Improve Industrial Network Security with Compliance to the IEC 62443-4-2 Standard

With the ongoing disruptions in the global supply chain, industrial enterprises are actively searching for methods to stabilize their operations and maintain their competitive edge. Embracing new technologies is a highly effective approach to ensuring resilient industrial operations. Organizations are now integrating innovative networking technologies to accelerate their digital transformation journey, enabling them to capture, transfer, and convert data into valuable insights. Nonetheless, connecting equipment introduces novel cybersecurity threats to business owners, necessitating the inclusion of security features at the component level to mitigate these risks. According to IDC’s Worldwide IT/OT Convergence 2022 Predictions*, by 2025, 30% of G2000 manufacturers will incorporate connected technologies into their products to improve reliability. By doing so, businesses can gain operational insights that enhance uptime and optimize maintenance supply chains.

As organizations integrate new technologies into their products and connect more assets, networking components play an increasingly vital role. Consequently, it is crucial that components are developed to meet these evolving requirements. This responsibility falls on discrete manufacturing companies, which must ensure secure and reliable connectivity. Industrial entities looking to leverage the array of services offered through connecting multiple devices need to ensure secure device connections in compliance with regulations and standards to uphold data accessibility, integrity, and security.

An Overview of the IEC 62443 Standard

Multiple standards outline the security framework for industrial control systems, with one of the most prominent being the IEC 62443 standard. This standard provides guidelines for implementing electronically secure Industrial Automation and Control Systems (IACS) across various network segments. Additionally, it delineates responsibilities for those engaged in automation control and other network-related duties. Currently, system integrators (SIs) often mandate that component suppliers adhere to a specific subsection of the IEC 62443 standard relevant to their devices. The image below offers a comprehensive outline of the standard, encompassing its scope, as well as roles and responsibilities critical for maintaining secure network operations.

Implementing the Standard for Enhanced Network Security

Establishing Policies and Security Management

Industrial organizations should base their security profiles and management systems on a thorough risk assessment. Felipe Sabino Costa emphasized in his white paper, A Practical Approach to Adopting the IEC 62443 Standards, the importance of an assessment capable of identifying dependencies, critical risks to operations/safety, and corresponding risk mitigation strategies. Following the establishment of policies and security systems, deploying visualization software becomes imperative to provide asset owners with real-time security status updates.

Implementing Defense-in-Depth Cybersecurity for IACS Networks

A defense-in-depth strategy suggests categorizing systems into zones and channels to mitigate risks to an acceptable level. Each zone and channel is assigned a security level based on its criticality, and network operators must enforce this stratification. This approach can be actualized through physical or logical segregation utilizing industrial secure routers, VPNs, and tailored remote access solutions for industrial automation. Additionally, networking functions like ACL (Access control lists) can aid in segmenting networks to achieve desired security levels. For enhanced protection, industrial intrusion detection/prevention systems (IDS/IPS) can be deployed to safeguard critical infrastructure from cyber threats.

Deployment of Hardened Devices With Built-in Security Features

Incorporating security features within network devices aligns with the defense-in-depth model and security management systems. Devices with built-in security components provide asset owners and SIs the assurance of meeting requisite security levels. Later in this article, the specifics of the requirements outlined in the IEC 62443-4-2 standard will be summarized.

IEC 62443-4-2 Requirements for the Automation Sector

The IEC 62443 standard encompasses various subsections tailored to individuals with unique responsibilities. As SIs increasingly demand compliance with the IEC 62443-4-2 subsection, which delineates guidelines for component suppliers, this subsection has gained significant importance. Component requirements stem from fundamental prerequisites such as account management, identifier and authenticator protocols, password-based and public key authentication, use control, data integrity/confidentiality, and resource availability backup.

Adherence to the guidelines outlined in the IEC 62443-4-2 subsection equips network operators with the tools required to safeguard their networks against cyber threats. While component suppliers must integrate specific features into their devices for deployment within Industrial IoT networks, it is vital for network operators to implement these features across their networks. Additionally, ensuring that all network users are well-versed in the guidelines and best practices dictated in the IEC 62443-4-2 subsection is paramount.

Compliance with each guideline in the IEC 62443-4-2 subsection generally leads to positive outcomes that significantly boost network security. Conversely, failure to adhere to these guidelines can leave networks vulnerable to malicious attacks, compromising their security and integrity.

Discover Moxa’s Solutions

To enhance security at the component level, Moxa has introduced the EDS-4000/G4000 Series, one of the world’s premier IEC 62443-4-2 certified Ethernet switches. Developed in compliance with the IEC 62443-4-1 software development life cycle guidelines, Moxa’s expansive product range of industrial networking devices enables customers to select devices that fortify their network security. For more information, visit our microsite www.moxa.com/Security.

* IDC FutureScape: Worldwide IT/OT Convergence 2022 Predictions, Doc #US47131521, October 2021.