ISA/IEC-62443-3-3: What is it and how to comply?

 

Overview

Protecting Industrial Automation and Control Systems (IACS) from cyberthreats is top of mind for industrial organizations. But converting good intentions to action can be a daunting task. As IACS and underlying networks are often very complex, with legacy technologies and poor security procedures, one could wonder where to start.

Fortunately, the International Society of Automation (ISA) put together the ISA99 set of standards and technical reports. The International Electrotechnical Commission (IEC) worked with the ISA to publish most of them as IEC documents and developed additional parts that are being added to the common series of ISA/IEC-62443.

The ISA/IEC-62443 Series standards and technical reports are arranged in four groups, corresponding to different focuses and audiences. Part 3-3 defines system security requirements and security capability levels to build an IACS that meets the target security level and evaluate your practice for each requirement. It gives IT and operations teams common ground to work together in building industrial infrastructures that are effectively protected against both cyberthreats and casual or coincidental events, and that drive continuous improvement.

Cisco is best known for enterprise networking and cybersecurity. Fewer people know that for more than 15 years we’ve also been helping industrial organizations around the globe to digitize their operations. We’ve worked with manufacturers, energy and water utilities, mines, ports, railways, roadways, and more. In fact, Cisco leads every segment of the industrial networking market.

With our deep understanding of Operational Technology (OT) requirements plus our leading cybersecurity portfolio, Cisco is an ideal partner to help industrial organizations secure their IACS to achieve compliance with the ISA/IEC-62443-3-3 standard. This document explains the requirements listed in the standard and illustrates how Cisco can help.

The ISA/IEC 62443-3-3 security principles

Part 3-3 of the standard defines essential security requirements (system requirements – SR and requirement enhancements – RE) derived from the Foundational Requirements (FR) to comply with the cybersecurity principles defined in Part 1-1, including:

Least privilege

This principle gives users only the rights they need to perform their work, in order to prevent unwanted access to data or programs and to block or slow an attack if an account is compromised.

Defense in depth

This technique allows multiple layered defense techniques to delay or prevent a cyberattack in the industrial network. The standard also requires that systems be separated into groups called “zones” that will be able to communicate with each other through communication channels called “conduits” whether they are physical, electronic, or process based.

Risk analysis

The concept of risk analysis, based on criticality, likelihood, and impact, is not new. It is already used to address risks related to production infrastructure, production capacity (production downtime), impact on people (injury, death), and the environment (pollution). However, this technique must extend to cybersecurity to address the risks inherent in industrial information systems. ISA/IEC-62443-3-2 describes a security risk assessment methodology for an IACS.

Compensating security measures

In many cases, the components of an IACS do not provide the capabilities required to meet a given security level. In such scenarios, the use of compensating security measures, technical or procedural, can help to facilitate the needed capability. The combination of multiple techniques found within a security solution is designed to fulfill such a role.

Zones and conduits

Based on these principles, ISA/IEC-62443 proposes an industrial control system architecture that leverages the Purdue reference model used in ISA95 (Figure 1), segmenting these functional levels into zones and conduits (Figure 2). The segmentation is an outcome of the security risk assessment as specified in ISA/IEC-62443-3-2.

ISA/IEC 62443 functional reference model (source: IEC-62443-3-3 standard)

According to the standard, a zone is a collection of physically and/or functionally united assets that have common security requirements. These zones are defined based on the physical and functional models of the industrial system control architecture. All assets in an IACS must be positioned in a zone.

Conduits support communication between zones. A conduit is a logical grouping of communication channels between two or more zones.

Example of industrial network zones and conduits (source: IEC 62443-3-3 standard)

Leveraging secure components

ISA/IEC-62443-3-3 focuses on the principle of a secure IACS but leverages other parts of the standard series. For instance, it assumes that a security program has been established and is being operated in accordance with IEC 62443‐2‐1: Security Program Requirements for IACS Asset Owners.

ISA/IEC-62443-3-3 also assumes that secure components will be deployed, or that additional measures will be put in place, to meet its requirements and address the current and future vulnerability and threat landscape. Component and development requirements are defined in Parts 4-2 and 4-1, which are essential to achieve compliance.

ISA/IEC-62443-4-1: Secure Product Development Lifecycle Requirements

This part of the ISA/IEC-62443 series comprises process requirements for the secure development of products used to assemble an IACS as well as maturity levels to set benchmarks for compliance. The content pertains to the following processes: requirement, management, design, use of coding guidelines, implementation, verification and validation, defect management, patch management, and product end of life. These requirements are essential to the security capabilities of a component and the underlying secure-by-design approach of the IACS solution. The overall focus of Part 4-1 is on continuous improvement, which is essential to address velocity in product development and release.

