公告&动态-标准2025-第224页

预防潜在影响网络安全的噩梦

2016-08-26

现在，网络空间安全对于工业生产设备的安全运行来说非常关键，但这些设备中许多装置的用户账户并没有得到妥善管理。中央用户账户管理结合基于角色的访问控制是集中有效地管理用户账户和权限的最佳途径，同时也是最先进的安全解决方案，这就消除了成百上千设备上有非托管用户账户的噩梦。

中央点操作员管理站，使用SDM600系统数据管理器控制台（照片来自于阿西亚布朗勃法瑞公司（ABB））

很多用户账户没有妥善管理

多数情况下，工厂默认工业设施设备中的用户帐户和密码是无人管理的，不会改变。共享和/或弱密码也是一个问题。

从网络空间安全的角度来看，当今世界互联互通，无论是工厂默认账户还是共享账户都存在巨大的风险，所以，二者都是不可接受的。除了考虑到网络安全问题，工厂默认账户和共享账户都会给系统控制人员带来控制系统管理方面的困扰。

修改配置会引发电力故障，但人们却无法确认是哪位员工更改了配置，因为无论是共享账户还是出厂设置账户都能进入系统进行操作。

另一种可能的情况和离开公司的员工有关。因为该员工知道公司的共享密码，这就需要公司重置大量设备和电脑的共享密码，来确保离职的员工无法登入公司系统。最后，同样重要的是，把新密码告诉在职的员工，这样，他们才能继续做自己的工作。

对于安全管理者和系统操作员来说，遗留流程、工具和技术会让他们很难改变系统来适应和抵御新的安全威胁。安全管理者需要通过标准化技术和现代工具提升安全水平。中央用户账户管理结合基于角色的访问控制（RBAC）是集中有效地管理用户帐户和用户权限的最佳途径，同时，它还是最先进的安全解决方案。它还消除了数以百计设备上有非托管用户帐户的噩梦。

技术变革可带来经营效益同时并存网络安全风险

变电站自动化、保护和控制系统在过去的十年里发生了重大变化。系统之间联系更加紧密，为终端用户提供更多信息，这就使依赖性增强，控制水平和生产效率提高。不同厂商产品和不同系统之间的互操作性已经通过利用符合公开标准，如从IEC 61850通信网络和电力系统自动化系列标准，或IEC 60870-5-104遥控设备和系统——第5-104部分传输协议——IEC 60870-5-101使用标准的传输轮廓和利用现有的以太网技术访问网络。

从操作角度来讲，技术变革给操作带来巨大便利，但也容易给公用事业网络安全造成威胁，这也是传统企业系统多年来一直受到的困扰。网络安全是现代网络的基本要素，但网络设备上分散的访问策略会暴露关键漏洞。

粗心会导致系统易被侵入

自动化网络的异构性质会使任务变得复杂，比如撤销人员凭证或更改默认密码。出厂默认账户从制造商到消费者经常是保持不变的，它甚至可能在设备的整个生命周期都保持不变。这样，不变更出厂默认账户就为攻击者快速访问设备提供了方便，而且他们不需要有任何特殊的技能或知识。

此外，大多数控制和网络设备提供日志功能来记录用户做了什么，但如果所有操作执行都在出厂默认账户的保护下进行，登录信息和审计轨迹便分不清谁做了什么。

准备可能的解决方案

系统控制者和管理者欢迎针对下列问题给予合理答案，以确保系统的安全：

.你想容易地管理用户帐户吗？

.你想从中央点管理公司新员工的访问和权限吗？

.当员工离职后，你想快速从中央位置删除或撤销其用户凭证吗？

.你想把对中央位置的改变立即有效地对公司来自不同供应商的所有产品起作用吗?

.你想消除对于默认用户帐户在非托管的本地设备上活跃的担忧吗？

行业反击战

按照北美电力可靠性协会——关键基础设施保护（NERC CIP）标准的要求，以及许多其他网络安全需求，工业正在走一条共同的未来之路：IEC TS 62351 – 8：电力系统管理和相关信息交换——数据和通信安全——第8部分：基于角色的访问控制。本技术规范规定了供应商应该如何为客户群实施和提供基于角色的访问控制和中央用户帐号管理。

自IEC TS 62351 – 82001年发布以来，用户已经能够用一个特定的用户名和密码在公司所有设备所有网络验证自己身份。此外，添加或删除用户可以集中完成，一键解决。

