performing-scada-hmi-security-assessment

执行 SCADA HMI 安全评估

何时使用

• 评估 SCADA/DCS 环境中 HMI 系统的安全态势时
• 评估基于 Web 的 HMI 界面是否存在常见 Web 漏洞时
• 审计 HMI 的身份验证、授权和会话管理时
• 测试 HMI 与 PLC/RTU 之间的通信安全时
• 准备 IEC 62443 或 NERC CIP 合规性评估时

不要使用于在没有维护窗口和回滚计划的情况下测试活跃生产环境中的 HMI，用于 PLC 级协议分析（参见 performing-s7comm-protocol-security-analysis），或用于非 OT 系统上的通用 Web 应用测试。

前提条件

• 包含供应商、版本和网络配置详细信息的 HMI 系统清单
• 镜像生产 HMI 设置的实验室或测试环境（主动测试首选）
• 在维护窗口期间进行测试的工厂运营授权
• NIST SP 800-82 和 IEC 62443 安全要求文档
• HMI 到 PLC 通信网段上的网络捕获能力

工作流

第 1 步：评估 HMI 攻击面

#!/usr/bin/env python3
"""SCADA HMI Security Assessment Tool.

Evaluates HMI security across authentication, communication,
configuration, and web interface categories aligned with
IEC 62443 and NIST SP 800-82 requirements.
"""

import json
import sys
from datetime import datetime
from typing import Dict, List

try:
    import requests
except ImportError:
    print("Install requests: pip install requests")
    sys.exit(1)


class HMISecurityAssessment:
    """Performs security assessment of SCADA HMI systems."""

    def __init__(self, hmi_info: dict):
        self.hmi_info = hmi_info
        self.findings = []
        self.checks_run = 0
        self.checks_passed = 0

    def check_authentication(self):
        """Assess HMI authentication mechanisms."""
        checks = [
            {
                "id": "AUTH-01",
                "name": "Password complexity enforcement",
                "iec62443_ref": "ISA-62443-3-3 SR 1.7",
                "description": "HMI must enforce minimum password complexity requirements",
                "test": "Verify minimum length >= 8, complexity rules, history >= 5",
            },
            {
                "id": "AUTH-02",
                "name": "Account lockout policy",
                "iec62443_ref": "ISA-62443-3-3 SR 1.11",
                "description": "HMI must lock accounts after failed login attempts",
                "test": "Verify lockout after 5 failed attempts, lockout duration >= 15 min",
            },
            {
                "id": "AUTH-03",
                "name": "Default credentials changed",
                "iec62443_ref": "ISA-62443-3-3 SR 1.5",
                "description": "All default vendor credentials must be changed",
                "test": "Attempt login with known vendor defaults (admin/admin, operator/operator)",
            },
            {
                "id": "AUTH-04",
                "name": "Role-based access control",
                "iec62443_ref": "ISA-62443-3-3 SR 2.1",
                "description": "HMI must separate operator, engineer, and admin roles",
                "test": "Verify operator role cannot access engineering functions",
            },
            {
                "id": "AUTH-05",
                "name": "Session timeout enforcement",
                "iec62443_ref": "ISA-62443-3-3 SR 1.12",
                "description": "HMI sessions must time out after inactivity",
                "test": "Verify session timeout <= 15 minutes for operator, <= 5 for admin",
            },
            {
                "id": "AUTH-06",
                "name": "Multi-factor authentication for remote access",
                "iec62443_ref": "ISA-62443-3-3 SR 1.13",
                "description": "Remote HMI access requires MFA",
                "test": "Verify MFA is enforced for all non-local HMI connections",
            },
        ]

        print(f"\n--- AUTHENTICATION ASSESSMENT ---")
        for check in checks:
            self.checks_run += 1
            print(f"  [{check['id']}] {check['name']}")
            print(f"    Ref: {check['iec62443_ref']}")
            print(f"    Test: {check['test']}")

    def check_communication_security(self):
        """Assess HMI-to-PLC communication security."""
        checks = [
            {
                "id": "COMM-01",
                "name": "Encrypted HMI-PLC communication",
                "description": "Traffic between HMI and PLCs should use encrypted protocols (OPC UA with TLS)",
                "test": "Capture HMI-PLC traffic and verify encryption (Wireshark TLS handshake)",
            },
            {
                "id": "COMM-02",
                "name": "HMI write command authentication",
                "description": "Write commands from HMI to PLC should be authenticated",
                "test": "Verify that write operations require operator confirmation/authentication",
            },
            {
                "id": "COMM-03",
                "name": "Web HMI uses HTTPS",
                "description": "Web-based HMI interfaces must use TLS 1.2+ with valid certificates",
                "test": "Check TLS version, cipher suites, certificate validity",
            },
            {
                "id": "COMM-04",
                "name": "No cleartext protocols in use",
                "description": "Telnet, FTP, HTTP must not be used for HMI access or management",
                "test": "Port scan HMI for cleartext protocol services",
            },
        ]