Cisco software and hardware products are developed according to the Cisco Secure Development Lifecycle (Cisco SDL), which enforces a secure-by-design philosophy from product planning through end of life. Cisco has obtained IEC-62443-4-1 certification for Cisco SDL that applies to the development of all Cisco industrial products.

ISA/IEC 62443-4-2: Technical Security Requirements for IACS Components

This part contains requirements for technical control system components associated with the seven Foundational Requirements (FRs). It extends the System Requirements (SRs) and Requirement Enhancements (REs) defined in ISA/IEC‐62443‐3‐3 into a series of Component Requirements (CRs) and related REs for the components contained within an IACS. The objective is to support selection and procurement of control system components to build and integrate an IACS solution.

In this regard, the standard specifies security capabilities that enable a component to be integrated into the system environment of an IACS at a given Security Level (SL). Part 4-2 contains requirements for four types of components: software application, embedded device, host device, and network device, tailored to the specifics of these assets. In essence, a secure IACS solution needs to be built based on secure components and by applying compensating security measures if needed.

Several Cisco products have already achieved IEC-62443-4-2 certification. In combination with a 62443-certified development process (Cisco SDL), Cisco offers trustworthy communication products, which is essential for IACS deployment in critical infrastructures.

ISA/IEC-62443-3-3 foundational requirements

This chapter details the System Requirements (SRs) defined in IEC-62443-3-3 for each Foundational Requirement (FR) and how Cisco can help achieve compliance. The FRs themselves are defined in ISA/IEC 62443-1-1 (Terminology, Concepts, Models).

According to the scope of the standard, these requirements pertain to all components used to build and operate an IACS. Cisco can typically support an asset owner in meeting the requirements and the desired security level for network and security components.

The standard defines five different Security Levels (SLs) organizations can choose to reach for each FR, depending on their risk analysis:

●      Level 0: No specific requirements or security protection necessary.

●      Level 1: Protecting against casual or coincidental events.

●      Level 2: Protecting against intentional events from malicious users using simple means, low resources, generic skills, and low motivation.

●      Level 3: Protecting against intentional events from malicious users using sophisticated means, moderate resources, specific skills, and moderate motivation.

●      Level 4: Protecting against intentional events from malicious users using sophisticated means, extensive resources, specific skills, and high motivation.

These security levels allow an organization to define the needed protection based on security controls for increasingly complex types of threats.

FR1: Identification, authentication control, and Access Control (AC)

Rationale

This part of the standard describes requirements for identifying and authenticating users (humans, software processes, and devices) before allowing them access to the industrial control system or a particular component. It acknowledges that some components might require stronger authentication mechanisms than others and recommends minimizing controls within a single zone.

How can Cisco help?

Cisco Identity Services Engine (ISE) works with network devices (both wired and wireless) to create an all-encompassing contextual identity with attributes such as user, time, location, threat, vulnerability, and access type. This identity, human or otherwise, can be used to enforce a highly secure access policy that matches the identity’s business role. Administrators can apply precise controls over who, what, when, where, and how endpoints are allowed on the network. ISE integrates with multiple external identity providers such as Microsoft Active Directory.

Cisco ISE additionally offers an easy-to-deploy internal certificate authority. ISE supports both standalone deployments and ones in which the certificate authority is integrated with your existing enterprise public key infrastructure and facilitates the manual creation of bulk or single certificates and key pairs to connect devices to the network with a high degree of security.

For human users accessing Windows workstations on the plant floor or entering the network remotely, Cisco Secure Access by Duo offers Multifactor Authentication (MFA) to verify user identity before granting access. Installing Duo authentication for Windows logons adds MFA to all interactive user Windows login attempts, whether at a local console or over Remote Desktop Protocol (RDP), unless you select the “Only prompt for Duo authentication when logging in via RDP” option in the installer.

Cisco Cyber Vision primarily provides asset inventory and visibility into flow data. It can also detect the presence of credentials being sent using cleartext protocols, giving administrators a chance to remedy the situation before a man-in-the-middle attack occurs.

Table 1.        System requirements for identification, authentication control, and access control

FR2: Use Control (UC)

Rationale

This foundational requirement is about enforcing the proper privileges for a user (human, software process or device) once identified and authenticated to protect a component against unauthorized action (reading/writing data, downloading programs, setting configurations, etc.). It also cares about monitoring user actions and recommends adapting user privileges based on time of day, date, location, and means by which access is made.

How can Cisco help?