这种技术不仅能够集中管理用户名和密码，而且可以集中管理用户权限，根据用户在公司的职责将角色分配给他们。（RBAC基于角色的访问控制）

解决噩梦的可能途径

控制系统需要进行管理，以确保基础设施的可持续性。管理系统意味着不断地更新设备。

网络安全策略的管理可能会变得复杂，因此，为了提高效率，安全管理者需要应用软件的支持。基于角色的访问控制系统就是这样一款应用软件。它允许负责人从中央点长期管理用户和他们的角色——甚至从不同位置的多个控制系统。

不是每个人都需要成为系统管理员。网络安全管理最普通的方法是尽可能少地授予每个用户特权。以IEC TS 62351 – 8为基础的基于角色的访问控制系统，能够让公司的安全负责人为整个系统管理用户，并将角色从同一个地方分配给那些用户。

IEC 62351是技术安全的系列国际标准，其目的是确保电力系统专用通信协议如IEC 61850和IEC 60870-5-104的可行性。虽然该系列标准中的大部分已经出台，在符合IEC 62351标准的系统投放市场前仍需做更多的工作。IEC 62351 – 8是于2011年完成并出版，为电力系统定义了基于角色的访问控制。这不是一个新概念，它实际上是许多信息技术系统里最佳实践的一部分。电力系统的基于角色的访问控制，可以减少必须分配给特定用户权限的人数，这些用户只有他们需要履行职责的权限。这就降低了电力系统的风险，因为根据最少特权的原则，只有实际需要时才会分配权限。这套标准还定义了一组预定义的角色（如，浏览器，操作者等）和预定义的权利。

尽可能遵守国际标准

要确保多样的设备网络安全功能的可靠性和高品质，最基本的是尽可能地遵守国际标准。高水平的网络安全仅来自于那些经得起考验的、已经被证实的、标准化的技术和方法，特别是当安装设备来自不同的供应商时。那些不走这条聪明路的公用事业会发现自己沉溺于单一的供货商，听从他们专有解决方案的摆布。

想要优化网络安全，必须要完全了解这个系统。和安全相关的事件，如需要监测不同系统组件的访问和不同系统组件其他用户的活动，来识别潜在的攻击和优化保护。中央用户活动日志从系统设备收集网络安全相关事件，并向负责人员提供信息。一个有效的、用户友好的方式，如自动识别事件模式，就是这种监测程序的重要特征。

基于国际标准（如IEC TS 62351 – 8）的最先进的网络安全产品，使得多厂家的控制系统的基于角色的访问控制的用户账户管理很有效率。这些产品为公用事业提供实时可见的与系统安全相关的用户活动。

专有网络安全的实现应该避免多厂家控制系统的无缝集成。根据IEC TS 62351 – 8，采用互操作的解决方案，会使操作任务更加容易。

Preventing a potential cybersecurity nightmare

Unmanaged user accounts in industrial environments present significant cybersecurity risks

Cybersecurity is now central to the safe operation of industrial installations, but user accounts for many devices used in these installations are not properly managed. Central user account management combined with Role Based Access Control is the perfect solution for managing user accounts and permissions efficiently and centrally while still providing a state of the art security solution. This eliminates the nightmare of having unmanaged user accounts on hundreds of devices.

Too many user accounts are not properly managed

In many cases the factory default user accounts and passwords used in devices in industrial installations are unmanaged and remain unchanged. Shared and / or weak passwords are also an issue.

From a cybersecurity perspective, in today’s interconnected world, both factory default accounts and shared accounts represent a huge cybersecurity risk and are unacceptable. Besides cybersecurity concerns, both factory default and shared accounts can make control system management a nightmare for control system owners.

Consider the case in which a power outage occurs as a result of a changed configuration, but it cannot be established which employee actually changed the configuration because a shared account or a factory default account was used to access the system and make the change.

Another possible scenario is connected with a single employee leaving an organization. Since this member of staff knows a password that is shared by several other employees, a huge effort is required to change this shared password in a number of devices and locations, to ensure that the departing employee can no longer access the system. Last but not least, the remaining employees must also be informed of the new password, so that they can continue to carry out their work.

Legacy processes, tools and technologies can make it hard for security managers and system operators to change systems so as to adapt to and defend against new security threats. Security managers need proven standardized technologies and modern tools to move to the next level. Central user account management combined with Role Based Access Control (RBAC) is the perfect solution for managing user accounts and user permissions centrally and efficiently, while still providing a state of the art security solution. It also eliminates the nightmare of having unmanaged user accounts on hundreds of devices.

