中圖分類號： TP393
文獻標識碼： A
DOI： 10.19358/j.issn.2096-5133.2021.09.010
引用格式： 周磊，姜雙林，饒志波. 工業控制系統漏洞補丁應用策略研究[J].信息技術與網絡安全，2021，40(9)：58-65.

Research on patching strategy of industrial control system vulnerability

Abstract： There are key differences between industrial control system(ICS) network assets and enterprise network assets. Compared with IT security patching, ICS security patching faces a series of significant challenges such as vulnerability identification, patch development, patch validation, and patching decision-making. In this paper，firstly, the basic process of ICS vulnerability management is introduced. Secondly, the limitations of the common vulnerability scoring system(CVSS) when it is used as the decision-making tool of ICS security patching are analyzed. Then four methods based decision tree in ICS security patching are introduced and their advantages are compared. Finally, a feasible practice to ICS vulnerability management is proposed.

Key words : industrial control system(ICS)；cyber security；vulnerability；patch；decision-tree