{"schema":"hottub-news/story/v1","story":"st_gfdjjlfyb2lzji2qmmua","title":"NIST公布OT安全指南草案，CISA與FBI示警第三方ICS整合商風險","title_en":"NIST releases draft OT security guidelines, CISA and FBI warn of third-party ICS integration risks","outlets":1,"brief":null,"page":"https://hottub.news/stories/nist-releases-draft-ot-security-guidelines-cisa-and-fbi-warn-of-third-gfdjjlfyb2","count":1,"items":[{"id":"n_gfdjjlfyb2lzji2qmmua","seq":546250,"kind":"article","title":"NIST公布OT安全指南草案，CISA與FBI示警第三方ICS整合商風險","title_en":"NIST releases draft OT security guidelines, CISA and FBI warn of third-party ICS integration risks","url":"https://www.ithome.com.tw/news/179234","summary":"新聞 美國多州水務與廢水處理設施近來接連 遭到網路攻擊 ， 科羅拉多州 兩家供水企業更遭攻擊者直接修改設備設定。美國政府近期也針對營運科技（OT）安全採取新動作， NIST公布新版OT安全指南初步草案 ， CISA與FBI 則提醒關鍵基礎設施業者留意第三方ICS整合商的安全風險。 NIST在新版OT安全指南草案中擴充不同領域的介紹，包括建築自動化與控制系統、供水與廢水系統，以及工業物聯網（IIoT）與雲端融合等內容，並改以網路安全框架CSF 2.0重新編排。新版也擴充OT資產管理、網路監控與偵測等安全控制實作指引，並加入系統管理功能保護與零信任原則等安全架構內容。草案目前徵詢意見至11月30日。 CISA與FBI也以2025年的實際入侵事件示警，外國網路攻擊者入侵一家美國工業自動化解決方案業者，並建立9個ZIP壓縮檔，其中包含約800個檔案，涉及客戶SCADA資訊、ICS設備詳細資料及相關系統圖，研判攻擊者可能打算將這些資料外傳。這起事件凸顯第三方ICS整合商遭入侵後，客戶OT環境資訊也可能面臨風險。…","published":"2026-09-29T00:00:00Z","seen":"2026-09-29T00:05:23Z","lang":"zh","country":"TW","source":{"id":"kite-ithome-com-tw-c23d09","name":"ithome.com.tw","domain":"ithome.com.tw","outlet":{"wikidata":"Q123398745","name":"iThome","type":"magazine","country":"TW","designations":["magazine","news website"]}},"via":"kite-ithome-com-tw-c23d09","authors":["王珮瑤"],"entities":[{"id":"Q176691","name":"National Institute of Standards and Technology","type":"org"},{"id":"Q5205058","name":"Cybersecurity and Infrastructure Security Agency","type":"org"},{"id":"Q8333","name":"Federal Bureau of Investigation","type":"org"}],"story":"st_gfdjjlfyb2lzji2qmmua","category":"science-technology","category_p":0.5299999713897705,"category2":"economy-business","sentiment":"neutral","tone":-0.3799999952316284,"political":0.4000000059604645}]}