In today's interconnected world, OT Security — the security of industrial control systems (ICS) and operational technology (OT) — is of top importance. These systems are the backbone of critical infrastructure, including energy, water, transportation and manufacturing. As cyber threats continue to evolve, securing these systems has become a priority. ISO 62443 is a series of standards developed to address this need, providing a framework for securing ICS and OT environments through Industrial Automation Cybersecurity best practices.
This blog provides a broad understanding of ISO 62443 and provides inputs on what developers need to do to comply with these standards during the development process.
What is ISO 62443?
ISO 62443 is an international standard developed by the International Society of Automation (ISA) and the International Electrotechnical Commission (IEC). It provides guidelines and requirements for the OT Security of industrial automation and control systems (IACS). The standard is designed to address the unique security challenges faced by these IACS environments. These systems mostly operate in safety and critical environments where Cybersecurity for IIoT Devices is becoming increasingly important as edge devices connect to the operational network.
Structure of ISO 62443
ISO 62443 is divided into four main parts, each focused on different aspects of IACS security and OT Security:
ISO 62443
General (62443-1-x)
This category provides foundational information, including terminology, concepts, and models that are essential for understanding and implementing OT Security and Industrial Automation Cybersecurity across all other parts of the standard.
- 62443-1-1: It establishes the fundamentals of cybersecurity for industrial automation and control systems, outlining essential concepts, terminology, and foundational principles to enhance IACS security.
- 62443-1-2: It outlines foundational concepts for industrial cybersecurity, focusing on defining security levels, key terms, and principles essential for safeguarding automation and control systems.
- 62443-1-3: System Security Compliance Metrics.
- 62443-1-4: It defines the principles and requirements for cybersecurity in industrial automation, focusing on secure design, operation, and lifecycle management of IACS systems and components.
Policies and Procedures (62443-2-x)
This category focuses on the establishment and maintenance of security programs and policies for OT Security.
- 62443-2-1: It provides guidelines for performing security risk assessments and designing secure IACS systems, ensuring robust Industrial Automation Cybersecurity measures.
- 62443-2-2: It focuses on assessing and managing security risks in industrial control systems. It provides guidelines for identifying threats, evaluating risks, and defining security requirements for system design.
- 62443-2-3: Patch Management in the IACS Environment.
- 62443-2-4: It focuses on security program requirements for IACS. It provides guidelines for establishing and maintaining a robust security management program, ensuring comprehensive OT Security protection of systems.
System (62443-3-x)
This category addresses security requirements for system-level activities, including risk assessment and system design for OT Security.
- 62443-3-1: It focuses on security technologies for industrial automation, providing guidelines on selecting and implementing security measures like firewalls, encryption, and intrusion detection systems. These are core tools for implementing a Defense-in-Depth strategy.
- 62443-3-2: It focuses on assessing and defining security requirements for industrial control systems. It guides the risk assessment process and helps establish security measures for IACS system design.
- 62443-3-3: It defines system security requirements for industrial control systems, focusing on achieving specific security levels through detailed technical controls and risk management practices aligned with Defense-in-Depth principles.
Component (62443-4-x)
This category defines security requirements for individual system components, including software development and hardware design — directly applicable to Cybersecurity for IIoT Devices.
- 62443-4-1: It defines secure development lifecycle requirements for industrial control systems, focusing on secure software development practices and lifecycle management to protect against cyber threats.
- 62443-4-2: It specifies security requirements for IACS components, focusing on secure design, implementation, and maintenance to ensure robust OT Security and support Cybersecurity for IIoT Devices at the component level.
This category maps specific security controls and capabilities to corresponding security levels, ensuring that components support the desired SLs.
Security Levels
These security levels gauge the robustness of an IACS against cybersecurity threats. These levels range from SL 0 to SL 4, with each level representing a progressively higher degree of OT Security.
- SL 0 (No Special Security Protection): This baseline level implies no specific cybersecurity measures are in place, and the system is vulnerable to any threat.
