An Approach to Identifying Information Security Threats Relevant and Specific for a Universal Industrial Controller

Abstract

Determining current threats to information security for a certain object of assessment, as a rule, should be carried out according to the Methodology for Assessing Security Threats, approved on February 5, 2021 as a methodological document of the FSTEC of Russia. This article shows that, provided that the main element of the assessment object, e.g., OS, (which implements the main mechanisms of the subsystem for protecting information from unauthorized access) and for which there is a security profile introduced in the established order, the list of typical security threats can also be obtained from the analysis of this document. Comparison of information security threats obtained from the security profile of operating systems of type “B” of the 4^th security class, with a list of information security threats obtained from the FSTEC of Russia Database based on the expert method, after optimizing this list and the exclusion of repeated threats from it, shows that the remaining threats are in certain correspondence with the threats from the security profile with some detail on their implementation.