Browse > Article
http://dx.doi.org/10.13089/JKIISC.2013.23.2.287

A Study on Security Evaluation Methodology for Industrial Control Systems  

Choi, Myeonggil (Chung-Ang University)
Publication Information
Journal of the Korea Institute of Information Security & Cryptology / v.23, no.2, 2013 , pp. 287-298 More about this Journal
Abstract
Industrial Control systems which are operated in the industrial infrastructure adopts the various functions and face various threats in these days. To assure the security of the industrial control systems, the security evaluation methodology should be necessarily developed. This study suggests the processes and methodology for evaluating control systems, verifies the effectiveness of processes and methodologies through development of security checklists. The results of the study will be utilized for operators, evaluators and obtainers of industrial controls and be basis for developing and assuring the industrial controls systems.
Keywords
Security Assurance; Security Evaluation; Evaluation Methodology; Security Checklists; Industrial Control Systems;
Citations & Related Records
Times Cited By KSCI : 1  (Citation Analysis)
연도 인용수 순위
1 DHS, "Recommended Practice:Improv -ing Industrial Control Systems Cybersecurity with Defense-In-Depth Strategies," October, 2009.
2 ISA, "Security for Industrial Automa -tion and Control Systems Part 1: Terminology, Concepts, and Models, International Society for Automation," October 29, 2007
3 Lee, Kathy, et al., "U.S. Department of Energy Office of Electricity Delivery and Energy Reliability," NSTB ICCP Security Assessment, February 2010.
4 Mell, Peter, Scarfone, Karen, and Romanosky, Sasha, "A Complete Guide to the Common Vulnerability Scoring System Version 2.0," June 2007
5 MITRE, "Common Attack Pattern Enumeration and Classification (CAPEC)," http://measurablesecurity.mitre .org/directory/areas/softwareassurance .html.
6 MITRE, "CWE(Common Weaknesses Enumeration)," Department of Homeland Security, January 11, 2009.
7 NIST, NIST SP 800-82, "Guide to Industrial Control Systems (ICS) Security, Final Public Draft, National Institute of Standards and Technology," September 29, 2008.
8 NIST, NIST SP 800-115, "Technical Guide to Information Security Testing and Assessment," September 2008.보호학회논문지, 18(1),
9 이철수, "산업제어시스템 정보보안 감리 프레임워크 연구," 한국정보pp.139-148, 2008년 12월.
10 최명균, 이동범, 곽진, "제어 시스템에 대한 보안정책 동향 및 보안 취약점 분석," 한국정보보호학회논문지, 21(5), pp.55-64, 2011년 8월.
11 한국정보보호진흥원, "취약점 분석․평가 모델," December 2002.
12 ANSI/ISA-99.00.01-2007, "Security for Industrial Automation and Control Systems Part 1: Terminology, Concepts, and Models," pp.69-73, October 2007.
13 CPNI, "Cyber Security Assessments of Industrial Control Systems," November 2010.
14 DHS, "Recommended Practice for Patch Management of Control Systems, Department of Homeland Security," December, 2008.
15 DHS, "Common Cyber Security Vulnerabilities Observed in DHS Industrial Control Systems Assessments," July, 2009.
16 DHS, "Common Cybersecurity Vulnerabilities in Industrial Control Systems," May 2011.