What is IEC 62443?

Industrial Automation and Control Systems are crucial in industries like energy, manufacturing, etc., and these systems were not designed with cybersecurity in mind. In fact, the security of these systems largely depends on physical isolation. Organizations around the world encountered various problems securing these systems, and around 40% of the global IACS were facing malicious activity in the second half of 2022; thus, the need for standards emerged.

IEC 62443

Established around a century ago, the International Electrotechnical Commission (IEC) exists to address the need for standard electrical measurements and technology. In the 21st century, the IEC became the global authority on electrical and electronic subjects. To date, the organization has published over 10,000 standard documents.

IEC 62443 was approved as a horizontal standard in 2021 by the IEC and was designed to be applicable across various industrial sectors. These standards aim to offer guidance on implementing security practices into the entire lifecycle of IACS and have enabled organizations around the world to adopt secure IACS practices.

IACS and why securing it is hard

• The traditional approach to secure IACS involves flat network designs; this works only up to a limited extent; a single breach can compromise the entire system as there are very few internal barriers to stopping malicious activity.

• IACS systems are known to have a long lifespan as compared to IT systems. These lifespans can be up to 20 years or more. This clearly means that they have to work with outdated software and hardware, which may no longer be compatible with modern security solutions.

• Real-time operation is the power of IACS, and hence, they are used in physical processes like manufacturing, power distribution, etc. If the decided security solution adds any latency or disrupts real-time performance, this can directly impact the system’s functionality.

• Remote access is an important requirement for monitoring and management in modern IACS. Although it is a necessary requirement, it increases the threat landscape as it directly increases the vulnerability to cyber-attacks

The concept of Zones and Conduits

The concept of zones and conduits is used to structure and manage the cybersecurity of industrial networks and, hence, is crucial to interpret IEC62443 standards. It helps to segment the system into logical parts and manage how the data flows between these parts, providing a foundation for managing security risks in complex environments. In IACS, zones are distinct areas with specific security requirements based on their operations and risk levels, which are then connected by conduits, which are communication paths between these zones.

Zones

It is just a logical or physical grouping of devices or systems that have similar security requirements or operational characteristics. The aim here is to isolate different parts of a system that require different levels of protection based on their operations or sensitivity.

An example here can be of a power plant where the control room that manages turbine operations might be one zone while the IT systems that handle employee emails might form a separate zone.

Types of Zones

• Safety Zones: These zones consist of systems that directly affect the safety of people or the environment, such as emergency shutdown systems.

• Enterprise Zones: These might contain business-related systems, such as email systems or ERP systems.

• Control Zones: These include core operational systems like Programmable Logic Controllers (PLCs), Distributed Control Systems (DCs), etc.

Conduits

Conduits are communication pathways existing to provide data flow and a way to control and secure interaction between zones. It ensures that only authorized and secure data exchanges occur. They act as checkpoints between the zones; they basically enforce security controls over the communication that happens between the zones. These controls can include access control lists, firewalls, intrusion detection systems, etc. An example of this is that in a similar power plant, a conduit can control the flow of data between the control room and a remote monitoring system. A firewall may act in between and restrict the type of data allowed to pass between these zones.

A strategic approach is required to effectively implement zones and conduits for an industrial environment; the following steps elaborate the advised approach.

• Risk Assessment

  This step involves identifying all assets within your IACS and assessing the vulnerabilities of these assets, evaluating the potential impact of different threats on each part of the system, and identifying what parts of your system are most critical and need the highest level of protection.

• Define Zones and Conduits

  In this step, systems that have similar functions and require the same level of protection are grouped into zones to ensure that only necessary information flows between the zones.

• Apply defense-in-depth Security

  This step ensures that multiple layers of protection are used within each zone and conduit. These layers might include firewalls, intrusion detection systems, authentication mechanisms, and monitoring tools.

• Develop Monitoring and Incident Response

  Monitoring is important to detect unusual activity or security breaches; using tools like Intrusion Detection Systems (IDS) and Security Information and Event Management (SIEM) solutions can be helpful. Having a clear incident response plan in place for each zone is also important to minimize security risks.

• Training and Awareness

  It must be made sure that personnel working or managing the conduits are well-trained in cybersecurity practices; they must have the ability to recognize threats and follow access control procedures.

• Continuous Improvement

  This step highlights the importance of continuously reviewing and updating the zoning and conduit strategies to account for evolving threats and technological changes, which might include adding new firewalls, updating encryption standards, etc.

• Ensure Compliance with IEC 62443

  Finally, ensure that the strategy that has been devised and implemented aligns with IEC 62443 standards.

