There have been many major industrial information security incidents in the world in recent years. Some organizations or individuals seek to achieve political appeals or economic demands through cyber attacks on industrial facilities and industrial systems. At present, most of China's industrial control systems are exposed to the Internet without protective measures, and contain system loopholes, which can be easily remotely controlled and face enormous security risks.

95% of industrial control systems have vulnerabilities that are easy to control. How to tighten industrial network "safety valves"

95% of industrial control systems contain vulnerabilities that are easily controlled

The reporter learned from the National Industrial Information Security Development Research Center that more than 5% of China's industrial control systems exposed on the Internet have been vulnerable to remote control, and about 20% of important industrial control systems. Can be remotely invaded and completely taken over.

In the past, most of China's industrial systems were closed systems, also known as stand-alone systems, without regard to networking. Now with the advancement of industrial "Internet +", the interconnection of IT and OT (operational technology) will inevitably lead to a number of systems and facilities. Exposed.

"Many systems and devices do not have protection software, nor can they install anti-virus systems. Once they are on the network, they are in a 'streaking' state." An industry insider told reporters that communication, energy, water, electricity and other critical infrastructures have security risks. Intrusion and control of industrial control systems have also become illegal means of suppressing competitors in business.

In Jiangsu and Zhejiang, consumer goods processing plants were invaded by foreign competitors, disrupting equipment operations and causing production disruptions.

From the perspective of global development trends, industrial control systems are increasingly becoming the focus of hacker attacks and cyber warfare.

In recent years, major global industrial information security incidents have occurred frequently: in 2010, Iran’s nuclear facilities suffered a “seismic network virus” attack; in 2016, the US East Coast was largely broken; in 2017, “Wanna Cry” ransom virus ravaged the world... Global industrial network security overall The risk continues to climb and presents a high-risk situation.

Directional attack accuracy increases rapidly. A large number of industrial control system vulnerabilities and attack methods can be obtained through various public and semi-public channels such as the Internet. Many technical analysis reports give detailed information such as network attack steps, attack codes and even attack tools, which are easily exploited by hackers and other lawless elements.

Technical means are complicated and specialized. The attack on the industrial control system has attacked one or two vulnerabilities from the original code, and evolved into a code to embed dozens of underlying system vulnerabilities, which is not an amateur.

The US cyber arsenal has been buried as a major hidden danger. Hacker organizations such as WikiLeaks and shadow brokers have publicly disclosed a large number of cyberattack tools and security vulnerabilities, which can be used to invade infected industrial control systems, causing high-frequency, large-scale cyber attacks.

For example, the "Wanna Cry" ransomware that shocked the world was exploited by the US National Security Agency's "Eternal Blue" vulnerability disclosed by the shadow broker. In a cyber attack, many Chinese industrial companies such as PetroChina were recruited.

Weak awareness, lack of technology, and lack of talent increase risk

At present, China has problems in industrial information security, such as weak awareness of safety protection, low technical level, and lack of talents. The situation is more serious.

Many regions, departments, and industrial enterprises pay insufficient attention to the information security of industrial control systems, and focus on development and light security. Vulnerabilities are not valued and repairs are not timely.

According to the 360-day vulnerability response platform statistics, 25.6% of all industrial control information system vulnerabilities have not been fixed, and some industry vulnerabilities have been repaired for several months.

China’s understanding of the safety of industrial information is still in its infancy. In May 2017, the "Wanna Cry" ransomware incident broke out. Microsoft released the corresponding security vulnerability patch in March of that year, but many units in China have not been patched, resulting in nearly 300,000 hosts and computers being infected.

Until now, 360 companies have been able to detect that nearly 1,000 computers are infected with this ransom virus every day.

In the enterprise, it is more common to expose and infect the virus due to private behavior, such as an individual who goes online through industrial control equipment, or a computer infected by a manufacturer's maintenance personnel, causing the entire system to be infected with the virus.

Some industrial control systems rely on imports, and the core products have low autonomy and controllability.

