... 1... 1... 4... 6... 9...11...11...12...12...12... 13...14... 14...16...17...17...18...18...19...22...23...24...24...27...29...29...31
...33...34...34...34...36...36...36...36...36...39...40...40...41...45...45...45...45...45...46...46...47...49...49...49...50...51...53...53...54...55...56...56...57...57
...59...66...68...68...69...69...73 TOE...75...78 PP...82...82...82 PP...82 PP...83 PP...83...84...86
9
Network Security Technology Dr. Stephen D. Bryen Development Plan for Plant Network Security Technology Mr. Fukuyama Measuring Network Risk Dr. Stephen D. Bryen New Risk Analysis Methodology Development for Network Mr. Koshijima Non-technical Approaches to CIP Dr. Irwin M. Pikus Establishment of Security guideline on plant network Mr. Hinoki Application of ISO/IEC 15408 into Plant Network Mr. Miyakawa Security of Networked System Shell companies --and Beyond-- Mr. Pieter van Dijken Security management in the Fibers and Chemical industry Mr. Robert T. George Survey Report Mr. Isomura
1996.11.15 1
1 1970 1980 2 1980 1990 Ethernet 2
3 1990 ERP( Enterprise Resource Planning ) PIMS (Plant Information Management System ) TCP/IP 3
4
5 Gate Way Firewall WAN PBX Firewall PC -1-2 LAN PHS PC RAS PLC PLC OA R/M LAN OALAN o o o o o o Gate Way o o o o o o EWS A LAN LAN R/M Gate Way B LAN Firewall
6
7
8
9
10
11
12
13
14 Common Criteria Protection Profile
15
Dr. Irwin M. Pikus Director, Communications and Information Infrastructure Assurance Program, U.S. Department of Commerce, NTIA Dr. Stephen D. Bryen Managing Partner, Aurora Marketing & Business Development Mr. Robert T. George Manager, Benchmarking Programs, DuPont Informatuin Security OrganizationE.I. DuPont de Nemours & Co. Mr. Pieter van Dijken ITS ( Information Security Services ) International B.V. Shell Services 16
1 2 3 17
4 5 18
19
( 1) ( 2) 1-3 Communications i = j k l i = -3 Communications 2 20
6 6 21
7 Sicherheit 7 8 The Oxford Encyclopedic English Dictionary 22
23
(Guideline for the Management of IT Security) (British Standard 7799) 24
25
() 3 26
Future Vision Company Policy Top Management Security Policy Deployment Section Management Section Section Section 4 27
28
29
9 30
31
32
Increasing Increasing threats threats from from espionage espionage and and information information brokers: brokers: Information Information Warfare Warfare Fraud Fraud increasing increasing with with restructuring restructuring & economic economic pressures pressures Increasing sophistication sophistication of of viruses, viruses, hacker hacker groups, groups, involvement involvement organised organised crime crime Information security: Trends in threats Threats to Confidentiality Threats to Integrity Threats to Availability Malicious Espionage, Leaks Fraud, Mischief Sabotage, Vandalism Theft Accidental Oversights, Breaches Safety Safety critical critical systems Errors, systems cause cause Failures concern, concern, Y2K Y2K Breakdowns Theft Theft of of notebooks notebooks Information warfare Security for Critical National Infrastructure sept/oct1999 PSEC copyright Large-Scale Network Security Committee All right reserved 1.Oct. 1999 Shell Services International Shell Services International 5 33
34
35
36
37
(1) (2) (3) (4) 38
39
40
41
() 1. 2. (3) (4) 1. 2. (3) 1. 2. (3) (3) 1. 2. (3) (3) 1. 2. (3) 2. 2. (X) (3) 2. 2. (X) (2) 2. 2. (X) (6) 2. 1. (X) (4) 3. 5. (1) (2) 42
() 4. 3. (3) (3) 4. 3. (3) (3) 4. 3. (3) (3) 43
44
45
46
47
48
49
50
51
52
10 PC 10 53
11 54
E3(Intrude to DCS) F4(Alter Control Parameters) Preliminary Risk Analysis (PRA) Hazard and Operability studies (HAZOP) Failure Mode and Effects Analysis (FMEA/FMECA) 2 Fault Tree Analy sis (FTA) Event Tree Analysis (ETA) ( FTA ETA Dynamic Event Tree Analysis Method (DETAM) Cause-Consequence Analysis (CCA) 1 55
2 HAZOP FTA/ETA HAZOP 56
FTA/ETA HAZOP FTA/ETA HAZOP FTA/ETA HAZOP FTA/ETA HAZOP a) CAD b) c) d) e) HAZOP d) e)2 2 57
2 LAN DCS 2 58
HAZOP 2 FTA/ETA FTA/ETA 1) PC Access to the Network PC. 2) DCS 3) DCS 4) 5). 6) 2 FTA/ETA 2 FTA/ETA 59
2 FTA/ETA : FTA = = : FTA = = FTA FTA FTA/ETA FTA FTA 60
61 2 OS OS OS
FT 2 FT ETFT FT FT FT ET+FT FT ET 62
FTA/ETA DCS UNIX su FT FT FT FT 63
FTA UNIX su 64
FT FT 65
FTA/ETA FT FTAETA, HAZOP 66
FTA ETA, HAZOP FTA FTA 67
ISO/IEC 15408 1998 PDD63President Decision Directive 63 20001 1.0 68
Common Criteria CC CC (*1) 1980 1990 CC CC CC 69
1 CC Part1 Part2 Part3 Part1 CC Security TargetST ST Protection ProfilePP Part2 70
Part3 Part2 EAL:Evaluation Assurance Level PP PP EAL ST ST ST ST ST PP PP ST ST 71
2ISO/IEC 15408 (Common Criteria) ST ST PP PP PP ISO/IEC 15408 ST PP ST ST PP PP PP 1. 2. 3. 4. PP 72
PP PP 3. 4. PP CC 4 4 73
5 11 5 Security audit FAU Communication FCO Cryptographic support FCS FDP User data protection FIA Identification and authentication FMT Security Management ex. DB FPR Privacy TOE FPT Protection of the TOE Security Function Resource utilization FRU TOE TOE access FTA TOE FTP TOE Trusted path/channels 3 ------------------------------------------------------------------------------------- *1 ISO/IEC/JTC 1/SC 27/WG 3 Common Criteria v.2 International Standard 15408 74
TOE PP PP PP PP PP PP PP 75
TOE TOE 6TOE (Target Of Evaluation) TOE LAN LAN 76
6TOE (Target Of Evaluation) 77
TOE CC ISO/IEC 15408 Annex B (*2) PP LAN LAN LAN LAN # LAN LAN LAN LAN LAN TCP/IP + # DCOM LAN 1. 1. # # 78
79 TCP/IP LAN 2. # LAN 3. LAN LAN # LAN 2. # 3.
80 4. # 5. 4. # 5. LAN LAN # LAN DCOM # #
81 # LAN LAN 1. 2. 1. # CPU 2. # # PP --------------------------------------------------------------------------- # PP
82
PP PP PP PP TOE PBX 83
PP 4. PP PP PP TOE RAS PP 84
85
86
87
ISO 88
89