2018-工业物联网：安全与保密协议（英文版）

报告摘要

Industrial Internet of Things (IIoT) Safety and Security Protocol Summary

Core Content

The Industrial Internet of Things (IIoT) is a rapidly growing sector that has the potential to transform industries and economies globally. However, its expansion also introduces significant safety and security risks, particularly due to its interconnected nature and complex system design. The World Economic Forum (WEF) has developed a Safety and Security Protocol to address these challenges by promoting collective responsibility and collaborative governance among stakeholders.

The Protocol is designed to align the behavior of users, manufacturers, and implementers with broader public-interest goals of safety and security. It emphasizes the role of insurance as a market-based incentive mechanism to encourage better security practices, including the development of differentiated premium programs and risk mitigation strategies.

Main Points and Key Information

1. IIoT Overview and Importance

IIoT is a subset of IoT focused on industrial and business environments.
It has the potential to transform manufacturing, energy, agriculture, transport, and other sectors, contributing to $14.2 trillion in global economic value by 2030.
Unlike consumer IoT, IIoT systems are integrated into larger operational systems, creating significant interdependencies and complex security challenges.

2. Security Challenges in IIoT

IIoT systems are vulnerable to cyber-physical threats, which can lead to public safety risks, physical harm, and systemic attacks.
Legacy devices and inadequate security features in IoT components contribute to vulnerability.
Recent cyberattacks, such as the Mirai botnet and Ukrainian power grid incidents, have demonstrated the catastrophic impact of IIoT insecurity.

3. The Role of Insurance

Insurance is a key stakeholder in IIoT security, as it can influence behavior through premiums, incentives, and penalties.
The Protocol aims to leverage insurance to promote active hardening of IIoT systems and to validate security practices.
Insurance can be used to differentiate risk levels and encourage compliance with security standards.

4. Protocol Objectives

To improve the security of IIoT devices and systems.
To align stakeholder behavior with public safety and security goals.
To create incentives for better security practices through insurance mechanisms.
To establish a framework for risk assessment, mitigation, and response.

Key Requirements for the Protocol

A. Line of Business IIoT Device Safeguards

Risk-assessment models must be used to identify digital and physical assets, threat agents, and vulnerabilities.
Segmentation of systems is required to logically isolate sub-systems and restrict access.
Device integrity and availability must be ensured through CIA (Confidentiality, Integrity, Availability) models.
Encryption of data in transit and at rest is mandatory.
Patches and updates must be implemented with trusted delivery mechanisms.
Privacy of personally identifiable information must be protected through encryption.
Interoperability is required using standard protocols and ports.
Secure software development lifecycle (SDLC) must be followed, including testing, threat modeling, and source code management.
Root of trust mechanisms should be established to define secure communication paths.
Vulnerability disclosure processes must be in place to coordinate responses to external security reports.

B. Internal Governance and Risk Management

Entities must have internal governance and risk management mechanisms.
These include executive oversight, annual risk reviews, and audit processes.
Risk management should be integrated into overall strategy, culture, IT, and OT.
Procedures must be in place to detect, mitigate, verify, and manage security risks throughout the system lifecycle.

C. Record-Keeping and Metrics

Record-keeping and metrics are essential for tracking security performance and identifying vulnerabilities.
Metrics should be transparent and actionable, supporting continuous improvement and compliance verification.

Implementation and Impact

The Protocol requires active participation from key stakeholders across the IIoT ecosystem.
Public-private partnerships are encouraged to enhance critical infrastructure protection.
The Protocol aims to realign demand and supply-side economics through insurance-based incentives.
It also promotes preventive cybersecurity approaches, rather than reactive measures.
New frameworks and principles are being developed to address IIoT security gaps and improve user awareness.

Conclusion

The IIoT Safety and Security Protocol is a comprehensive framework designed to enhance the security and reliability of industrial internet systems. It emphasizes collective responsibility, multistakeholder collaboration, and the integration of insurance mechanisms to drive positive behavioral change. By promoting standardized practices, risk assessment, and transparent governance, the Protocol aims to minimize the impact of security breaches and support the sustainable growth of the IIoT sector.