Abstract: In addition to the application of manufacturing industries, industrial control systems are also widely used in critical infrastructure such as transportation, energy, and water treatment industries. Accelerated application of digital, network, and intelligent technologies in industrial control systems, more and more smart devices are connected to it, leading to severe challenges to its security. Therefore, the security of industrial control systems has attracted the attention of researchers. In order to let the researchers systematically understand the current research progress, we have researched the core database of Web of Science, EI database, the network and information security related papers of CCF recommended international academic conferences and other high-level research work in the past three years. First, the architecture of industrial control systems is introduced, then the security threats that ICS faces are introduced. Moreover, according to the architecture of the industrial control systems, we divide the security research work into three parts: the communication security of industrial control system and cloud, the communication security of human machine interface (HMI) to device, the security of device firmware and other security research issues, analyze them from the perspective of attack and defense. Finally, we put forward the main challenges that security research faces, identify open problems for future research directions.