中图分类号： TP393
文献标识码： A
DOI： 10.19358/j.issn.2096-5133.2021.09.010
引用格式： 周磊，姜双林，饶志波. 工业控制系统漏洞补丁应用策略研究[J].信息技术与网络安全，2021，40(9)：58-65.

Research on patching strategy of industrial control system vulnerability

Abstract： There are key differences between industrial control system(ICS) network assets and enterprise network assets. Compared with IT security patching, ICS security patching faces a series of significant challenges such as vulnerability identification, patch development, patch validation, and patching decision-making. In this paper，firstly, the basic process of ICS vulnerability management is introduced. Secondly, the limitations of the common vulnerability scoring system(CVSS) when it is used as the decision-making tool of ICS security patching are analyzed. Then four methods based decision tree in ICS security patching are introduced and their advantages are compared. Finally, a feasible practice to ICS vulnerability management is proposed.

Key words : industrial control system(ICS)；cyber security；vulnerability；patch；decision-tree