Cisco Identity Services Engine (ISE) is an Authentication, Authorization, and Accounting (AAA) server that is used for access control in both wired and wireless industrial networks. Authentication provides a way to identify a user, typically by having the user enter a valid username and password before access is granted. However, most devices in the network are not human and therefore do not have the capability to provide a username or password.

ISE provides the capability to do MAC Authentication Bypass (MAB), which uses the MAC address of a device to determine the level of network access to provide. Before MAB authentication, the identity of the endpoint is unknown, and all traffic is blocked. The switch examines a single packet to learn and authenticate the source MAC address. After MAB succeeds, the identity of the endpoint is known and traffic from that endpoint is allowed. The switch performs source MAC address filtering to help ensure that only the MAB-authenticated endpoint is allowed to send traffic.

Authorization is the process of enforcing policies and determining what type of activities, resources, or services a user or device is permitted to access. All controlled from a central location, Cisco ISE distributes enforcement across the entire network infrastructure. Administrators can centrally define a policy that differentiates vendors from registered users and grant access based on least privilege. ISE provides a range of access control options, such as downloadable Access Control Lists (dACLs), VLAN assignments, and Security Group Tags (SGT) or Cisco TrustSec. These technologies are explained further in FR5, where network segmentation is addressed. Cisco Secure Firewall provides more granular policy across network boundaries for capabilities such as read/write enforcement.

Accounting measures the resources a user consumes during access, which may include the amount of system time or the amount of data that a user sent or received during a session. Accounting is carried out through the logging of session statistics and usage information, which is used for authorization control, resource utilization, and capacity planning activities.

Audit logs are supplemented by Cisco Cyber Vision, as all packets that flow through the network infrastructure undergo deep packet inspection, providing OT specific data when reviewing events in the network.

Table 2.        System requirements for use control

FR3: System Integrity (SI)

Rationale

The objective of this foundational requirement is to ensure the integrity of each component of the IACS by hindering unauthorized manipulations throughout the component’s lifecycle, that is, during testing, operational, and nonoperational phases. Integrity of data transmission is also a key requirement to prevent manipulation of measurement values or command parameters, for instance.

How can Cisco help?

In addition to security controls, hardened and ruggedized equipment is required to address specific physical and environmental effects and to preclude impact from Electromagnetic Interference (EMI) and other harsh conditions. This includes cabling, interfaces, and the design of the communication equipment. A perfect example in this regard is the IEC-61850-3 standard for equipment installed in electrical substations. Cisco’s ruggedized industrial switches used in substation automation networks are all certified against Part 3 of IEC-61850.

Furthermore, a robust, reliable, and in some cases redundant network architecture is key to ensure high availability of data and to minimize effects from environmental conditions.

To gain insight into the integrity of data transmission, Cisco recommends the use of endpoint software and an Intrusion Detection System (IDS) to prevent, detect, report, and mitigate the effects of malicious code or unauthorized software. Cisco Snort is an open-source IPS/IDS that is integrated into both Cisco Secure Firewall and Cyber Vision. Cisco Secure Endpoint is an endpoint protection tool that can detect and prevent malware on workstations, Windows-based Human-Machine Interfaces (HMIs), and tablets used within industrial networks.

Table 3.        System requirements for system integrity

FR4: Data Confidentiality (DC)

Rationale

The objective of this foundational requirement is to protect data from unauthorized disclosure, either when being transmitted or while stored. Not only does this imply protecting communication channels and storage, it also requires organizations to define what data must be protected and who should have access to it.

How can Cisco help?

MACsec is the IEEE 802.1AE standard for authenticating and encrypting packets between two MACsec-capable devices. Cisco Catalyst IE3400 Rugged Series switches, for example, support 802.1AE encryption with MACsec Key Agreement (MKA) on switch-to-host links for encryption between the switch and capable host devices. The switch also supports MACsec encryption for switch-to-switch security using Cisco TrustSec Network Device Admission Control (NDAC), Security Association Protocol (SAP), and MKA-based key exchange protocol.

Protecting data while stored is out of scope for Cisco, and further considerations should be applied to do so.

Table 4.        System requirements for data confidentiality

FR5: Restricted Data Flow (RDF)

Rationale

The objective of this foundational requirement is to restrict seamless communications between components to enforce the least privilege principle that the standard recommends. Restricting communications is achieved by segmenting the IACS network to support the zones and conduits defined by each organization based on its risk assessment and the security level it wants to reach. Network segmentation is acknowledged as an efficient way to reduce the exposure of the control system to cyberthreats and limit the spread of attacks. It is also leveraged to respond to an incident by breaking connections between different network segments.