Example: Anyone can access the control system and modify settings without any authentication or logging. - SL 1 (Protection Against Casual or Coincidental Violation): At this level, basic measures are implemented to guard against unintentional breaches or low-skill attackers, such as basic access control and simple authentication mechanisms.
Example: An operator must log in with a username and password to access the control system, preventing accidental modifications by unauthorized personnel. - SL 2 (Protection Against Intentional Violation Using Simple Means): Enhanced measures are in place to protect against deliberate but unsophisticated attacks. This includes stronger authentication, user management, and more rigorous access controls.
Example: Only specific IP addresses are allowed to connect to the control system, and operators have roles with defined permissions (e.g., read-only access for some users). - SL 3 (Protection Against Intentional Violation Using Sophisticated Means): This level involves advanced security mechanisms to defend against highly skilled attackers. Measures include detailed auditing, anomaly detection, and robust encryption — all hallmarks of a strong Defense-in-Depth architecture.
Example: All data transmitted between the control system and operators is encrypted. The system logs all access attempts and changes. - SL 4 (Protection Against Intentional Violation Using Highly Sophisticated Means): The highest OT Security level, SL 4, offers protection against highly sophisticated threats. It involves thorough security practices, such as multi-factor authentication, comprehensive encryption, and real-time threat monitoring. This level is essential for Cybersecurity for IIoT Devices deployed in critical infrastructure.
Example: Developers must use multi-factor authentication to access the control system. The system is continuously monitored for threats, with immediate response mechanisms in place to mitigate any detected risks.
Key Principles of ISO 62443
Before diving into what developers need to know, it's important to understand the key principles underlying ISO 62443 and Industrial Automation Cybersecurity:
- Defense in Depth: Implement multiple layers of security controls to protect against threats. A Defense-in-Depth strategy ensures that even if one layer is compromised, additional layers continue to protect the IACS environment. Defense-in-Depth is the central architectural principle of OT Security under ISO 62443.
- Zone and Conduit Model: Segment the network into zones with similar security requirements and define conduits for secure communication between zones. This model supports Defense-in-Depth by limiting lateral movement for attackers within the IACS.
- Risk Assessment: Regularly assess risks to identify and mitigate potential threats to the IACS.
- Security by Design: Integrate Industrial Automation Cybersecurity practices throughout the development lifecycle, from design to deployment.
What Developers Need to Do
Developer involvement to add necessary support for ISO 62443 applicable to ISO 62443-3 sub-standard. For example,
Security Technologies for IACS:
Evaluate various security technologies, such as firewalls, intrusion detection systems, and secure communication protocols. Configure robust firewalls to segment the network and implement Defense-in-Depth controls that prevent unauthorized access and movement across IACS zones. Implement intrusion detection systems to monitor for suspicious activities — a critical component of OT Security.
Security Risk Assessment for System Design:
Conduct a comprehensive risk assessment for product critical assets or modules. Map potential threats, such as unauthorized access to modules (PLCs, etc) and data interception between sensors and control systems. Implement encrypted communication between modules and sensors. Addressing Cybersecurity for IIoT Devices requires risk assessments that account for the unique exposure of edge devices on the operational network.
System Security Requirements and Security Levels:
Harden the operating systems of the product control systems, disabling unnecessary services and applying the latest security patches. Install robust logging and audit mechanisms to track all access and changes, ensuring any suspicious activity can be swiftly identified and addressed. This hardening approach directly supports the Defense-in-Depth and IACS security requirements of ISO 62443.
Embien’s Edge Computing Services and IT-OT Convergence & ICS Cyber Security expertise enable secure, real-time operations aligned with ISO 62443 across industrial environments.
Conclusion
ISO 62443 provides a comprehensive framework for OT Security in industrial control systems and operational technology environments. For developers, adhering to these standards requires a commitment to integrating Industrial Automation Cybersecurity practices throughout the development lifecycle. By understanding the key principles of ISO 62443 — including IACS security, Defense-in-Depth, and Cybersecurity for IIoT Devices — and implementing secure coding practices, threat modeling, robust access controls, and security testing, developers can significantly enhance the OT Security of their systems.