Technological change has brought both operational benefits and cybersecurity risks

Substation automation, protection and control systems have changed significantly in the past decade. Systems have become more interconnected and provide end users with much more information, resulting in higher reliability, increased levels of control and higher productivity. Interoperability between different vendor products and systems has been achieved by deploying products and solutions based on open standards such as publications from the IEC 61850 series, Communication networks and systems for power utility automation, or IEC 60870-5-104, Telecontrol equipment and systems – Part 5-104: Transmission protocols – Network access for IEC 60870-5-101 using standard transport profiles, and by leveraging proven Ethernet technology.

This change in technology has brought huge benefits from an operational point of view, but it has also exposed utilities to the kind of cybersecurity threats that have been confronting traditional enterprise systems for years. Cybersecurity is an essential component of modern networks, but fragmented access policies across network devices risk exposing critical vulnerabilities.

Careless practices make system access easy

The heterogeneous nature of automation networks has complicated tasks such as revoking staff credentials, or changing default passwords. Factory default accounts often remain unchanged after handover from manufacturer to customer, and may even remain unchanged on devices for their entire lifetime. Such practices and unchanged factory default accounts make it easy for an attacker to access devices rapidly and without needing to possess any special skills or knowledge.

Furthermore, most control and network devices provide logging capabilities to record what users have done, but if all actions are performed under the umbrella of a factory default account, then the logged information and audit trail say nothing about who has really performed which actions.

Setting the stage for a possible solution

Control system owners and managers would probably welcome positive answers to the following questions to ensure the security of their systems:

Would you like to manage user accounts easily?
Would you to like to administer new employees’ access and permissions in your company from a central point?
Would you like to be able to remove or disable user credentials quickly from a single central location when an employee leaves your company?
Would you like the changes you made in the central location to be immediately effective on all products from different vendors throughout your organization?
Would you like to eliminate worry about default user accounts remaining active on unmanaged local devices?

The industry strikes back

Following demands from the North American Electric Reliability Corporation – Critical Infrastructure Protection (NERC-CIP) Standards, and many other cybersecurity requirements, the industry is adopting a common path to the future: IEC TS 62351-8: Power systems management and associated information exchange – Data and communications security – Part 8: Role-based access control. This Technical Specification sets out how vendors should implement and provide RBAC and central user account management to their customer base.

Since the arrival of IEC TS 62351-8 in 2011, users have been able to authenticate themselves across their organization to all devices in all networks, with a user-specific and unique user-id and password. Moreover, the addition or removal of users is done centrally, in a single step.

This technology offers not only the central management of user-ids and passwords, but also the management of user permissions by assigning roles to users, depending on their job roles in the organization (RBAC).

Possible solution for a nightmare scenario

Control systems need to be managed to ensure sustainable infrastructures. Managing a system means continually keeping its devices up-to-date.

The management of a cybersecurity policy can become complex; therefore to be efficient, security managers need support from software applications. A Role Based Access Control system is such an application. RBAC allows responsible persons to be able to manage users and their roles consistently from a central point – even for multiple control systems in different locations.

Not everybody needs to be a system administrator. A common sense approach in cybersecurity management is to grant the fewest possible privileges to every user. A RBAC system based on IEC TS 62351-8 enables the person responsible for security in a company to manage users for the entire system and assign roles to those users from one place.

IEC 62351 is a series of technical security International Standards that aims to secure power system-specific communication protocols such as IEC 61850 or IEC 60870-5-104. While most parts of the series have been released, more work is needed before systems compliant to IEC 62351 can be put on the market. IEC 62351-8, finalized and published in 2011, defines RBAC for power systems. This is not a new concept; it is in fact part of best practice in many IT systems. The use of RBAC in power systems makes it possible to reduce the number of permissions that have to be assigned to certain users so that these users have only the permissions they need to perform their duties. This reduces the risk to the power system, as permissions are only assigned when they are actually needed, according to the principle of fewest privileges. The standard also defines a list of pre-defined roles (e.g., Viewer, Operator, etc.) and of pre-defined rights.

Adhering to International Standards as closely as possible

To ensure high quality and dependable cybersecurity functionality in heterogeneous installations, it is fundamental to adhere to International Standards as far as possible. A high level of cybersecurity can only be achieved by deploying and using reviewed, approved and standardized technologies and methods, especially when installing devices from different vendors. Utilities not following such a wise path can find themselves locked in to a single supplier offering proprietary solutions.