How can Cisco help?

The industrial Demilitarized Zone (IDMZ) is the buffer between critical environments or production floor systems and the enterprise network. All shared services between the industrial zone and the enterprise zone will be located at the IDMZ. Cisco provides boundary or “edge” security appliances such as the Cisco Secure Firewall that can inspect traffic as it enters and exits each security zone, as well as replication services such as the Cisco Telemetry Broker to bridge the gap between the critical network and the noncritical network while maintaining a segmented network.

Within the plant itself, and to support the zones and conduits model proposed by IEC 62443, Cisco ISE uses TrustSec technology to logically segment control system networks. Cisco TrustSec classification and policy enforcement functions are embedded in Cisco switching, routing, wireless LAN, and firewall products. At the point of network access, a Cisco TrustSec policy group called a Security Group Tag (SGT) is assigned to an endpoint, typically based on that endpoint’s user, device, and location attributes. The SGT denotes the endpoint’s access entitlements, and all traffic from the endpoint will carry the SGT information. The SGT is used by switches, routers, and firewalls to make forwarding decisions. Because SGT assignments can denote business roles and functions, Cisco TrustSec controls can be defined in terms of business needs and not underlying networking detail.

Cisco Cyber Vision helps define these business roles. Cyber Vision leverages a unique combination of passive and active discovery to identify all your assets with no risk to devices and processes. As discovery is performed by your industrial network elements, inquiries are not blocked by firewalls or Network Address Translation (NAT) boundaries, resulting in 100% visibility. Cyber Vision shows assets and their communications in maps that operations teams can easily relate to their industrial processes. This gives them the opportunity to group assets into zones (production cells, for example) and define the network segmentation logic. Cyber Vision automatically shares this information with ISE to build security policies accordingly.

To meet compliance requirements, Cyber Vision maintains the history of all events and application flows, including variable accesses, so you can easily run forensic searches and build reports.

Table 5.        System requirements for restricted data flow

FR6: Timely Response to Events (TRE)

Rationale

The objective of this foundational requirement is to ensure that IACS components are properly monitored to ensure that they remain secure. These requirements are designed so that organizations implement the tools and procedures to collect forensic evidence and respond to security violations. The five security levels set different expectations for how quickly the proper authorities get notified when an event impacts the security of the systems.

How can Cisco help?

Cisco Cyber Vision maintains the history of all events and application flows. It enables you to quickly understand your current security status, identify anomalies and vulnerabilities, and respond to threats. Cyber Vision offers various dashboards, reports, and event histories to easily spot security concerns. Additionally, Cyber Vision integrates the Snort IDS engine leveraging Cisco Talos threat intelligence to detect known and emerging threats such as malware or malicious traffic.

Cyber Vision is preintegrated with leading SIEM and Security, Orchestration, Automation, and Response (SOAR) platforms such as IBM QRadar and Splunk and can forward OT events and alerts to any other tool using syslog. To avoid event fatigue, it even lets you choose which event types should be shared.

Cisco SecureX aggregates intelligence from both Cisco security product and third-party sources to identify whether observables such as file hashes, IP addresses, domains, and email addresses are suspicious. When you start an investigation, context is automatically added from integrated Cisco security products, so you know instantly which of your systems was targeted and how. It brings that knowledge back from intel sources and security products, displaying results in seconds. Cisco SecureX also provides security operations teams the ability to act immediately by triggering custom workflows or continue their investigation with the tools provided.

Table 6.        System requirements for timely response to events

FR7: Resource Availability (RA)

Rationale

The objective of this foundational requirement is to ensure that IACS components will still provide essential functions to ensure continued safe operations when running in a degraded environment, such as when a Denial-of-Service (DoS) attack occurs. This means being able to prioritize network traffic, detect deviations from baselines, recover systems from backups, and more. For all this to become feasible, organizations must maintain a detailed inventory of all their IACS components.

How can Cisco help?

The entire objective of Cisco’s industrial security architecture is to help ensure the integrity and availability of IACS resources. This is achieved through various techniques as described in the table below.

In addition, Cisco network infrastructure provides the ability to configure Quality of Service (QoS) to protect against DoS attacks. Users can select specific network traffic and prioritize it according to its relative importance. Implementing QoS in the network makes network performance more predictable and bandwidth utilization more effective. If a network segment is compromised, QoS will help ensure that the resource utilization of other network segments on the same physical infrastructure is unaffected.

Table 7.        System requirements for resource availability

Starting your ISA/IEC-62443-3 journey

For over 15 years, Cisco has been helping industrial organizations around the globe digitize their operations by developing a market-leading networking portfolio that is purpose-built for industrial use cases. Our deep understanding of OT requirements plus a comprehensive cybersecurity portfolio is a rare combination.