The "Industrial Information Security Situation White Paper 2017" issued by the National Industrial Information Security Industry Development Alliance shows that domestic databases only occupy 7% of the low-end market, thousands of industrial control systems are provided by foreign manufacturers for operation and maintenance, and a large number of enterprises do not have the ability to maintain their own. At the same time, there is a lack of supervision of foreign products and services.

The reporter learned that the maintenance personnel of equipment manufacturers have very strong control over the industrial control system. In some enterprises, the access control card of the control room of the industrial control system is even in the hands of the foreign party.

The protection technology is relatively backward, and there is a shortage of talents, which is difficult to compete with cyber attacks. Through the safety monitoring, the National Industrial Information Security Development Research Center found that industrial enterprises have insufficient information security emergency preparedness measures, and about 70% of the industrial enterprises surveyed lacked a comprehensive disaster preparedness system.

The public information security talents are the composite talents of automation and network security talents. The gap is huge. There is no master's or doctoral training direction in the field of industrial control in colleges and universities. The industrial information security practitioners are almost all learning in actual combat.

How to tighten the industrial network "safety valve"

In response to the complex and ever-changing challenges in the field of industrial security, we must focus on policy systems, technology product development, and personnel training to further develop industrial Internet security and build a security system.

Strengthen network security vulnerability management to reduce the risk of being attacked.

Zhou Hongyi, chairman and CEO of 360 Group, believes that it is necessary to establish a system for monitoring and penalizing the whole process of vulnerability management, and formulate rules for the whole process of discovering, reviewing, disclosing, reporting, repairing, and responsibility covering network security vulnerabilities. The time for repairing the vulnerability and the penalties for violations are clearly defined.

In addition, supervision and inspection mechanisms and forces should be established to promptly identify the failure to repair the loopholes in a timely manner, and to investigate the responsibility of the relevant units and responsible persons.

Study and formulate the safety architecture of the new generation of information technology in the industrial field, break through a number of key core technologies of industrial information security as soon as possible, focus on the development of a number of high-end products, and form a market-competitive product system.

China's existing industrial information security industry (including products, technologies, services, etc.) accounts for less than 2% of the entire IT industry, far below the level of nearly 10% in developed countries in Europe and America. Only those industries that are independent and controllable in industrial control systems can have a say in security issues.

Support relevant education and training institutions, carry out joint construction of network security disciplines, incorporate network security into the vocational skills appraisal system, and train a team of professional talents with complete categories and skilled skills.

The essence of network security is the contest between the offensive and defensive capabilities. More than 90% of China's huge network security talent gap is defensive talent.

Different from offensive and research-oriented talents, defensive talents can be cultivated in large quantities through vocational training, relying on social forces to carry out vocational education, and can make up for the shortage of network security talents in a short period of time.

10.1 Inch Laptop

Which is the most welcome kid laptop for entertainment and online learning? 10.1 inch laptop is the best choice. You can see netbook 10.1 inch with android os, 10.1 inch windows laptop, mini laptop 10.1 inch 2 in 1 windows, 10.1 inch 2 In 1 Laptop with android os. Of course, there are various matches of memory and storage, 2 32GB or 4 64GB. Our suggestion is that 10.1 inch android 32GB laptop, 10.1inch 32GB or 64GB Solid State Drive windows laptop. Except 10.1 inch Student Laptop , there are 11 Inch Laptop, 15.6 Inch Laptop, 14 Inch Laptop , also option here.

Besides, other advantages you can see on 10.1inch Budget Laptop For Students, for example, lightweight, competitive cost, portability, Android or Windows OS, rich slots, energy saving cpu, etc.

As a professional manufacturer, can provide free custom service, like mark client`s logo on laptop cover, opening system, inner color box, manual, boot. Produce as your special requirement on parameters, preinstall apps needed, etc. What you need to do is very simple, confirming PI, including price, delivery time, parameters, etc.

10.1 Inch Laptop,Netbook 10.1 Inch,10.1 Inch 2 In 1 Laptop,10.1 Inch Windows Laptop,Mini Laptop 10.1 Inch

Henan Shuyi Electronics Co., Ltd. , https://www.shuyiminipc.com