Cybersecurity cannot be optimized without knowing everything that is going on in the system. Security related events, like access and other user activities in different system components, need to be monitored to identify potential attacks and to optimize protection. Central user activity logs collect cybersecurity related events from the system devices and make the information available to responsible personnel. An efficient and user-friendly approach, such as automatic recognition of event patterns, is a key feature of such monitoring applications.

State of the art cybersecurity products based on International Standards such as IEC TS 62351-8 enable efficient RBAC management of user accounts in multi-vendor control systems. They provide utilities with real-time visibility of the security-relevant user activity within their systems.

Proprietary cybersecurity implementations should be avoided for seamless integration of multi-vendor control systems. The adoption of interoperable solutions that accord to IEC TS 62351-8 makes performing these tasks much easier.

About the authors

Frank Hohlbaum – Security Manager Grid Automation,ABB Switzerland Ltd.

Frank is globally responsible for all aspects of cybersecurity within ABB’s Power System Substations and drives the security activities in this business unit. He is an active member of the Power System Security Council and represents the business unit Power System Substations. Frank Hohlbaum joined ABB in 1996 and has 20 years’ experience in substation automation. Frank is a Member of IEC Technical Committee (TC) 57/Working Group (WG) 3: Telecontrol protocols.

Bart de Wijs – Head of Cybersecurity for ABB's Power Grids Division.

Bart represents this division in the ABB Group Cybersecurity Council, which is a cross-disciplinary team staffed with resources from various corporate functions. Additionally, he is a member of the ABB Cybersecurity Response Team, handling vulnerabilities and incidents. Within the division he leads a team of cybersecurity specialists dealing with the different aspects of all the security-related concerns that could affect ABB customers. He is a member of various cybersecurity expert groups. Between 2007 and 2010 Bart was responsible for cybersecurity in ABB’s Power Generation business unit.

Fernando Alvarez – Cybersecurity Technical Product Manager,ABB Switzerland Ltd.

Fernando is responsible for supporting the development of different cybersecurity technologies in ABB products and for managing and tracking ABB’s cybersecurity intellectual property. He is also an active member of IEC TC57/WG15: Data and communication security, the IEC group working on the IEC 62351 series of International Standards for power systems management and associated information exchange. Previously Fernando worked on securing the internal IT infrastructure of banks and on securing military communications.

ANSI标准化工作

2016-08-26

ANSI通过对标准制定组织（SDOs）认可程序推动美国国家标准（ANS）的制定，这些标准制定组织致力于共同制定国家自愿性协商一致标准。

ANSI认可表明，参与美国国家标准制定的标准制定组织所采用的程序都符合ANSI开放、平衡、协商一致和程序正当的基本要求。

人们经常向ANSI询问美国标准（和标准制定组织）的总数。据估，美国目前有数百个“传统”的标准制定组织 — 90％的标准由20个最大的标准制定组织（SDOs）制定 – 还有数百个“非传统”的标准制定机构，比如财团等。可以看出，美国的标准制定参与程度很高，因为标准制定组织本身所包含的各个委员会中的专家可以用他们的专业技能来满足这些标准的技术要求。

截至2015年，ANSI认可了240多个标准制定机构，制定了11,000多项美国国家标准（ANS）。

根据NIST专有出版物806— 《美国组织的标准活动》（1996年出版，作者罗伯特.B.托特）提供的数据显示，美国制定了93000多个标准，有近700 [1]个组织将制定标准作为自己的活动领域。其中，联邦政府是最大的标准制定者和使用者（制定和使用44000多个标准）;而美国私营部门总共拥有约49,000个标准。

然而，随着1995年《国家技术转让与推动法案》（NTTAA）（公法104-113）的批准，美国开始鼓励联邦机构在可行情况下利用自愿协商一致标准，并适当参与自愿协商一致的标准制定工作。被批准为美国国家标准的标准是满足NTTAA的所有要求。

ANS的过程是经得起推敲的，它保护了所有参与者的权益。实质上， ANS加快了市场接受产品的速度，同时阐明了提高这些产品安全性的途径，从而实现对消费者的保护。

ANS的过程特征包括：

由利益相关方代表组成的团体或“协商一致团体”对所建议的标准达成共识;

对标准草案进行广泛的公开评审

考虑有关协商一致的投票成员和公众评论者所提交的意见并给予回应;

将批准的修改意见纳入标准草案中;