Cisco believes that a solid and flexible network architecture is a key success criterion for robust security. Poor network design can create a huge vulnerability and hinders the concepts of segmentation and extensibility, as well as the integration of cybersecurity controls and physical security measures.

However, our experience shows that building a secure industrial network will not happen overnight. To help ensure success, Cisco promotes a phased approach in which each phase builds the foundation for the next so that you can enhance your security posture at your own pace and demonstrate value to all stakeholders as you embark on this journey.

Building on the ISA/IEC-62443-3 zones and conduits concept, Cisco has developed a reference architecture that describes the various steps organizations should follow to secure their industrial control systems while building compliance with the standard. The Cisco Industrial Security Validated Design (CVD) meets the needs of operations as defined by ISA/IEC-62443-3 and also leverages the NIST cybersecurity framework that IT and security teams are more familiar with.

The pillars of the NIST cybersecurity framework

Discover

Visibility into all industrial assets and their application flows is provided by Cisco Cyber Vision. It creates dynamic inventories with detailed information on all connected devices, tracks communication activities to monitor zones and conduits, and helps drive risk assessments by identifying the IACS exposure to cyberthreats. Cyber Vision sensors are embedded into the cell/area network equipment to provide visibility at scale.

Segment

The industrial network is segmented from the enterprise network by an Industrial Demilitarized Zone (IDMZ) implemented by Cisco Secure Firewalls. It can also be used to segment the various parts of the industrial network so that each segment forms a semiautonomous zone to limit and contain security incidents within a zone.

For more granular segmentation and dynamic access control, Cisco Identity Services Engine (ISE) automatically enforces security policies at the device level. It leverages zones configured by control engineers in Cyber Vision to instruct the network to restrict communication flows accordingly.

Cisco ISE can also restrict activities from remote users gaining VPN access to the industrial network using Cisco Secure Client (which includes AnyConnect). Cisco Secure Equipment Access is another remote-access solution that grants access only to individual devices. Both solutions can leverage MFA using Cisco Duo.

Detect

Cisco Cyber Vision alerts you to hardware and software vulnerabilities that need to be patched for each OT device and also integrates a Snort IDS engine to detect intrusions and malicious traffic. This comprehensive visibility into OT network activities lets you build baselines to detect any deviations from normal behaviors.

Cisco Secure Network Analytics (formerly Cisco Stealthwatch) also helps detect anomalies by collecting telemetry from network devices and monitoring network flows.

Cisco Secure Firewall integrates Cisco Secure IPS, Secure Firewall Malware Defense, advanced Distributed DoS (DDoS) mitigation, and URL filtering to offer comprehensive intrusion detection and protection. It can also leverage Talos signature files to block vulnerability exploits.

Cisco Secure Endpoint offers advanced malware protection for your various endpoints (workstations, servers, laptops, tablets, etc.) and can identify which processes on the protected endpoint are talking on the network.

Respond

Cisco SecureX accelerates investigations by aggregating threat intelligence and data from multiple security technologies—Cisco and otherwise—into one unified view. It streamlines remediations by offering comprehensive case management and enabling custom playbooks for your specific environment.

Cyber Vision and other security tools can export log events to SIEM platforms for further investigation and correlation.

The Cisco Validated Design (CVD)

Cisco’s OT security reference design is a blueprint for a secured, robust, and reliable industrial network. It leverages Cisco’s comprehensive networking and security technologies to provide industrial asset visibility, macro/zone segmentation, zone access control, threat detection, and response. It enables coordination with information security for consistent access policy management and aggregation of industrial security events in the Security Operations Center (SOC).

As shown in Figure 4, this design follows the Purdue/ISA95 model and provides detailed design and implementation guidelines to achieve compliance with ISA/IEC-62443-3.

Cisco’s industrial security architecture (source: Cisco OT Security Validated Design)

Summary

As with any other security measure, the protection of industrial automation and control systems is not a product, it is a continuous process. This applies to component development comprising hardware and software, operation, maintenance, and any other related activity. Cisco is addressing this essential paradigm not only in product development based on Cisco SDL but also in improving architectural and deployment references such as the Cisco Validated Designs.

Links and references

●      ISA99 standard committee

●      IEC62443-3-3 standard download

●      Cisco Validated Design for industrial security

●      Cisco Industrial Threat Defense solution for securing industrial networks

●      Cisco Secure Development Lifecycle (Cisco SDL)

●      Contact Cisco to discuss your industrial security needs