Hello Securing Things Community,

This is Part-3 of a multi-part series on ISA/IEC 62443 standards overview - and will be expanding more on the standards, understand what are zones and conduits, foundational requirements, its relationship with systems and other requirements, applicability of security levels, different parts of the standard across the cybersecurity lifecycle phases, reference architecture and more.

✅Note: Part 2 included a diagram illustrating the relationship of certain key terms and definitions. There are plans for certain terminology to be updated soon. More on this when new terms get published in future.

➡The 62443 series includes numerous related standards and reports. Clause three of each publication is the source for terms, conventions, and abbreviations.

We’ll start where we left off in Part 2 related to different types of requirements.

IEC62443-3-3 outlines seven foundational requirements (FRs), which are detailed into a series of system requirements (SRs) and requirement enhancements (REs). The standard provides a chart to map SRs and REs to SLs 1 to 4.

<continue reading by registering below>.

The 7 FRs are outlined below. It also shows the flow of requirements between asset owners, system integrators and product manufacturers based on target security levels.

SLs may need adjustment based on security zone differences, threats, operational changes, and technology used, as these factors can alter an ICS's attack surface.

SLs set goals, but these must be flexible and updated to match the evolving threat landscape. Therefore, asset owners should periodically perform risk analysis and also after risk-relevant events to ensure security risks are tracked and SRs remain current, maintaining a defendable posture.

Following image highlights the relationship between the with FRs, SRs and CRs.

<Note: I may add an example mapping later>.

➡ISA/IEC 62443-3-2 provides guidance on separating an industrial environment into security zones and conduits (defined in Part 2) based on risk assessments. It provides guidance on the selection of and or designing zones, conduits and assigning security levels (SLs).

To achieve the desired SLs, certain countermeasures / controls needs to be implemented to meet a specific SLs.

Asset owners (OT owner / operators) organisations must assess gaps between its existing security controls and the standards definition of assigned levels.

Even with multiple zones, perfect risk isolation in ICS environments is impossible because a weakened zone can impact others by disrupting services or compromise communication paths.

To address this, the standard includes the concept of "conduits" to analyze and protect communication paths / channels between zones.

Each security zone and conduit is assigned a target security level (SL-T).

To achieve a satisfactory security level (SL-A), several factors must be considered.

Though are complex and challenging to implement, the standard outlines these factors.

It's crucial to select and validate countermeasures while considering their implications, such as the impact of function dependency on compromised services in different zones.

Evaluating residual or introduced risks is as important as achieving specific security levels.

When establishing security zones and conduits, these factors must be considered to ensure they meet SL-A.

Communication paths may create residual attack vectors, so they and neighbouring zones must also meet SL-A.

In segmentation, security zones and subzones are logical constructs separate from the physical network.

Information flows within, into, and out of zones via conduits (communication paths between zones).

These include communications among programming terminals, mobile devices, and vendor connections.

Conduits and channels can be trusted or untrusted, with those not crossing zone boundaries generally trusted.

Untrusted channels occur when parties are at different security levels.

Channels inherit the security properties of their conduits, but secure communications can extend a security zone.

Analysing communications between zones and endpoints is crucial for selecting countermeasures / security controls.

When zones share technologies, they must adopt the higher SL to meet risk-reduction and protection requirements.

This helps identify opportunities for technology segmentation and realignment, minimizing the assignment of higher SLs and reducing costs.

Each OT/ICS solution implementation is unique, but can include following principles:

- Segmentation of ICS, network, and applications offer cost/benefit opportunities.

- Layer 2 network access control can enhance zone boundary controls.

- Zone boundaries create choke points for security monitoring.

- Lower security levels need fewer controls.

- Hierarchical zoning offers defense in depth.

We’ll conclude part 3 here.

Stay tuned to find out more in Part 4 - ISA/IEC 62443 Standards Series Overview in a future newsletter edition, in which we’ll cover, more on the standards, latest revision of 62443-2-1 and what’s new in it, cybersecurity risk assessments using 62443-3-2, applicability of different parts of the standard across the cybersecurity lifecycle phases, and more.

I invite you as part of #SecuringThings community to share your feedback.

Your feedback and input is invaluable to me as we work together to strengthen our cybersecurity defenses and create a safer and smarter digital society.

Let us know how we can improve this and or what you’d like to see in future?

Thank you for your trust and continued support.

Do register, validate your email, and request login link to submit poll to be able to enter a chance to win a future course giveaway.

Thanks for reading - until the next edition!

It’s a Great Day to Start Securing Things for a Smart & Safer Society.

Take care and Best Regards,

M. Yousuf Faisal. (Advice | Consult Cyber & business leaders in their journey on Securing Things (IT, OT/ICS, IIOT, digital transformation, Industry 4.0, & AI) & share everything I learn on this Newsletter | and upcoming Academy).

Follow Securing Things on LinkedIn | X/Twitter & YouTube.