오늘날 대부분의 국내 석유화학 산업에서 사용되고 있는 공정제어시스템은 Windows 플랫폼 기반을 사용하고 있다. 개방형 기술에 따른 위험 노출이 증가하고 있지만, 사이버 공격에 대한 인식 부족과 오해로 인해 각종 사이버 공격에 대비하는 기업이 많지 않다. 본 연구는 석유화학 공정제어시스템이 OT 사이버보안 취약성에 얼마나 노출된 상태에서 운영 중인지를 조사하였으며, 보안 취약점을 감소시킬 수 있는 현실적인 방법을 제시하고자 하였다. 공정제어시스템의 사이버 위협 상태를 확인하기 위하여, 주요 사이버 위협 인자인 Windows 플랫폼에 대한 취약점을 확인하였으며 이를 위하여 국내 주요 3개 DCS 공급자와 635개 시스템의 Windows 플랫폼 단종 여부를 조사하였다. 조사결과 조사 대상의 77.5%가 아직도 이미 단종된 Windows 플랫폼으로 운영 중인 것으로 확인되어 공정제어 시스템이 보안 위협에 취약한 상태로 운영 중인 것으로 확인되었다. 이러한 사이버 위협에 능동적으로 대처하기 위해서는 미국과 같은 선진국에서 시행하고 있는 주요 석유화학 시설에 대한 중요기반시설 지정과 같은 법률적인 규제가 필요할 것으로 판단되며, 기존 DCS 공급자가 제공하는 보안 솔루션을 적극적으로 도입하여 공정제어시스템에 대한 보안 위협을 적극적으로 감소시키려는 노력이 필요한 시점이라고 판단된다.

Process control systems used in most domestic petrochemical corporates today are based on the Windows platforms. As technology leans toward opened environment, the exposure risk of control systems is increasing. However, not many companies are preparing for various cyberattacks due to lack of awareness and misunderstanding of cyber intrusion. This study investigated the extent of how much exposed the petrochemical process control system is to security threats and suggested practical measures to reduce OT cybersecurity vulnerabilities. To identify the cyber threat status of process control systems, vulnerabilities of the Windows platform, a principal cyber threat factor, have been analyzed. For research, three major DCS providers in Korea and the discontinuation of Windows platform of 635 control systems were investigated. It was confirmed that 78% of the survey subjects were still operating in the discontinued windows platforms, and those process control systems were operated in a state vulnerable to cyber intrusions. In order to actively cope with these cyber threats, legal regulations such as designation of critical infrastructure for major petrochemical facilities which is implemented in advanced countries such as the United States are needed. Additionally, it is necessary to take the initiative in eradicating security threats to the process control systems by aggressively introducing security solutions provided from existing DCS suppliers. This paper was submitted to Professor Ko JaeWook's retirement anniversary issue.

OT Cybersecurity Vulnerability Windows platform DCS (Distributed Control System) Critical infrastructure

Lee JM, “Security Vulnerability Management in Industrial Control System (ICS) Environment and Its Limitations; (2018).
Kim DH, Korea Institute Electronc Commuication Science, 9(1), 140 (2014)
Park MH, Yoo JY, Korea Institute Information Decurity Cryptology, 27(1), 165 (2017)
Oh HJ, Yoo YI, Lee KH, Korea Institute Information Decurity Cryptology, 27(2), 5 (2017)
Beyond Trust Microsoft – Vulnerabilities – Report, 4,7,12(2021).
Korea Inernet & Security Agency (Accessed 06 Sep 2021).
Security News on Security World Magazine (Accessed 01 Sep 2021).
Security News on Security World Magazine (Accessed 20 Aug 2021).
Ackerman P, Kim JW, Lee DK, “Industrial Control System Cybersecurity,”Acorn Publishing, 207(2021).
Lipson HF, Ph. D. “Tracking and Tracing Cyber-Attacks: Techincal Challenges and Global Policy Issues,”CERT Coordination Center 24(2002).
Kaspersky Lab, Industrial Control System Vulnerabilities Statistics, 12(2015).
Center for Chemical Process Safety(CCPS) Guideline for Analyzing and Managing the Security Vulnerabilities of Fixed Chemical Sites (2003).
Korea Inernet & Security Agency (Accessed 3rd Sep 2021).
Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0 National Institute of Standards Technology. Feb. 2014.
Ministry of Science and ICT public notice 2021-28, 2021-103 Partial revision of the criteria for the analysis and evaluation of technical vulnerabilities in major information and communication infrastructure.