Hardware Holds The Key To Making Industrial Systems IEC 62443 Compliant

By Christophe Tremlet and Michael Jackson

The previous blog in this series showed how Analog Devices’ hardware solutions can secure next-generation 10BASE-T1L field instruments against threats from intruders, thus preventing them from offering a ‘backdoor’ for accessing critical industrial infrastructure. The blog provides a higher-level perspective on protecting industrial automated and control systems (IACS), as defined in IEC 62443, and shows manufacturers how they can simplify the pathway towards ensuring their equipment complies with the standard.

What is IEC 62443?

IEC62443 is a set of standards for securing Industrial Automation and Control Systems (IAC) against cybersecurity threats. It includes a comprehensive series of documents that provide a thorough set of recommendations for defending industrial networks against today’s cybersecurity threats and those that may emerge in the future. With cyberattacks on IACS increasing exponentially every year, meeting the requirements defined by IEC 62443 can provide asset owners, system integrators, and product suppliers with the reassurance they have assessed risks and identified and applied preventive countermeasures that reduce vulnerabilities to acceptable levels. 

Overview of the IEC 62443 Standards

As shown in Figure 1, IEC 62443 is organized into four categories: General, Policies and Procedures, System, and Component:

• The General documents provide an overview of the industrial security process and introduce essential concepts and models.
• The documents on Policies and procedures highlight the importance of policies and ensuring that people are properly trained and committed to supporting them.
• Security can only be understood as part of a fully integrated system, therefore the System documents provide essential guidance on designing and implementing secure IACS systems.
• Finally, the Component documents describe the requirements that must be met for secured industrial components, this is the focus of this blog

Figure 1 The IEC 62443 set of standards

Using the approaches described in IEC62443, industry stakeholders can assess cybersecurity risks to their systems and decide how best to address them. Recognizing that not all systems are equally critical, the standard identifies four security levels (SLs): from SL 1 (low security) to SL 4 (resistant against nation-state level attacks). The system-level sections of the standard (IEC 62443-3-3) define the methodology for system integrators to establish target security levels (SL-T) for components like field instruments. Field instruments designers can find the security requirements to meet for attaining these levels in the subsection IEC 62443-4-2.

Figure 2 IEC62443 Security Levels

Implementing IEC 62443 is Challenging

While IEC 62443 offers many benefits, implementing the standard also brings challenges - the standard is very detailed - it already runs to nearly 1000 pages, meaning stakeholders must devote a significant amount of time and effort to reading and interpreting the complete standard. IACS users can benefit by drawing on the experience of a proven hardware security supplier like Analog Devices who can offer additional support, advice, and guidance in implementing IEC62443 compliant industrial systems.

Use Analog Devices’ secure Authenticators on the path to IEC 62443-4-2 Compliance

IEC 62443-4-2 defines requirements for different types of industrial systems, with those applicable to field instruments including:

• Common security constraints (CSC)
• Common requirements (FR)
• Embedded device requirements (EDR)

Table 1 below shows a simplified mapping of IEC 62443-4-2 requirements to security functions and Analog Devices’ secure authenticators features, meaning users can be confident they can be used as part of their roadmap towards making their industrial systems comply with the standard.

­Analog Devices has designed its secure authenticator products (also referred to as secure elements) to make it easy and efficient for industrial equipment manufacturers to implement the security functions listed above. These single-function ICs offer a turnkey security solution, coming with a full software stack to run on the system microcontroller. These hardware solutions effectively enable manufacturers to outsource responsibility for the equipment’s security to the proven expertise of a trusted chip supplier.

• AES 128 and 256 bits are supported by DS28S60 and MAXQ1065 with protection against side-channel attacks
• Public key cryptography calls for computing power, which is often not available in embedded MCU, secure authenticators offload the processor from computing-intensive tasks
• Analog Devices’ secure authenticators similarly combine multiple cryptographic algorithms when required. This is the case for the TLS (Transport Layer Security) protocols and secure boot/ secure update functions
• Analog Devices can factory-program keys and X509 certificates in MAXQ1065 and thus make PKI deployment easy
• Physical security is taken to unprecedented levels thanks to ChipDNA physically unclonable function (PUF) technology

Please refer to our previous blog for a practical example of how to implement these concepts.

Find the final blog in this series here.