• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>56th annual ISA POWID symposium >CYBER SECURITY PROCUREMENT METHODOLOGY FOR DIGITAL INSTRUMENTATION AND CONTROL SYSTEMS
【24h】

CYBER SECURITY PROCUREMENT METHODOLOGY FOR DIGITAL INSTRUMENTATION AND CONTROL SYSTEMS

机译：数字仪器和控制系统的网络安全采购方法

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Cyber security standards have been produced as a result of continual threats to business andrnprocess control networks. In recent years, electric utilities have established cyber securityrnprograms to ensure compliance with critical infrastructure protection (CIP) standards requirementsrnof the North American Electric Reliability Corporation (NERC), Nuclear Regulatory Commissionrn(NRC) Regulatory Guide 5.71, and related requirements in the international community.rnDetermining how to apply cyber security requirements for new I&C systems requires cyberrnsecurity experts, I&C engineers, and procurement organizations to work together with vendors tornimplement and maintain cyber security controls. Improper or incomplete implementation ofrncontrols due to lack of proper requirements and/or division of responsibilities between the utilityrnand vendor can often result in costly backfit to meet the requirements.rnThis paper reports on phase 2 and 3 of an ongoing EPRI cross sector project to develop arnmethodology and several worked examples (application of the methodology in a samplernprocurement) for procuring digital I&C systems with the necessary cyber security controls. Thernmethodology facilitates addressing cyber security related issues early in the lifecycle of an I&Crnsystem in order to fit within and support the other key requirements. This is especially useful inrnthe procurement phase, so utilities and vendors have a common understanding of cyber securityrnrequirements and capabilities. The methodology is based on understanding the cyber securityrnrequirements for the system, and defining the boundary between those that are the responsibility ofrnthe utility and of the vendor.rnThe major steps in the methodology are:rn1. Identify the required cyber security controls and requirements, and clearly define thernboundaries and responsibilities between the owner/operator and the vendor based on the cyberrnsecurity strategy, use case, data topology and data flow, and access points.rn2. Fit the cyber security requirements into the existing lifecycle and procurement process tornensure that cyber security does not inadvertently cause conflicts with other key requirements.rn3. Understand common types of I&C components that have similar cyber security requirements.rn4. Utilize one of the worked examples from the Phase 3 report (scheduled to be published in latern2013) to apply the methodology for identifying controls and defining responsibilities that alsornmaps to the appropriate standard.rn5. Create a Request for Information (RFI), Request for Proposal (RFP), or procurementrnspecification for the controls that have been identified as the responsibility of the vendor.rn6. Perform an analysis of risks, cost/benefit, and cyber security impacts that facilitate negotiationrnand selection of a vendor.rn7. Create a fully traceable, documented path that shows how the required controls are fully orrnpartially provided by the vendor, how any gaps were evaluated and how compensatingrncontrols were applied.rnThe Phase 2 report “Cyber Security Procurement Methodology” Technical Update 1025824rn(Reference 12) was published in late 2012 and is available to the public. Phase 1 was arnbenchmarking study prior to proceeding with any new guidance. The Phase 3 project is wellrnunderway to develop three worked examples with sample procurement language, and along with arncomplete mapping between major applicable regulations and guidelines. An outline of the threernexamples will also be presented.
机译：由于对业务和流程控制网络的持续威胁，已经产生了网络安全标准。近年来，电力公司已经建立了网络安全计划，以确保符合北美电力可靠性公司（NERC），核监管委员会（NRC）监管指南5.71以及国际社会的相关要求的关键基础设施保护（CIP）标准要求。确定如何对新的I＆C系统应用网络安全要求，需要网络安全专家，I＆C工程师和采购组织与供应商合作，以实施和维护网络安全控制。由于缺乏适当的要求和/或公用事业公司与供应商之间的责任分工导致对控制的不正确或不完全实施，通常会导致昂贵的改型以满足要求。本文针对正在进行的EPRI跨部门项目的第二阶段和第三阶段的开发方法进行报告。以及几个用于通过必要的网络安全控制来采购数字I＆C系统的工作示例（该方法在样本采购中的应用）。方法论有助于在I＆Crnsystem生命周期的早期解决与网络安全相关的问题，以适应并支持其他关键要求。这在采购阶段特别有用，因此公用事业和供应商对网络安全要求和功能有共同的了解。该方法基于对系统的网络安全要求的理解，并定义了公用事业和卖方责任之间的界限。该方法的主要步骤是：1。确定所需的网络安全控制和要求，并基于网络安全策略，用例，数据拓扑和数据流以及访问点明确定义所有者/运营商与供应商之间的边界和责任。使网络安全要求适应现有的生命周期和采购流程，以确保网络安全不会无意间引起与其他关键要求的冲突。了解具有相似网络安全要求的通用I＆C组件类型。利用第3阶段报告（计划于2013年晚些时候发布）中的一个工作示例，应用该方法来识别控制和定义职责，并映射到适当的标准。为已确定为卖方责任的控制措施创建信息请求（RFI），建议书（RFP）或采购规范。对风险，成本/收益和网络安全影响进行分析，以利于谈判和选择供应商。7。创建一个完全可追溯的，有文档记录的路径，以显示供应商如何部分或完全提供所需的控件，如何评估任何差距以及如何应用补偿控件。第二阶段报告“网络安全采购方法”技术更新1025824rn（参考文献12）于2012年末发布，并向公众开放。在进行任何新指南之前，第一阶段是arnbenchmarking研究。第三阶段项目正在进行中，目的是开发三个带有示例采购语言的工作示例，并在主要适用法规和准则之间进行完整的映射。还将提供这三个示例的概述。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号