Security Levels of IEC 62443

The IEC 62443 includes four levels of Security aimed at protecting the industrial system against various threats arising from cybersecurity. Each level is defined with a certain level of threat in mind, from the most trivial occurrences to sophisticated operations.

SL1- Guarding from accidental methods practices

Only accidental breach remediation is effective in this category. Emphasis is placed on measures to counter human errors such as information misconfiguration and unintended deletion, among others.

SL2- Protection from deliberate abuses

Level 2 looks at attacks that are intentional but weak. It looks at more standard violations like breaking in or using very basic-level viruses. The safety measures, in this case, are very primitive user profile login-based access and activity monitoring to avert or find such abuse.

SL3- Safeguard against sophisticated attacks

Security level 3 primarily targets attackers who will typically be more organized and skilled, such as those in organized crime groups. This level involves a wide range of very rigid security practices. For example, there are requirements for biometric access, installation of sophisticated alarm systems, and strict user protocols.

SL4- Safeguard from external attacks using extra prerequisite Tools

Level 4 is the apex of Security Levels, which prevents the most advanced cyber-attacks. Here, Sequential, multi-layered methods of defense strategies along with callbacks on danger are put in place.

IEC 62443-4-2

IEC 62443-4-2 is one of the standards found in the IEC 62443 series and defines a baseline of cybersecurity requirements applicable to individual components of industrial automation and control systems. In addition, IEC 62443-4-4 builds upon these requirements with recommendations on adopting secure software engineering practices within applications related to IACS. This standard aims at the security development lifecycle (SDL), motivating software developing companies to implement Security at the design phase till the final product is released.

As with any other modern standard, IEC 62443-4-4 imposes certain conditions, such as vulnerability analysis, secure programming, and testing, which respond to new purposes like cyber violence. Its focus is maintaining the Security of IACS applications against manipulation or interference through proactive measures such as testing (code review and updates of the system) or the active maintenance of the software.

On top of these, the standard further explains the minimum levels of preparedness in handling countermeasures, which shows that a developer will be able to fix a sure hole and issue a patch within the lifetime of the threat. This approach to the life cycle enhances the strength and safety of IACS since Security is already part of the system even before the system has been developed, right from the software development life cycle.

In practice, IEC 62443-4-4 enables organizations to ensure the achievement of high-end security requirements, thus enabling developers to develop secure and strong IACS elements that satisfy all considerations provided in IEC 62443-4-2.

Public Key Infrastructure and IEC 62443

The use of the Public Key Infrastructure and digital certificates is the groundwork for the protection of Industrial Automation and Control Systems (IACS) security levels, especially those that are more advanced and have sophisticated security threats. Digital certificates work just like e-passports in that they serve to verify an individual’s identity as well as encrypt information to maintain the confidentiality and integrity aspects of the data.

However, even so, there are challenges in managing certificates in industrial setups covering hundreds of plants. Because of the numerous devices and the constant changes, manual processes involve too much attention from human resources, which exposes the process to numerous inaccuracies. Outdated certificates can also bring a business to its knees or, even worse, expose it to serious security risks. These are made worse by the efforts of trying to incorporate PKI into existing institutions that have other systems, which include armies of people who must work manually and certificates that are everywhere.

Thus, it helps in the understanding of the needs of the respective audience. In order to ease the process of PKI deployment, which is often complicated and unreliable, document IEC 62443 outlines the use of management tools for automated certificates. They perform the processes of issuing guidelines for certificates, reissuing and canceling certificates, and eliminating or reducing the possible risks caused by people, hence supporting strong implementing Security. Such tools play a part in ensuring the safe and efficient operation of IACS when integrated into the architecture of industrial systems.

Conclusion

To sum up, IEC 62443 is a beneficial standard for securing Industrial Automation and Control Systems (IACS) in power generation, manufacturing, and construction industries. The standards deal with a very specific issue of how to protect systems traditionally protected from external threats thanks to the physical separation of different components and not cybersecurity per see.

The concepts of zones and conduits, security levels, and risk management systems, in general, provide a strategized, prevalent way of dealing with various cybersecurity challenges. Standards such as IEC 62443-4-2 and IEC 62443-4-4 serve as road maps for organizations wishing to apply secure coding techniques at each stage of the software development process to IACS. This ensures that IACS hardware and software include security features from the start of the product’s development.

Apart from this, the use of Public Key Infrastructure (PKI) for authentication and data integrity also enhances IACS security, even though managing the PKI is a challenge in large-scale industrial environments. IEC 62443 is an assurance to such firms that their critical operational assets will be safeguarded against the risks of the changing cyber landscape.