There are multiple industry frameworks to help create and maintain a secure ICS environment. Some of the industrial cybersecurity standards include IEC 62443 (International Electrotechnical Commission), NERC CIP (North American Electric Reliability Corporation Critical Infrastructure Protection), and NIST 800-82 (National Institute of Standards and Technology - Guide to Industrial Control Systems (ICS) Security). IEC 62443 is a series of standards and technical reports that are developed by the International Society of Automation (ISA) and the International Electrotechnical Commission (IEC). This is the recommended framework to follow for the DVD for Manufacturing Edge and was used as a reference when validating components of this solution. This series of standards provides a road map for improving the overall cyber security posture of an ICS environment. The scope of IEC 62443 is defined as any software, hardware, personnel, and policies that are involved in or have influence over the safety, security, and reliability of the ICS operations. Since ICS components can be physical systems, IEC 62443 stresses the importance of safety. Specifically, a compromise of these physical systems can lead to risk of human life or safety, damage to machinery, financial impact, and harm caused to the environment.

IEC 62443 is broken up into documents and technical reports that are grouped into four families of standards: 1) General, 2) Policies and Procedures, 3) System, and 4) Component. Also, IEC 62443 defines roles of those who are involved in the overall operations of an ICS. These roles consist of the Asset Owner, Maintenance Service Provider, Integration Service Provider, and the Product Supplier. In addition, listed below are some of the fundamental concepts within IEC 62443:

• Security program—Specific to Part 2-1, this program covers details on policies and procedures, technical capabilities, and maintenance of personnel within ICS.
• Risk Management—Specific to Part 3-2, this program starts with a risk assessment to help understand the current level of risk within the ICS environment. Going through the risk assessment help identify how to manage the risk through tasks such as identifying assets, Security Levels, and by establishing Zones and Conduits.
• Security Levels—Measure of how well an ICS component is protected from a certain level of threat and potential vulnerabilities. The following table gives an overview of each security level with some examples of potential threats and their associated skills and effort.

• Zones and conduits—Zones are groups of physical or logical assets that are based upon criteria such as risk, function, or physical/logical location. Conduits are logical groupings of communications channels that share common security requirements when connecting zones.
• Defense-in-depth—A principle in which multiple layers of security are built into the overall system architecture so that if one level of security is broken, the rest of the system is not compromised. An example of this is if physical security is compromised, all communication over the network is encrypted so it cannot be easily read.

As mentioned previously, IEC 62443 is broken up into a family of standards that applies to different areas of industrial control systems. For example, IEC 62443-3-3 (System security requirements and security levels) describes overall requirements for an ICS-based system and mainly targets asset owners, suppliers, or integrators of the system.

Standards IEC 62443-4-1 and IEC 62443-4-2 are at the component level. Since this is at the component level, both standards provide more detailed and specific applicable controls. IEC 62443-4-1 is a standard that focuses on the security development life cycle requirements for control system suppliers.

IEC 62443-4-2 focuses on components within the ICS and is broken up into different categories such as embedded devices or host devices.

As an example, to align with IEC 62443-3-3, the organization must go through a certain set of steps. The steps can include the organization having identified their OT assets and conducted an organizational risk analysis to help identify criticality of system components. Once this is done, the organization can leverage this information to create zones and conduits. Security target levels (SL-T) can then be assigned to each zone and conduit, identifying how secure each should be. The organization assesses achieved security levels (SL-A) to then obtain a list of systems where the SL-A is less than the SL-T, which translates to the capability level (SL-C). The SL-C describes to what security level a system can be configured to. If an SL-T cannot be achieved, the organization should consider compensatory controls such as changing equipment.

Security Levels help narrow down the scope for what security controls to apply. The following table is an example of a set of controls and their associated security levels for a component’s identification and authentication capabilities. This table shows how higher security levels, which are mapped to components or systems with higher criticality levels, apply more stringent security controls. A higher security level (SL-2 or SL-3 in this case) assumes application of lower security levels. In summary, this section aims to provide an overview of the different components of IEC-62443 and an introduction of how to understand it and start to leverage the family of standards.