ISA ISA-IEC-62443 - ISA/IEC 62443 Cybersecurity Fundamentals Specialist

ISA/IEC 62443 defines “defense in depth” as a layered approach to security. This can be accomplished by implementing zones within zones (sometimes called subzones), where each zone or subzone provides an additional security barrier or control layer. This segmentation restricts an attacker's ability to move laterally and ensures that compromise of one zone does not automatically result in compromise of the entire system.

 A cyber attack is an attempt to compromise the confidentiality, integrity, or availability of a computer system or network by exploiting its vulnerabilities. A cyber attack can be launched from various entry points, which are the pathways that allow an attacker to access a target system or network. According to the ISA/IEC 62443-3-2 standard, which defines a method for conducting a security risk assessment for industrial automation and control systems (IACS), some of the possible entry points for a cyber attack are:

LAN: A local area network (LAN) is a network that connects devices within a limited geographic area, such as a building or a campus. A LAN can be an entry point for a cyber attack if an attacker gains physical or logical access to the network devices, such as switches, routers, firewalls, or servers. An attacker can use various techniques to access a LAN, such as network scanning, spoofing, sniffing, or hijacking. An attacker can also exploit vulnerabilities in the network protocols, services, or applications that run on the LAN. A cyber attack on a LAN can affect the communication and operation of the devices and systems connected to the network, such as IACS.

Portable media: Portable media are removable storage devices that can be used to transfer data between different systems or devices, such as USB flash drives, CDs, DVDs, or external hard drives. Portable media can be an entry point for a cyber attack if an attacker uses them to introduce malicious code or data into a target system or device. An attacker can use various techniques to infect portable media, such as autorun, social engineering, or physical tampering. An attacker can also exploit vulnerabilities in the operating systems, drivers, or applications that interact with portable media. A cyber attack using portable media can affect the functionality and security of the systems or devices that use them, such as IACS.

Wireless: Wireless is a technology that enables communication and data transmission without physical wires or cables, such as Wi-Fi, Bluetooth, or cellular networks. Wireless can be an entry point for a cyber attack if an attacker intercepts, modifies, or disrupts the wireless signals or data. An attacker can use various techniques to access wireless networks or devices, such as cracking, jamming, or eavesdropping. An attacker can also exploit vulnerabilities in the wireless protocols, standards, or encryption methods. A cyber attack on wireless can affect the availability and reliability of the wireless communication and data transmission, such as IACS.

Therefore, LAN, portable media, and wireless are three possible entry points that could be used for launching a cyber attack. References:

Cybersecurity Risk Assessment According to ISA/IEC 62443-3-21

ISA/IEC 62443 Series of Standards2

The “Maintain” phase is the fourth phase of the IACS Cybersecurity Lifecycle described in ISA/IEC 62443-2-1. A key activity in this phase is managing changes (also known as “change management”). This activity ensures that any modifications to the IACS environment (hardware, software, processes, etc.) are evaluated for cybersecurity impact, and proper controls are implemented to maintain the intended security posture. While risk assessment is typically done in the Assess phase, and allocating assets and designing countermeasures belong to earlier phases, managing changes is essential for ensuring ongoing compliance and effectiveness of cybersecurity controls over time.

Programmable Logic Controllers (PLCs) were originally designed to replace relay-based control systems in industrial automation. Early manufacturing and process control systems relied on hard-wired relays, timers, and sequencers, which were inflexible and difficult to modify. PLCs offered a software-based alternative that could easily be reprogrammed for various automation tasks, making plant operations more efficient and flexible. Their purpose was not specifically to enhance network security or Ethernet functionality, but rather to modernize and simplify control logic implementation.

The asset model is used in ISA/IEC 62443 to represent and describe the relationships and dependencies between different assets in an IACS environment. This model helps organizations identify and document assets, their interconnections, and their significance for operational and cybersecurity purposes. The zone model builds upon the asset model for segmentation, but the asset model itself establishes the foundational relationships.

The Ukrainian power grid cyberattack (2015 and 2016 incidents) is widely documented as a “nation state” attack. It was attributed to a highly skilled, well-resourced group with nation-state backing, and demonstrated the ability to compromise, disrupt, and remotely control industrial systems in critical infrastructure. This attack is discussed in ISA/IEC 62443 training and guidance as an example of advanced persistent threat (APT) activity targeting industrial control systems.

The best practice for detection-in-depth according to ISA/IEC 62443 involves layering different types of security controls that operate effectively under multiple scenarios and across various zones within an environment. IDS (Intrusion Detection Systems) sensors deployed across multiple zones within a production environment exemplify this strategy. By positioning sensors in various strategic locations, organizations can monitor for anomalous activities and potential threats throughout their network, thus enhancing their ability to detect and respond to incidents before they escalate. This deployment aligns with the ISA/IEC 62443 focus on comprehensive coverage and redundancy in cybersecurity mechanisms, contrasting with relying solely on perimeter defenses or single-point security solutions.

 The risk analysis category of an IACS consists of two elements: business rationale and risk identification and classification1. Business rationale is the process of defining the scope, objectives, and criteria for the risk analysis, as well as the roles and responsibilities of the stakeholders involved. Risk identification and classification is the process of identifying the assets, threats, vulnerabilities, and consequences of a cyberattack on the IACS, and assigning a risk level to each scenario based on the likelihood and impact of the attack1. These elements are essential for establishing a baseline of the current risk posture of the IACS and determining the appropriate risk treatment measures to reduce the risk to an acceptable level. References: 1: ISA/IEC 62443-3-2:2020, Security for industrial automation and control systems - Part 3-2: Security risk assessment for system design, International Society of Automation, Research Triangle Park, NC, USA, 2020.

Datagram Transport Layer Security (DTLS) and Secure Sockets Layer (SSL) are both commonly used protocols for managing secure data transmission on the Internet. DTLS is a variant of SSL that is designed to work over datagram protocols such as UDP, which are used for real-time applications such as voice and video. SSL is a protocol that provides encryption, authentication, and integrity for data transmitted over TCP, which is used for reliable and ordered delivery of data. Both DTLS and SSL use certificates and asymmetric cryptography to establish a secure session between the communicating parties, and then use symmetric cryptography to encrypt the data exchanged. DTLS and SSL are widely used in web browsers, email clients, VPNs, and other applications that require secure communication over the Internet. References:

ISA/IEC 62443 Standards to Secure Your Industrial Control System, Module 3: Introduction to Cryptography, pages 3-5 to 3-7

Using the ISA/IEC 62443 Standards to Secure Your Control System, Chapter 6: Securing Communications, pages 125-126

ISASecure is a conformity assessment scheme developed under the ISA Security Compliance Institute (ISCI), an affiliate of ISA. Its primary focus is the certification of IACS (Industrial Automation and Control System) products, systems, and supplier processes for cybersecurity. The program’s aim is to facilitate and ensure the cybersecurity of automation and control systems by certifying that products and systems meet the requirements set forth in the ISA/IEC 62443 standards. ISASecure offers certifications such as ISASecure EDSA (Embedded Device Security Assurance), SSA (System Security Assurance), and CSA (Component Security Assurance), all of which are tightly mapped to the 62443 series requirements.