1. Introduction
As Industrial Control Systems (ICS) face potential threats from remote maintenance, unauthorized operations, malware intrusions, illegal access, and internet connectivity, there are certain vulnerabilities in network boundaries, access control, communication protection, malicious operation control, and malware protection. Therefore, a single protective measure is no longer effective. ICS, as the core of industrial infrastructure, is related to the economic development and national security of our country. Relevant departments should adopt multiple security measures based on the concept of in-depth defense to build a secure ICS that continuously meets the needs of technological and commercial development.
2. Security Strategy Deployment
A comprehensive, detailed, and scientifically reasonable security strategy deployment is crucial for the implementation of in-depth defense strategies. Security strategies need to be revised and evaluated annually to better achieve timeliness and practicality.
(1) Security Strategy Development
To improve effectiveness, security strategies must be operationally feasible, not severely impact production, and not incur excessively high costs while also obtaining necessary support from senior management. Therefore, the development of security strategies requires the joint participation of senior administrative leaders and system administrators. Network and ICS administrators possess technical knowledge, but the execution of security strategies still requires certification and authorization from management. Management must also support appropriate human resource deployment and utilization to ensure ICS security. Additionally, many traditional IT security strategies can be referenced and integrated with the specific needs of ICS.
(2) Security Risk Assessment
Risk assessment is the foundation for understanding and defining threats and vulnerabilities, as well as for developing security measures. Before implementing in-depth defense strategies, a comprehensive security risk assessment should be conducted to identify and uncover the risks and vulnerabilities faced.
(3) Establishing a Security Team
A cross-functional security team should be established, specifically managed by senior management. The security team should include engineers and administrators who are involved in the entire process of ICS, and team members should receive relevant security training to understand the security challenges and risks faced in the current ICS architecture. The main responsibilities of the security team are to develop security strategies and processes to enhance security capabilities and effectively protect ICS.
(4) Operational Security Plan
To prevent security strategies from negatively impacting the availability of ICS, all operational requirements of ICS should be considered. An Operational Security Program should be established, which includes roles and responsibilities, physical security, access control, and area defense, based on the premise of meeting operational requirements.
Before implementing in-depth defense technologies, it is essential to first develop a technical assessment plan, a security procurement plan, and a security implementation plan throughout the system lifecycle. In-depth defense technologies are viewed as part of the ICS security architecture and should mark system connections and key areas with different security capabilities.
(5) Security Training
Security training is an important part of promoting the importance of security awareness. When developing security training, factors such as objectives and scope, resource allocation, implementation plans, monitoring and feedback, and effectiveness evaluation should be considered.
All employees should receive security training, including those at the executive, operational, and technical levels, with different training content tailored to different positions. For instance, network security administrators should receive training on cutting-edge trends in network security, such as architectural design, firewall, and intrusion detection system configuration.
(6) Incident Response
When incidents occur in ICS, a series of measures must be taken promptly, including identification, response, impact mitigation, and documentation. A detailed incident response process document should be developed to improve incident response capabilities and guide employees in taking responsive measures. Issues to be addressed during the incident response process include:
Signs of an incident occurring or in progress; emergency measures to be taken; the order of notifying relevant personnel; methods for preserving collected evidence; and methods for securing affected computers.
The ICS forensics plan, as part of incident response, should fully consider the initiator, victim, location, and time of the incident and collect sufficient usable evidence. To this end, the National Institute of Standards and Technology (NIST) has developed the Computer Security Incident Management Guidelines SP800-61 to provide guidance for security personnel in the incident handling process.
3. In-Depth Defense Measures
(1) Zone Division
To establish layered defense, it is necessary to understand the location of system connections and manage the ICS architecture by establishing clear boundaries to divide it into independent areas. ICS can be zoned using methods such as firewalls, routers with access control lists, configured switches, static routing, and dedicated communication media. Based on the Purdue Control Hierarchy Model, the control system can be divided into the following five areas:
1. External Zone: This area connects to the internet, backup, or remote sites. It is not a demilitarized zone (DMZ), but devices connected to it are often untrusted. This area has the lowest priority and the highest risk.
2. Corporate Zone: This is the organizational communication area, where email servers, domain name system servers, and IT business system components are located. This area is connected to the external zone, thus posing potential security risks. Due to the maturity of the security situation and redundancy of the system, the corporate zone has a higher priority than the external zone but lower than other zones.
3. Manufacturing/Data Zone: This is the monitoring area, essential for ensuring business continuity and managing control networks, where operational and management devices are deployed. Risk points exist at the junction of the external and corporate zones, making this area a higher priority.
4. Control Zone: This area connects programmable logic controllers, human-machine interfaces, and basic input/output devices. The functionality of devices in this area can directly affect terminal devices, giving it a higher priority.
5. Safety Zone: This area has the highest priority and the lowest risk, as devices within it can automatically control the safety level of terminal devices.
(2) Deploying Firewalls
Firewalls provide robust and complex rules for communication between different network areas, playing a protective role in preventing attackers from obtaining information from the network or sending files and commands into the network. Different firewalls can be deployed at various layers of the OSI model, requiring selection based on the application and connectivity of the control system and the different layers of the network.
1. Packet Filtering Firewalls: These firewalls operate at the network layer, analyzing incoming and outgoing data packets of each independent network based on established rules. Packet filtering rules are typically related to port numbers, protocols, and other specified data. Packet filtering firewalls are suitable for systems requiring quick connections and can formulate rules based on device addresses, assisting ICS in securing specific applications and protocols.
2. Proxy Firewalls: These firewalls operate at the application layer and are suitable for analyzing internal application data and collecting user activity information. In ICS, proxy firewalls can isolate business LANs from control LANs and provide protection for DMZs and other assets that require specialized application protection.
3. Host Firewalls: These software firewalls protect device ports and services and can establish rules to track, allow, or deny data flows. Since workstations, laptops, and other devices may enter and exit ICS, integrating these mobile devices with host firewalls can provide additional security for ICS.
For ICS, it is crucial to configure firewalls comprehensively, reasonably, and accurately to ensure that all communications are restricted to the range permitted by system functions and that all communication lines connecting to special areas undergo detailed security risk assessments. Information exchanges in ICS should be monitored in real-time, considering bidirectional data flowing through firewalls and configuring and managing rules for incoming and outgoing network information to ensure the security of the communication process.
(3) Intrusion Detection Systems
Intrusion Detection Systems (IDS) are not a single product or technology but a complex collection of tools and processes that monitor abnormal or unauthorized activities in the network.
IDS are typically deployed at the entry and exit points of network architecture or at network connection points where important resources are located. IDS compare the status of collected information with established rules, historical behaviors, or attack characteristics to determine whether illegal activities exist. Detection features include port numbers, communication loads, etc. If deviations from comparison results exceed thresholds, the system will take a series of alerting measures to expedite incident response and resource management.
The configuration of log analysis strategies for IDS is very important. If an attacker accesses the system and initiates an attack before log auditing, detecting the attack behavior with IDS loses its protective significance.
4. Conclusion
As the core control device of national infrastructure, the security of ICS relates to the livelihood of the nation. This article proposes the adoption of in-depth defense strategies for ICS, which requires establishing an active security model based on the ICS architecture to facilitate the implementation of corresponding security measures, effective risk assessment, and timely handling of security incidents. Additionally, suitable security strategies should be formulated for ICS, with regular reviews of the security situation, considering current threats, system functions, and required security levels. Measures such as setting access control lists, monitoring malicious behaviors, log monitoring, and addressing core issues should be employed to enhance the security level of ICS.