STRIDE 위협 모델링에 기반한 스마트팩토리 보안 요구사항 도출
Derivation of Security Requirements of Smart Factory Based on STRIDE Threat Modeling
2
조회
0
다운로드
9
인용
0
참고문헌
키워드
초록
최근 4차 산업명에 한 심이 증가하고 있다. 그 제조업 분야에서는 사이버 물리 시스템(CPS) 기술을 기 반으로 제조의 모든 단계를 자동화, 지능화 시킨 스마트팩토리 도입이 확산되고 있는 추세이다. 스마트팩토리는 그 복잡도(Complexity)와 불확실성(Uncertainty)이 크기 때문에 상치 못한 문제가 발생할 가능성이 높고 이는 제조 공정 단이나 오작동, 기업의 요 정보 유출로 이어질 수 있다. 스마트팩토리에 한 을 분석하여 체계 인 리를 수행할 필요성이 강조되고 있지만 아직 국내에서는 연구가 부족한 상황이다. 따라서 본 논문에서는 스 마트팩토리의 반인 생산 공정 차를 상으로 Data Flow Diagram, STRIDE 모델링 기법을 이용하 여 체계으로 을 식별한다. 그리고 Attack Tree를 이용해 험을 분석하고 최종으로 체크리스트를 도출한 다. 도출된 체크리스트는 향후 스마트팩토리의 안성 검사 보안 가이드라인 제작에 활용 가능한 정량 데이터 를 제시한다.
Abstract
Recently, Interests on The Fourth Industrial Revolution has been increased. In the manufacturing sector, the introduction of Smart Factory, which automates and intelligent all stages of manufacturing based on Cyber Physical System (CPS) technology, is spreading. The complexity and uncertainty of smart factories are likely to cause unexpected problems, which can lead to manufacturing process interruptions, malfunctions, and leakage of important information to the enterprise. It is emphasized that there is a need to perform systematic management by analyzing the threats to the Smart Factory. Therefore, this paper systematically identifies the threats using the STRIDE threat modeling technique using the data flow diagram of the overall production process procedure of Smart Factory. Then, using the Attack Tree, we analyze the risks and ultimately derive a checklist. The checklist provides quantitative data that can be used for future safety verification and security guideline production of Smart Factory.
참고문헌 (36)
- Edward A. Lee, "Cyber Physical Systems : Design Challenges", 11th IEEE International Symposium on Object Oriented Real-Time Distributed Computing(ISORC), pp.363~369 (2008)
- Alvaro A. Cardenas, "Secure Control : Towards Survivable Cyber-Physical Systems", The 28th International Conference on Distributed Computing Systems Workshops, pp.495~500 (2008)
- Domestic and Overseas Introduction Trends of Smart Factory, "Injae Lee", Institute for Information and Communications Technology Promotion, ~ (2016)
- Cyber Physical Systems Public Working Group, "Framework for Cyber-Physical Systems Release 1. 0", ~ (2016)
- NIST, "Framework for Cyber-Physical Systems : Volume 1, Overview", ~ (2017)
- Framework for Cyber-Physical Systems : Volume 2, Working Group Reports, "NIST", NIST, ~ (2017)
- Framework for Cyber-Physical Systems : Volume 3, Timing Annex, "NIST", NIST, ~ (2017)
- NIST, "Guide to Industrial Control Systems (ICS) Security", ~ (2015)
- Karnouskos, "Stuxnet worm impact on industrial cyber-physical system security", IECON 2011-37th Annual Conference on IEEE Industrial Electronics Society. IEEE, pp.4490~4494 (2011)
- Ciancamerla, Ester, "Modeling cyber attacks on a critical infrastructure scenario", Information, intelligence, systems and applications (IISA), 2013 fourth international conference on. IEEE, pp.1~6 (2013)
- Brian Meixell, "Out of Control:Demonstrating SCADA Exploitation", Black Hat USA, ~ (2013)
- Spenneberg, Ralf, "Plc-blaster:A worm living solely in the plc" (2016), Black Hat Asia, Marina Bay Sands
- "DEF CON 25 Hacking Conference"[URL]
- Wollschlaeger, Martin, "The future of industrial communication : Automation networks in the era of the internet of things and industry 4. 0", IEEE Industrial Electronics Magazine, 11(1), pp.17~27 (2017)
- "Black Hat USA 2016"[URL]
- Lucas Apa, "Compromising Industrial Facilities from 40 Miles Away" (2013), Black Hat USA
- Kim, HyungJun, "Security and vulnerability of SCADA systems over IP-based wireless sensor networks", International Journal of Distributed Sensor Networks, 8(11) (2012)
- Thilo Sauter, "The continuing evolution of integration in manufacturing automation", IEEE Industrial Electronics Magazine, 1(1), pp.10~19 (2007)
- D. Bauer, "Movement Towards Service-orientation and App-orientation in Manufacturing IT", Procedia CIRP, 62, pp.199~204 (2017)
- Smart Factory Status and Implications, "Korea Embedded Software and System Industry Association", KESSIA, ~ (2015)
- James Kettle, "Server-Side Template Injection: RCE for the modern webapp" (2015), Black Hat USA
- Vanhoef, Mathy, "HEIST: HTTP Encrypted Information can be Stolen through TCP-windows" (2016), Black Hat USA
- Sivakorn, Suphannee, "HTTP Cookie Hijacking in the Wild:Security and Privacy Implications" (2016), Black Hat USA
- "OWASP AppSec Europe '16"[URL]
- Kyle Wilhoit, "The Little Pump Gauge That Could: Attacks Against Gas Pump Monitoring Systems" (2015), Black Hat USA
- Jason Larsen, "Remote Physical Damage 101 – Bread And Butter Attacks" (2015), Black Hat USA
- "ShmooCon Speakers" (2016)[URL]
- Sergey Temnikov, "Pwning the Industrial IoT : RCEs and backdoors are around!", DEF CON 25, ~ (2017)
- "Black Hat Asia" (2017)[URL]
- Emerson, "Emerson Wireless Security – Automation Solutions", Emerson Process Management (2016)
- MSB, "Guide to Increased Security in Industrial Control Systems", Swedish Civil Contingencies Agency (2014)
- SANS Institute, "Securing Industrial Control Systems-2017", ~ (2017)
- Kaspersky, "Industrial Control Systems Vulnerabilities Statistics", ~ (2016)
- "MITRE"[URL]
- "Microsoft"[URL]
- "Microsoft Threat Modeling Tool"[URL]