Author: Miles Pfefferle

5 Steps to Build an ICS Cybersecurity Maturity Program Using the IEC 62443 Standards

• Security Foundations – Cyber Security Management System (CSMS) definition
  • Develop the objectives, policies, metrics, and governance for the overall ICS security program

• Risk assessment
  • Develop a detailed view of risks at each facility, endpoint, network, and user

• Design of security program
  • Prioritize a set of initiatives to reduce risks across each area to achieve the security objectives established in phase 1

• Implementation & Testing
  • Execute the plan and conduct robust testing of solutions, stand-alone as well as in concert with each other

• Maintenance & Continuous Improvement
  • Ensure controls and execution is monitored and tracked and improvement occurs over time

For audiences that are more visual, the following diagram illustrates the five phases aligned for IEC 62443 compatibility:

Key Takeaways from IEC 62443 Standards

• Achieving IACS cybersecurity requires a combination of people, processes, and technologies. The foundational elements of a CSMS define an enterprise’s overall cybersecurity objectives including its risk tolerance, the potential impacts of events, the policies that the organization will adopt to ensure security, etc. These are not a “tool”. They require thoughtful debate and trade-offs, debated at senior levels of an organization.

However, to ensure the implementation of these policies as well as the maintenance and continuous improvement of overall security levels (SLs), technology is a critical component in the overall program. As we hear over and over, the number one challenge in achieving ICS cyber security is resources. Technology enables greater efficiency and effectiveness to reduce the resource burdens required.

• Monitoring is NOT enough. Security requires active management of the devices and systems to ensure they are secured as designed, and that security is maintained – and improved – over time. Certainly, monitoring or initial visibility is an important component. But to achieve true security level improvements, organizations need to conduct “OT Systems Management” to patch, harden configurations, manage users and accounts, manage anti-virus and other protective solutions, etc. This active management is a necessary capability in the overall Cyber Security Management System of any organization.

This point is perhaps best made in reviewing the Foundational Requirements (FR) in IEC 62443.

As seen in ISA 62443’s Foundational Requirements (FRs), monitoring technologies cannot provide sufficient overall coverage to allow asset owners to achieve an SL-T between 0 & 1 (basically, they might tell you something is wrong, but provide no level of resistance/protection).

• FRs require a wide range of security management across all Systems Under Consideration (SUC) (both device level and process level), requiring holistic security approaches.

The FRs are comprehensive across a range of security elements. IEC 62443 applies both to product development/procurement as well as to the overall process operations of industrial controls systems. Many manufacturers are pursuing SL 1 or 2 status for their products, which is a great initial outcome of the standards. But true security will require operators, themselves, to adopt the standards across their systems-of-systems. Security of the control system involves the interaction of many components, broken into “zones” and “conduits”.  IEC 62443 requires taking this system-wide look at security to increase maturity across the landscape.

To manage IEC 62443 across FRs, organizations need to manage their implementation and continuous improvement across multiple security elements and layers of SUCs.  Using just one capability to secure an OT environment would be difficult for any resource, skilled or not, but organizations need to do this across multiple capabilities. Fortunately, the ISA/IEC 62443 committees have a diverse audience of OEMs, asset owners, and security practitioners, and the focus is on a combination of management, action, monitoring, and procedure.  Each of these FRs can have specific SRs or another form of enhancement based on the use case.

If we are to continue with the philosophy that an organization’s security is made up of more than a single product’s SL-T designation, then it should stand to reason that cyber risk reduction for an asset owner must not just be for zones, conduits, devices, and endpoints – but instead inclusive of the larger ecosystem at a facility.  This would mean an asset owner needs to cover in-depth several FRs, and multiple systems, zones, and conduits.

Verve Industrial and OT Systems Management for IEC 62443

For the past 30 years, Verve has worked with industrial organizations to improve the reliability and security of their control systems. The Verve Security Center platform was built to address this type of security management in an efficient manner. Asset owners need to be enabled to act, not merely stuck with a fire alarm that cannot let them own and manage the assets they have.  They need a platform that traverses FRs and provides substantial coverage and functionality.  They also need professional service support that can help develop the right foundations and risk assessments based on experience and best practices.

It is important to note that depending on the type of asset or even the System under Consideration (SuC), the applicable FRs may change, and so do the solutions possible to enable certain controls.  For example, securing a Windows-based HMI or Historian will certainly be different than securing a PLC cabinet.  Verve provides controls, improves visibility on cyber-risks, and safely inventories across a variety of device types:

• Routers and switches
• Laptops, desktops, and servers
• Human Machine Interfaces (HMI)
• Programmable Logic Controllers (PLC)
• Flow and valve controllers/sensors
• Distributed Control Systems (DCS)

ISA 62443 alignment requires coverage across all areas of the People-Process-Technology spectrum.  In fact, it explores organizational aspects including requiring processes/procedures, maintaining asset inventories, applying security controls, and of course, having the resources or partners to do so. This means an effective security product should be robust and not limit itself to targeting one specific type of asset.  Security is not a one-time investment, but a continuous investment similar to purchasing and maintaining a vehicle.