated. If any event is found to be inconsistent with the actual situation, it can be ignored and will not be included in the scoring. The final overall risk event score is 90.

[0067] c. Asset characteristic attributes: Firewalls in industrial control environments are configured with some policies related to industrial control networks. For example, if no scnet-related policies are configured, many scnet protocol blocking cases are found in the firewall. Based on the configured policies, the characteristic attribute score is given as 10 points.

[0068] Based on the combined asset value, asset risk events, and asset characteristics, the overall risk value of this firewall is: 100*(90+10) / 2 / 100=50.

[0069] 3. Traffic auditing equipment

[0070] Traffic auditing equipment is a device connected to the traffic mirroring port of a switch in an industrial control network. It can obtain all traffic in the entire industrial control network without affecting the operation of the industrial control network.

[0071] a. Asset value: The asset value of the integrated flow audit equipment in the entire industrial control network is rated as very low (20).

[0072] b. Asset risk events: By collecting the operation logs and audit logs of the traffic auditing device, relevant risk events are generated according to preset rules.

[0073] For example, traffic auditing devices can monitor the communication behavior of industrial control equipment and detect abnormal or abnormal operations between devices, such as device restarts or configuration changes. Such behaviors are defined as medium-risk events, and a corresponding medium-risk event is generated.

[0074] The system identifies malicious software, viruses, or attack behaviors in industrial control networks, such as ransomware, remote command execution, and vulnerability exploitation. This type of traffic is defined as a high-risk event, and a corresponding high-risk event is generated. Logs and audit data from traffic auditing devices are combined to generate relevant asset risk events. Ultimately, a comprehensive risk event score of 40 is obtained.

[0075] c. Asset characteristic attributes: It can identify the flow of operations on tag numbers. When an abnormal tag number is assigned a flow, it will affect the normal operation of the industrial control equipment. The characteristic attribute score is given as 80 points based on the abnormal tag number flow.

[0076] Considering the overall asset value, asset risk events, and asset characteristics, the comprehensive risk value of this firewall is: 20*(40+80) / 2 / 100=12.

[0077] (2) Calculation method for network security risk value of the overall industrial control system

[0078] Equipment risk value: Based on the combined assessment of the host protection software, boundary devices, and traffic auditing devices, the equipment score under the industrial control network is (34+50+12) / 3=32.

[0079] Threat level: Based on a comprehensive analysis of the network environment and firewall devices, the threat situation in the current network environment is identified and a score is given.

[0080] If a mining virus is discovered, it will have a significant impact due to its high consumption of computer resources, and the current threat level of the industrial control network is given as 30.

[0081] Vulnerability: If the firewall is likely to go offline, the vulnerability of the current industrial control network is given as 40.

[0082] Based on the above scores, the risk value is 32*(30+40) / 2 / 100=11.2.

Claims

1. A method for calculating the network security risk value of an industrial control system, characterized in that: This includes methods for calculating the risk value of a single device within an industrial control network and methods for calculating the network security risk value of the entire industrial control system. Single-device risk value calculation method: Before calculating the risk value, the industrial control equipment data is prepared. The asset value is determined by confirming the asset types and list of industrial control equipment, estimating the network asset value, and estimating the relative value of assets based on CIA attributes. Data of specific industrial control equipment is collected, including operation logs, operating status, working status, and online status. Based on this data, corresponding risk events are generated according to preset rules. Based on the actual situation, risk events of corresponding levels are generated: low risk 1, medium risk 2, and high risk 3. All risk events are multiplied by their risk levels and then added together to obtain the final asset risk event score. Subsequently, engineering personnel handle the industrial control equipment according to the event content and resolve it at the asset risk event point. If there is a misjudgment of the risk event, it is ignored here. When the abnormal status of the equipment or the alarm disappears, the corresponding risk event is eliminated, reducing part of the risk value. Different types of equipment have different functions and attributes. The corresponding evaluation is carried out according to the configuration and activation status of relevant functions. Based on the above data, the risk value is calculated. First, each item is scored. The higher the asset value, the higher the score; the more asset risk events, the higher the score. assets The more detailed the feature configuration according to the specifications, the lower the score; if there is no relevant asset feature configuration, no risk value assessment or calculation will be performed, and the above scores will be multiplied to obtain the final single-device risk value. The overall industrial control system (ICS) network security risk value calculation method is as follows: It is calculated by comprehensively considering device risk value, threat identification, and device vulnerability. Device risk value: A comprehensive assessment of all devices and the entire ICS network is conducted, resulting in a score. Threat identification: Threats in the current network environment are identified, including threat pathways, threat capabilities, threat effects, and threat frequency; a threat score is given based on the analyzed threat information. Vulnerability: The stability of various assets within the ICS network is obtained to determine the overall vulnerability of the current ICS network. For example, the higher the importance of an asset in the entire ICS network, the higher the vulnerability of the ICS network if its stability is poor. The overall risk value of the ICS network is calculated based on the risk values ​​of all assets, the current threat score, and the vulnerability.

2. The method for calculating the network security risk value of an industrial control system according to claim 1, characterized in that: The asset value is determined by identifying the types and list of industrial control equipment assets: divided into network equipment, host, server, application, data and document assets.

3. The method for calculating the network security risk value of an industrial control system according to claim 1, characterized in that: CIA attributes: confidentiality assignment, integrity assignment, and availability assignment; divided into 5 levels: 1 Very low 20, 2 Low 40, 3 Medium 60, 4 High 80, 5 Very high 100; asset threat level consists of two parts: asset risk events and asset characteristic attributes.

4. The method for calculating the network security risk value of an industrial control system according to claim 1, characterized in that: Single device risk value calculation method: Query the reasons for the increase in risk value at the risk value section, including specific asset risk events and configuration related to asset characteristic attributes, and carry out targeted risk reduction measures. After the measures are completed, the device risk value is recalculated based on the latest status of the device to obtain the latest risk value.

5. The method for calculating the network security risk value of an industrial control system according to claim 1, characterized in that: Equipment risk value: First, obtain the risk value of all devices under the industrial control network, including host protection software, boundary devices and traffic auditing devices, generate the risk value of each device, and calculate an average value for all devices.

6. The method for calculating the network security risk value of an industrial control system according to claim 1, characterized in that: Threat pathways: The methods and processes used to threaten assets, including Trojans, worms, and computer viruses.

7. The method for calculating the network security risk value of an industrial control system according to claim 1, characterized in that: Threat effects: The impact on the network system after a successful threat, including unauthorized access, deception, and denial of service.

8. The method for calculating the network security risk value of an industrial control system according to claim 1, characterized in that: Threat capability: The ability to impact or cause damage to assets within an industrial control network.

9. The method for calculating the network security risk value of an industrial control system according to claim 1, characterized in that: Threat frequency: The likelihood of a threatening activity occurring, determined by statistical data. 1: Very low, impossible. 2: Low, very low frequency; 3: Medium, >1 time / half a year; 4: High, >=1 time / month; 5: Very high, >=1 time / week.

10. The method for calculating the network security risk value of an industrial control system according to claim 1, characterized in that: The stability of various assets refers to whether they frequently go offline.

Images