任何参与者若认为标准制定过程不符合ANSI的标准制定正当程序原则，有权提起上诉。

综上所述，为了维护ANSI的认可工作，要求标准制定者始终遵循一套管理协商一致的标准制定协程的要求或程序。这些要求在《ANSI基本要求：美国国家标准制定的正当程序要求》（ANSI Essential Requirements: Due process requirements for American National Standards.）这一文件中有所体现，另外还有一系列指导文件对这些程序进行了进一步阐释。这些指导性文件内容翔实，有助于ANSI认证标准的制定者和参与者了解ANS的制定过程及其影响。

正当程序是确保ANS标准得以在公平、可获得和回应各利益相关者要求的环境中制定的关键。ANS标准和制定过程秉承公开、公正的理念，确保所有的利害相关方都有机会参与到标准的制定中。同时，通过认证的标准制定者必须遵循ANSI的基本要求和其他正当程序保障，从而使公共利益也得到了适当的保障。

数据截至1996年，新的统计数据不可用。欲浏览美国的标准制定者名单，请于ANSI网站的国家标准系统网络（NSSN）：全球标准化资料库（A National Resource for Global Standards）搜索标准制定者的可用目录。

ANSI成员用标准支持美国“儿童眼部健康安全月”

2016-08-26

每年八月是美国“儿童眼部健康安全月”，每年到了这个时候，人们会密切关注任何有可能威胁儿童眼睛健康的因素。通过利用ANSI成员制定的眼部健康标准， ANSI积极支持儿童眼部健康安全呵护活动，并对自己的积极行为表示自豪。

你知道吗？每100名学龄儿童中，就有近25名儿童有眼部健康问题。而定期进行眼部检查则是保障眼部安全的初步措施，通过眼部检查，可排除各种潜在的眼睛健康问题，如色盲症、眼部感染和视力不佳。而视力不佳或将引起头痛、弱视等健康问题。

国际标准化组织为视力不佳人员推出了一套标准: ISO 14534:2011眼科光学——隐形眼镜和隐形眼镜护理产品——基本要求。该项标准对隐形眼镜、隐形眼镜护理产品及其他配件的提出了安全和性能要求。之所以会针对隐形眼镜做标准化规定，是因为隐形眼镜现如今非常流行，是镜框眼镜的常见替代品。该项标准由ISO/TC 172/SC7眼科光学及仪器分技术委员会，以及美国电光学标准理事会制定的，该理事会为ANSI认可的作为美国技术顾问组（TAG）管理机构。

眼镜或隐形眼镜虽不是人人所需，但目前离炎热夏日结束尚有一月有余，佩戴保护型太阳镜保护眼部则对每个人都至关重要。ANSI Z80.3，眼镜科学-非处方眼镜和时尚眼镜基本要求，适用于一切非处方眼镜和时尚眼镜的标准。人们通常出于休闲、服饰搭配和娱乐等目的，佩戴非处方眼镜和时尚眼镜。这项全美通用的眼镜产品标准是由ANSI认可的Z80标准委员会制定。美国视力理事会是Z80秘书处管理部门。

尽管暑期护眼利于避免出现长期眼部健康问题，但在相关标准支持下，相关护目产品能够在孩子开学返校后的各种场合下，如高强度体育活动中保护孩子的眼睛。ASTM F803-1特定体育活动下护目镜标准规范是由ANSI成员和认可的组织ASTM International制定的。该项标准规范里涉及各种类型的护目镜，这些护目镜可极大减少外部环境对眼睛的伤害。

另外，美国防盲协会还为广大父母提供了有关婴儿视力发展的相关信息以及儿童在成长学习过程中的视力发展须知。

DIN发起创新项目资助计划

2016-08-26

DIN and DKE（DIN 和 VDE的德国电气、电子和信息技术协会）共同发起了一项全新的创新理念资助计划。它通过称为“DIN Connect的标准化项目，为创新理念或项目提供资金支持。该项目计划既可加大人们在创新领域的研发力度，同时又可加快创新成果市场化应用进程。任何创新理念或创新活动的成功都离不开民众的信任和市场的欢迎，而民众的信任和市场的欢迎也离不开各类标准的规范作用。凭借自身广泛的国际关系和成熟的基础设施，DIN and DKE为全球范围内潜在客户及合作伙伴们提供了一个参与渠道。创业公司、知名企业、研发组织及各学术机构都受邀提交各自的创新理念或项目。