        print(f"\n--- COMMUNICATION SECURITY ASSESSMENT ---")
        for check in checks:
            self.checks_run += 1
            print(f"  [{check['id']}] {check['name']}")
            print(f"    Test: {check['test']}")

    def check_web_hmi_security(self):
        """Assess web-based HMI for common web vulnerabilities."""
        hmi_url = self.hmi_info.get("url", "")
        if not hmi_url:
            print(f"\n  [SKIP] No web HMI URL provided")
            return

        checks = [
            {
                "id": "WEB-01",
                "name": "Cross-Site Scripting (XSS)",
                "owasp": "A7:2017",
                "test": "Test input fields with XSS payloads in tag names, alarm messages",
            },
            {
                "id": "WEB-02",
                "name": "Cross-Site Request Forgery (CSRF)",
                "owasp": "A8:2013",
                "test": "Verify CSRF tokens on state-changing operations (setpoint changes)",
            },
            {
                "id": "WEB-03",
                "name": "Insecure Direct Object References",
                "owasp": "A4:2013",
                "test": "Manipulate URL parameters to access other users HMI views",
            },
            {
                "id": "WEB-04",
                "name": "Security Headers",
                "test": "Verify X-Frame-Options, CSP, X-Content-Type-Options headers",
            },
            {
                "id": "WEB-05",
                "name": "Privileged file system access (CVE-2025-0921)",
                "test": "Check Ignition SCADA for privileged file system vulnerability via project files",
            },
        ]

        print(f"\n--- WEB HMI SECURITY ASSESSMENT ---")
        print(f"  Target: {hmi_url}")
        for check in checks:
            self.checks_run += 1
            print(f"  [{check['id']}] {check['name']}")
            print(f"    Test: {check['test']}")

    def check_hardening(self):
        """Assess HMI operating system and application hardening."""
        checks = [
            {
                "id": "HARD-01",
                "name": "OS patch level",
                "test": "Verify HMI OS is patched within SLA (typically 90 days for OT)",
            },
            {
                "id": "HARD-02",
                "name": "Unnecessary services disabled",
                "test": "Verify no unnecessary network services running (RDP if not needed, SMB, etc)",
            },
            {
                "id": "HARD-03",
                "name": "USB port restrictions",
                "test": "Verify USB mass storage is blocked on HMI terminals",
            },
            {
                "id": "HARD-04",
                "name": "Application whitelisting",
                "test": "Verify only authorized HMI applications can execute",
            },
            {
                "id": "HARD-05",
                "name": "Audit logging enabled",
                "test": "Verify operator actions, login events, and setpoint changes are logged",
            },
        ]

        print(f"\n--- HMI HARDENING ASSESSMENT ---")
        for check in checks:
            self.checks_run += 1
            print(f"  [{check['id']}] {check['name']}")
            print(f"    Test: {check['test']}")

    def generate_report(self):
        """Generate assessment report."""
        self.check_authentication()
        self.check_communication_security()
        self.check_web_hmi_security()
        self.check_hardening()

        print(f"\n{'='*70}")
        print("SCADA HMI SECURITY ASSESSMENT SUMMARY")
        print(f"{'='*70}")
        print(f"Date: {datetime.now().isoformat()}")
        print(f"HMI: {self.hmi_info.get('name', 'Unknown')}")
        print(f"Vendor: {self.hmi_info.get('vendor', 'Unknown')}")
        print(f"Version: {self.hmi_info.get('version', 'Unknown')}")
        print(f"Total Checks: {self.checks_run}")
        print(f"Findings: {len(self.findings)}")


if __name__ == "__main__":
    assessment = HMISecurityAssessment(hmi_info={
        "name": "Plant-HMI-01",
        "vendor": "Siemens WinCC",
        "version": "7.5 SP2",
        "ip": "10.10.2.10",
        "url": "https://10.10.2.10:8080",
        "os": "Windows 10 LTSC 2021",
    })
    assessment.generate_report()

关键概念

术语	定义
HMI	人机界面，为操作员提供工业流程的可视化表示和控制
Web HMI	可通过 HTTP/HTTPS 访问的基于浏览器的 HMI 界面，受标准 Web 漏洞影响
设定值	操作员可通过 HMI 更改的流程变量目标值；未经授权的更改可能导致流程异常
报警抑制	攻击者禁用或隐藏 HMI 报警以掩盖恶意流程操纵的技术
WinCC	西门子 SCADA/HMI 软件，广泛部署在制造业和流程工业中
CVE-2025-0921	Ignition SCADA 特权文件系统漏洞，可通过恶意项目上传利用

输出格式

HMI SECURITY ASSESSMENT REPORT
=================================
Date: YYYY-MM-DD
HMI: [name] | Vendor: [vendor] | Version: [version]

FINDINGS BY CATEGORY:
  Authentication: [pass/fail count]
  Communication: [pass/fail count]
  Web Security: [pass/fail count]
  Hardening: [pass/fail count]

CRITICAL FINDINGS:
  1. [finding with remediation]

COMPLIANCE STATUS:
  IEC 62443 SL-T: [target level]
  IEC 62443 SL-A: [achieved level]