How to make industrial control network security protection
Reporter: Mr. Hu, do you think of the present development of China‘s industrial control system security?
Hu: in 2011, the ministry issued no. 451, no. 451 document requirement is for China‘s infrastructure, especially the industrial control network safety inspection, focused on problems and safety plan is given. In 2011, after many enterprises began to explore in this field, but because the lack of professional industrial control network security companies to help the government to complete the task, so the effect is not obvious. After 2013, the enterprises have begun to emerge, including Ceres, also including some foreign mature technology and products began to enter China, to rapidly development of China‘s industrial control field. Now from the level of national industrial control network security is very seriously, because the industrial network security is essentially infrastructure security, once a major network security incidents, influence and loss is incalculable. In addition, business leaders are also calls the state, and the positive response to industrial control network security, take active measures to implement. So from a market perspective, the eve of the outbreak is in safety control in the market, enterprises need to cultivate the market, grasp the needs of users, the quality reliable safety product promotion out. This process usually have a trial and error stage, however, the prospects of industrial safety is immeasurable.
Ceres network technology (Beijing) co., LTD., chairman and CEO Hu Hao
Reporter: you think what is the key link in industrial control network security?
Hu: the core link is, the first is the bosom friend, need a thorough understanding on the entire network, accomplish know fairly well. Industrial control network exactly what problems, what are the defects and risks, we need to adopt what kind of technical measures, what need to improve to level; The second is to know that, if the other side know my these problems after they will take what kind of means of attack, of course, sometimes the local information security may also be because the staff error or defect in operation. So, after the enemy and know yourself, the need for a set of complete protection scheme, will need to complete protection scheme deployment to our control system, bulletproof, usually to reinforce industrial control network security, this is what we need to do several steps.
Reporter: the enterprise for the deployment of the traditional industrial control system information safety protection products have what problem? Compared with the traditional information security protection system, what are the professional characteristics of safety control in the system?
Hu: first of all, our country industry level of 4.0 or weaker, many enterprises have begun to investment, the construction of intelligent factory. If just for information security protection, his factory after each other, the whole control system, in fact, there is a lot of defects and risks. Due to the release of the interface, hacking through open interface directly into our system, and our system itself for the control equipment is network security holes, so through the use of these holes, will cause a certain degree of damage and loss.
Industrial control system on the system availability and real time requirement is very high, while traditional security information industry the most attention is the information itself, so the focus is different. In addition, industrial control industry upgrading of the industrial control products cycle is very long, some system has been running for more than ten years in service, unlike traditional information industry now, 3 liang years will upgrade, change of hardware devices. As for the software system, the traditional software often to update the information industry, even if the update fails, restart system also won‘t cause too big effect and loss. Industrial control system for the direct control of production equipment, if there are no major defects, in does not affect the production conditions, are not allowed to upgrade the software, and hardware system is equipped with redundant equipment, control systems are requested not to have any plan of downtime or restart, otherwise may cause serious production losses or personal injury accidents.
Reporter: for different industries and different scale enterprise, how to conduct industrial safety products selection?
Hu: selection of industrial safety products, the first important products to leading technology and reliable quality, only used the advanced safety control technology, in order to protect the industrial control products, of course, if the quality is not reliable, effective protection on products is conducted by itself is not. Secondly, the enterprise in the industry reputation and market share, good product, the market will raise hand to vote; Bad product, the market will only vote with their feet. Finally, depends on whether the enterprise has application cases in different industries, whether some enterprises to focus on some industries, enterprises usually demand for industrial safety products in the same industry have a performance comparison.
Ceres, safety protection products, is to pass from Stanford university, Carnegie Mellon university, tsinghua university, Beijing university and other top universities at home and abroad for the development of independent research and development team, combined with the domestic and foreign most advanced security architecture and module, technology in a leading position at home and abroad. Ceres in domestic industrial control systems are important partners in information security technology national engineering laboratory, industrial control equipment manufacturers, system integrators, control in the industrial control research direction of research institutes and universities, national and provincial level measurement units, power generation group, etc. Company has become the industry control security technology national engineering laboratory director of council, industrial control system of information security industry association member. In order to establish independent industrial safety protection system in our country, the power security control in the core competitiveness.
Reporter: as to the IOE and national intelligent manufacturing requirements, domestic labor safety system manufacturers will face opportunities and challenges?
Hu: the current industrial safety was more severe, before a lot of infrastructure industry for lack of understanding of their but some industry doing very well. As the power industry already adopted horizontal isolation, longitudinal encryption, a lot of security measures all have their own norms and standards, gas and oil and other industries like petrochemical, also have a lot of measures on management practices, such as mobile media cannot be used casually, closed network environment, etc. Generally speaking, our country some of the infrastructure industry itself has taken some management measures, better awareness of security industry is gradually enhanced, the need for safety is more and more strong, more and more high. Facing the seismic network, Ukraine grid events, everyone realized that if we don‘t industrial control system, not to security reinforcement, is that the consequences of a particular local infrastructure after a serious network security accident, the damage caused by both political influence or economic impact is huge, immeasurable. From the perspective of the investment of the whole market, our country is now on the industrial control network security investment is relatively small, only several billion a year, less than ten billion of investment, and if a secure network accident happen, an infrastructure losses could exceed billions. So this is why we must strengthen the network infrastructure security. In addition to the influence of the economic and political factors, the most important still is the personal safety, for control system, it is the biggest problem will involve the personal safety. Ceres as the leading enterprise in the industry, but also in actively with various industries, government level, we have cooperate and provincial information security evaluation center, inspection on key enterprises, and gives us solutions to help them to consolidate their own industrial control system, network security for the safety of the industrial control industry contributes own strength.
In addition, the IOE for domestic manufacturers, whether do security, server, operating system or is an opportunity. At the same time, we also need to recognize the awareness of safety, market behavior and technology abroad than domestic or lead, but with the return of foreign talent, also brought back a few more new ideas and technology, which makes the overall technology in the field of industrial control safety threshold increased a lot. Personal humble opinions: China‘s security companies cannot behind closed doors, want to often go abroad to study abroad the latest technology, communication, research, and according to the practical application of industrial enterprises in China is digestion and absorption, to develop advanced and reliable products, to meet the development of China‘s industrial security industry of rapid development soon.