预计该项目将持续一到两年，每年的项目运营管理成本达35000欧元。而项目目标是，制定一项或多项DIN规范（DIN SPECs）和/或VDE应用指南 (VDE Application Guides)或其他初步的标准化工作成果。

2016年10月31日前是提交创新新理念或项目的截止时间。DIN将根据各创新项目的创新程度、与标准化的相关度以及对德国产业发展效益的提升度等标准，择优选取。待对提交的项目进行内部评估后，DIN拟于2016年11月邀请最优项目的申请人员前往德国进行项目资金申请，并于12月宣布创新项目入围者名单，选定的项目预计于2017年年初启动。

DIN launches innovation funding programme

Innovative ideas can be submitted up to 31 October 2016

DIN and DKE (German Association for Electrical, Electronic & Information Technologies in DIN and VDE) have launched a new funding programme for supporting innovative ideas through standardization called "DIN Connect". The programme will promote R&D in innovative areas and will make it easier to bring results to the market. Standards create trust and market acceptance, which innovations need in order to be successful. With their extensive international contacts and mature infrastructures, DIN and DKE can provide access to global networks of potential customers and partners. Start-ups, established companies, research organizations and academic institutions are invited to submit their ideas.

Projects will last one to two years and will be funded with up to € 35,000 per year for the project management. The objective is to draw up one or more DIN SPECs and/or VDE Application Guides, or other preliminary standardization work results.

Ideas should be submitted by 31 October 2016. Projects will be selected based on their degree of innovation, the benefits for German industry and relevance for standardization. After the submitted project has been reviewed internally by DIN, the applicants with the best ideas will be invited in November to make a full application for funding. The winners will be announced in December and the projects can be initiated at the start of 2017.

信息技术安全-欧洲制造

2016-08-26

2016年6月30日，DIN-信息技术安全协调办公室（KITS）在德国柏林举行了第三届信息技术安全协调会议。在会上，欧盟委员会增长总司（ DG GROWTH）单一市场政策、法规及实施处主任克斯汀•罗娜（Kerstin Jorna）表示：“互联网安全是实现数字化的基础和前提”。

会议的口号是：“使数字化更加安全”。本届KITS会议有来自工商企业、政界及科研机构的70余人参加，再次取得巨大成功。主题发言和小组讨论涉及信息技术安全的方方面面。与会嘉宾指出，由于该议题相当复杂，若要实现市场透明之目标，我们必须采取特别措施。另外，基于标准和规范的标签和认证也能为此目标提供助力。“信息技术安全—欧洲制造”品牌效应同样也能为信息技术安全定下正确的基调。

不过，大家都有这样一个共识：包括专业用户、消费者等各类市场经济主体的携手共同努力才是实现信息技术安全的唯一途径。要想实现信息技术安全之目标，不仅需要基于协商一致的标准，也需要得到诸如DIN-信息技术安全协调办公室(KITS)这样的跨行业组织的协助。

会上讨论的其它主题包括欧洲安全市场分化现象以及全新的欧洲资金规划等，同时也强调通过具体的保护文件来评估信息技术安全状况。但问题是，目前这种保护文件缺乏相关基础，因此急需信息技术安全这样的标准。而且，为制定出一套缜密并且可供多方使用的信息技术安全标准，必须更加有效地将“信息技术安全设计”理念付诸实施。对此，与会专家一致认为，急需一批专业知识过硬的信息技术安全专家，还讨论了信息技术安全在教育和培训行业面临的多种挑战。感谢美国思科集团、德国itWatch GmbH公司和Siemens的大力支持，本次会议这才顺利召开。

专家们无不热切盼望明年再次召开该会议，预计明年的会议同样将取得巨大成功。关于2017年会议相关信息以及历届会议精彩回顾，敬请访问：www.kits-konferenz.de.

IT security "Made in Europe"

2016 KITS Conference

"Cybersecurity is the foundation upon which digitalization is being built" said Kerstin Jorna, Director of the European Commission's Single Market Policy, Regulation and Implementation, DG GROWTH, at the third Conference held by DIN's IT Security Coordination Office (KITS) on 30 June 2016 in Berlin.

The motto of the conference was "Make digitalization more secure!". This year's KITS conference was again a resounding success, with over 70 participants from industry, politics and research. Lectures and panels covered various aspects of IT security. The participants pointed out that because this topic is so complex, special efforts will have to be taken to achieve the necessary transparency on the market. Labels and certificates based on standards and specifications can help, and an "IT Security – Made in Europe" branding can help set the right tone.

