발전제어시스템 악성코드 방어를 위한 보안관제 모델 연구

국문 초록 (Abstract)

발전제어시스템은 발전소별, 발전호기별 독립 폐쇄망으로 구성되어 있는 특성과 준공이후 이용기간이 종료되는 시점까지 장기간 제조사에 종속되어 있는 기술적 환경 등으로 인해 변화하는 사이버위협에 대해 능동적인 정보보호 대책 적용의 어려움이 존재했으나, 최근에는 설비전용 임베디드 운영체제가 아닌 범용 프로토콜과 Windows 기반의 운영체제를 이용한 제어시스템 도입 비율이 높아지고 있어, 업무망 및 인터넷망에 적용된 범용적인 보안기술을 활용하여 제조사의 기술적 종속을 우회할 수 있는 정보보호기술 적용이 가능한 환경으로 변하고 있는 추세이다.

독립 폐쇄망으로 운영하는 환경임에도 불구하고 경영활동을 위하여 업무시스템에서 제어시스템 운영 데이터를 활용하는 빈도수가 증가되고 있다. 필요한 데이터 확보를 위하여 일방향 자료 전송장치를 이용하여 업무망과 연결되어 데이터를 제공하고 있으며 이는 독립 폐쇄망이 외부 네트워크와의 연결되는 접점이 되고 있다. 또한, Windows 기반 운영환경이 증가함에 따라 OS 보안패치나 제어시스템 패치를 위하여 외부파일을 반입하여 작업하는 사례들이 빈번하게 이루어지면서 사이버 보안위협에 대한 새로운 노출요소가 되고 있다.

따라서, 산업제어시스템(Industrial Control System) 분야도 이러한 새로운 사이버 위협에 능동적으로 대처해야 해야 한다. 본 논문에서는 독립 폐쇄망으로 운영되고 있지만 여전히 외부 공격자들의 주요 사이버 공격 목표가 되고 있는 발전제어시스템을 대상으로 네트워크 기반의 포렌식 기술을 이용하여 제어시스템 네트워크 패킷 데이터에 대해 수집·분석하는 보안관제 모델을 제시하고자 한다.

목차 (Table of Contents)

• 제 1 장 서 론 ································································································· 1
• 제1절 연구의 목적 ························································································ 1
• 제2절 연구의 범위 및 방법 ········································································ 2
• 제 2 장 발전제어시스템 이해 및 정보보호 현황 ·································· 4
• 제1절 발전제어시스템 운영 환경······························································ 4
• 1. 발전제어시스템의 이해 ······································································· 4
• 2. 발전제어시스템의 네트워크 구성····················································· 5
• 제2절 발전제어시스템 보안관리 현황······················································ 9
• 1. 제어시스템 보안기술··········································································· 9
• 가. White listing 탐지 방법 ······························································· 9
• 나. 시그니처(Signature) 탐지 방법 ·················································· 9
• 다. 이상행위(Anomaly) 탐지 방법················································· 10
• 라. 산업용 방화벽을 이용한 탐지 방법········································· 11
• 2. 제어시스템 보안제품········································································· 12
• 가. 침입탐지시스템············································································· 12
• 나. 제어시스템 방화벽······································································· 13
• 다. 일방향 전송장치··········································································· 13
• 라. 기타 보안제품··············································································· 14
• 3. 제어시스템 보안관리 현황 ·································································14
• 제3절 발전제어시스템 정보보호 정책 적용 문제점······························16
• 1. IT시스템과 제어시스템의 차이························································17
• 2. 정보보호 적용 문제점·········································································19
• 제 3 장 발전제어시스템 보안위협 ·······························································21
• 제1절 산업제어시스템 공격사례 분석······················································21
• 1. 산업제어시스템 특유의 취약점을 이용한 공격사례 ·····················22
• 2. 악성코드를 이용한 산업제어시스템 공격사례·······························24
• 제2절 발전제어시스템 보안위협 및 위협 시나리오······························28
• 1. 발전제어시스템의 사이버 위협 대상 ···············································28
• 2. 보안위협 시나리오···············································································29
• 제 4 장 발전제어시스템 보안관제 모델 ····················································31
• 제1절 보안관제 모델 수립을 위한 현황 분석 ··········································31
• 1. 보안관제 모델 수립 전제조건···························································31
• 2. 실험대상 구간 선정·············································································32
• 제2절 실험결과 분석 ······················································································34
• 1. 발전제어시스템 네트워크 프로토콜·················································34
• 2. 네트워크 패킷 분석·············································································35
• 제3절 보안관제 모델 설계 ············································································39
• 1. 수집 데이터의 분석 요건 ···································································40
• 2. 보안관제 모델·······················································································43
• 제 5 장 결 론 ···································································································47
• 참고문헌 ···············································································································48