VGB規格 175: IT Security for Generating Plants
Description
The topic of IT security for power and heat producing plants (generating plants), especially for instrumentation and control (I&C) systems, has increasingly moved into the focus of attention of users and manufacturers.
The following trends have materially influenced this situation:
- The pervasive and unstoppable use of IT standard products in I&C systems;
- The progressive interlinking of the I&C systems with the business processes mapped in the corporate IT;
- An increased focus of the hacker community on automation and I&C systems, which is evident from an increasing number of security holes discovered and the occurrence of specialized malicious software;
- The increasing activities of lawmakers and regulatory authorities in the critical infrastructure sectors.
If I&C systems are to be connected to the “IT environment” existing in generating plants, it always has to be carefully pondered whether everything that is technically possible and desirable from the user’s point of view should actually be implemented. In decision making, the expected benefit must in any case be weighed against the potential risks, and effective protection mechanisms must be put into place.
The VGB-Standard S-175 starts with identifying the relevant threats and error sources for the operation of generating plants and then proceeds to deriving from this organizational and technical requirements for reducing the threats to an acceptable level, which is complemented by recommendations for action and references to other sources of information.
The main aspects of this standard have been discussed in technical consultations with renowned manufacturers and the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI), and their acceptance and general practicability was confirmed by the manufacturers.
As the lifecycle of IT systems and the system threats are subject to rapid progress, this VGB-Standard is limited to addressing fundamental aspects. The listed sources of information are intended to help the user in delving deeper into the topic.
The VGB-Standard S-175 can be used to assess the organizational and technical structures and processes relevant to IT security and derive conclusions for expansion and new investment projects. In this context it will be essential to bring the requirements in line with the company-specific situation and put them into more specific terms.