But everyone agreed on one thing: IT security can only be achieved with the help of all economic players, including professional users and consumers. This requires consensus-based standards and the assistance of cross-sectoral organizations such as DIN's IT Security Coordination Office (KITS).

Other topics addressed at the conference include the fragmentation of the European security market and new European funding programmes. It was stressed that it must be possible to measure IT security on the basis of concrete protection profiles. But there is currently no basis for such profiles, and thus standards are desperately needed. Also, the concept of "IT security by design" needs to be implemented more effectively to achieve a thorough, interoperable IT security. Experts agreed that there is a great need for competent specialists, and they discussed the challenges of including IT security in training and education. The conference was made possible by contributions from CISCO, itWatch GmbH and Siemens.

Experts are looking forward to next year's conference, which should be just as successful as this year's. Information on the 2017 KITS Conference 2017 and impressions of past conferences can be found at www.kits-konferenz.de.

欧盟委员会与相关企业就网络安全签署协议，积极应对网络安全威胁

2016-08-26

今日，欧盟委员会建立了一项新的公私合作伙伴关系，这项公私合作关系有望在2020年之前带来18亿欧元的投资。该合作关系是一系列改善欧洲反网络攻击基础设施和加强欧洲网络安全领域的竞争力的新倡议中的一部分。

一项近期的调查显示，去年至少有超过80%的欧洲公司经历过至少一起网络安全事件，2015年全球各行业所遭遇的网络安全事件上升38%。这对众多大小型欧洲公司造成损害，同时这个威胁也让欧洲电子经济领域的信誉受损。作为欧洲数字化单一市场策略的一部分，委员会想加强跨境合作以及与在网络安全方面积极行动的行业和部门之间的合作，旨在在欧盟范围内帮助开发既具有创新性又有安全性的技术、产品和服务。

数字化一体市场副委员长安德鲁斯.安西普说道：“没有信任和安全，就没有数字化一体市场。欧洲必须准备好应对日益严峻且跨境流动的网络安全威胁。我们正在计划具体措施来加强欧洲应对这类攻击的快速恢复能力，保证建设和扩大电子经济的能力。”

数字经济与社会委员会委员京特•H•厄廷格说：“欧洲需要高质量，经济和彼此协作的网络安全的产品和服务。对于欧洲的网络安全产业来说，现在有一个很好的机遇使我们能在快速发展的全球市场中竞争。我们呼吁成员国和所有网络安全相关市场主体加强合作，凝聚知识、信息专业技能，以此来提高欧洲网络弹性。今日签订的网络安全伙伴关系对于该领域来说也是一大进步，具有里程碑式的意义。

如今的行动计划包括第一个欧洲公私网络安全合作伙伴关系的确立。欧盟将在其研究和创新项目计划“地平线2000”下，对此项合作投资4.5亿欧元。以欧洲网络安全组织 (ECSO)为代表的欧洲网络安全市场主体的投资金额有望达到其三倍。该合作伙伴关系同时也将包括来自各国、各地区以及地方的公共管理机构、研究中心和学术界人士，旨在促进研究和创新早期阶段的合作，为能源、卫生、交通和金融等领域的网络安全问题提供解决方案。厄廷格委员今日与ECSO在斯特拉斯堡签署了这项伙伴关系。(照片和视频将于中欧时间12点公布)

欧盟委员会还制定不同措施来解决欧盟网络安全市场分化的问题。目前一个通信技术公司可能要通过不同的认证程序才能向一些成员国销售它的产品和服务。因此委员会将研究针对信息通信技术安全产品建立一个可行的欧洲认证框架。

大量的欧洲创新型中小企业在利基市场（如密码学）和存在新型商业模式的完善市场（如杀毒软件）涌现，但是他们往往无法扩大业务规模。欧盟委员会希望能够减轻网络安全领域小型企业的融资问题，并将在欧盟投资计划下探索不同的融资途径。

欧洲议会拟批准《网络和信息安全指令》，欧盟依据该指令已经建立了一个计算机安全事件应对小组，以快速回应网络安全威胁和事故。同时各成员国之间还将建立“合作小组”，支持并促进战略合作和信息互换，提升信任和信心。欧盟委员会还呼吁各成员国充分利用这些新的机制，尽可能加强协调配合。欧盟委员会将提出方法加强大型网络安全事件中的跨境合作。鉴于网络安全领域的发展速度，委员会也将对欧盟网络和信息安全局进行评估。此项评估包括欧盟网络和信息安全局的授权范围和能力是否足以完成其职责，即是否可以协助成员国提升其网络应对能力。委员会还将对如何不同经济部门之间的加强和简化网络安全合作进行研究，其中就包括网络安全培训和教育。

背景：

行动计划的根据主要来自2015年《数字化单一市场策略》，2013年《欧盟网络安全策略》，以及即将确定的《网络和信息安全指令》，是基于欧洲安全议程对话以及《打击混合威胁》提出的。

European Commission – Press release

Commission signs agreement with industry on cybersecurity and steps up efforts to tackle cyber-threats

Brussels, 5 July 2016

The Commission today launches a new public-private partnership on cybersecurity that is expected to trigger €1.8 billion of investment by 2020. This is part of a series of new initiatives to better equip Europe against cyber-attacks and to strengthen the competitiveness of its cybersecurity sector.

According to a recent survey, at least 80% of European companies have experienced at least one cybersecurity incident over the last year and the number of security incidents across all industries worldwide rose by 38% in 2015. This damages European companies, whether they are big or small, and threats to undermine trust in the digital economy. As part of its Digital Single Market strategy the Commission wants to reinforce cooperation across borders, and between all actors and sectors active in cybersecurity, and to help develop innovative and secure technologies, products and services throughout the EU.

Andrus Ansip, Vice-President for the Digital Single Market, said: "Without trust and security, there can be no Digital Single Market. Europe has to be ready to tackle cyber-threats that are increasingly sophisticated and do not recognise borders. Today, we are proposing concrete measures to strengthen Europe's resilience against such attacks and secure the capacity needed for building and expanding our digital economy."

Günther H. Oettinger, Commissioner for the Digital Economy and Society, said: "Europe needs high quality, affordable and interoperable cybersecurity products and services. There is a major opportunity for our cybersecurity industry to compete in a fast-growing global market. We call on Member States and all cybersecurity bodies to strengthen cooperation and pool their knowledge, information and expertise to increase Europe's cyber resilience. The milestone partnership on cybersecurity signed today with the industry is a major step ."

Today's action plan includes the launch of the first European public private partnership on cybersecurity. The EU will invest €450 millionin this partnership, under its research and innovation programme Horizon 2020. Cybersecurity market players, represented by the European Cyber Security Organisation (ECSO), are expected to invest three times more. This partnership will also include members from national, regional and local public administrations, research centres and academia. The aim of the partnership is to foster cooperation at early stages of the research and innovation process and to build cybersecurity solutions for various sectors, such as energy, health, transport and finance. Commissioner Oettinger today signs the partnership with the ECSO in Strasbourg (photos and videos to be available at around 12.00 CET).

The Commission also sets out different measures to tackle the fragmentation of the EU cybersecurity market. Currently an ICT company might need to undergo different certification processes to sell its products and services in several Member States. The Commission will therefore look into a possible European certification framework for ICT security products.

A myriad of innovative European SMEs have emerged in niche markets (e.g. cryptography) and in well-established markets with new business models (e.g. antivirus software), but they are often unable to scale up their operations. The Commission wants to ease access to finance for smaller businesses working in the field of cybersecurity and will explore different options under the EU investment plan.

The Network and Information Security Directive, which is expected to be adopted by the European Parliament tomorrow, already creates a network of Computer Security Incident Response Teams across the EU in order to rapidly react to cyber threats and incidents. It also establishes a ‘Cooperation Group’ between Member States, to support and facilitate strategic cooperation as well as the exchange of information, and to develop trust and confidence. The Commission today calls on Member States to make the most of these new mechanisms and to strengthen coordination when and where possible. The Commission will propose how to enhance cross-border cooperation in case of a major cyber-incident. Given the speed with which the cybersecurity landscape is evolving, the Commission will also bring forward its evaluation of the European Union Agency for Network and Information Security (ENISA).This evaluation will assess whether ENISA's mandate and capabilities remain adequate to achieve its mission of supporting EU Member States in boosting their own cyber resilience. The Commission also examines how to strengthen and streamline cybersecurity cooperation across different sectors of the economy, including in cybersecurity training and education.

Background

Today's action plan finds its main roots in the 2015 Digital Single Market strategy, the 2013 EU Cybersecurity strategy and the forthcomingNetwork and Information Security (NIS) Directive. It builds on the recent Communications on Delivering the European Agenda on Security andCountering Hybrid Threats.