Free Access ISA ISA-IEC-62443 New Release

An intrusion detection system (IDS) is a network security tool that monitors network traffic and devices for known malicious activity, suspicious activity or security policy violations. The IDS sends alerts to IT and security teams when it detects any security risks and threats. However, an IDS does not block or prevent the malicious activity, it only detects and reports it. Therefore, an IDS is not the lock on the door for networks and computer systems, nor is it effective against all vulnerabilities in networks and computer systems. An IDS can be combined with an intrusion prevention system (IPS) to block the malicious activity in real time. References:

• What is Intrusion Detection Systems (IDS)? How does it Work? | Fortinet1
• Intrusion Detection System (IDS) - GeeksforGeeks2
• What is an intrusion detection system (IDS)? - IBM3

Phishing is a type of cyberattack that relies on a human weakness to succeed. Phishing is the practice of sending fraudulent emails or other messages that appear to come from a legitimate source, such as a bank, a government agency, or a trusted person, in order to trick the recipient into revealing sensitive information, such as passwords, credit card numbers, or personal details, or into clicking on malicious links or attachments that may install malware or ransomware on their devices. Phishing is a common and effective way of compromising the security of industrial automation and control systems (IACS), as it can bypass technical security measures by exploiting the human factor. Phishing can also be used to gain access to the IACS network, to conduct reconnaissance, to launch further attacks, or to cause damage or disruption to the IACS operations. The ISA/IEC 62443 series of standards recognize phishing as a potential threat vector for IACS and provide guidance and best practices on how to prevent, detect, and respond to phishing attacks. Some of the recommended countermeasures include:

• Educating and training the IACS staff on how to recognize and avoid phishing emails and messages, and how to report any suspicious or malicious activity.
• Implementing and enforcing policies and procedures for email and message security, such as using strong passwords, verifying the sender’s identity, and not opening or clicking on unknown or unsolicited links or attachments.
• Applying technical security controls, such as antivirus software, firewalls, spam filters, encryption, and authentication, to protect the IACS devices and network from phishing attacks.
• Monitoring and auditing the IACS network and devices for any signs of phishing attacks, such as anomalous or unauthorized traffic, connections, or activities, and taking appropriate actions to contain and mitigate the impact of any incidents. References:
• ISA/IEC 62443-1-1:2009, Security for industrial automation and control systems - Part 1-1: Terminology, concepts and models1
• ISA/IEC 62443-2-1:2009, Security for industrial automation and control systems - Part 2-1: Establishing an industrial automation and control systems security program2
• ISA/IEC 62443-2-4:2015, Security for industrial automation and control systems - Part 2-4: Security program requirements for IACS service providers3
• ISA/IEC 62443-3-3:2013, Security for industrial automation and control systems - Part 3-3: System security requirements and security levels4
• ISA/IEC 62443-4-2:2019, Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components5

Asymmetric (public) key algorithms are a type of cryptographic algorithms that require more than one key. Asymmetric key algorithms use a pair of keys, one for encryption and one for decryption, that are mathematically related but not identical1. The encryption key is usually made public, while the decryption key is kept private. This allows anyone to encrypt a message using the public key, but only the intendedrecipient can decrypt it using the private key1. Asymmetric key algorithms are also known as public key algorithms or public key cryptography1. Asymmetric key algorithms are used for various purposes, such as digital signatures, key exchange, and encryption2. Some examples of asymmetric key algorithms are RSA, Diffie-Hellman, ElGamal, and Elliptic Curve Cryptography2.

References: Asymmetric Algorithm or Public Key Cryptography - IBM, Cryptography 101: Key Principles, Major Types, Use Cases & Algorithms | Splunk.

 Access control is the process of granting or denying specific requests to obtain and use information and related information processing services. It is one of the foundational requirements (FRs) of the ISA/IEC 62443 standards for securing industrial automation and control systems (IACSs). According to the ISA/IEC 62443-3-3 standard, access control includes the following system requirements (SRs):

• SR 1.1: Identification and authentication control
• SR 1.2: Use control
• SR 1.3: System integrity
• SR 1.4: Data confidentiality
• SR 1.5: Restricted data flow
• SR 1.6: Timely response to events
• SR 1.7: Resource availability

Among these SRs, the ones that are most related to the critical variables of account management and password strength are SR 1.1 and SR 1.2. SR 1.1 requires that the IACS shall provide the capability to uniquely identify and authenticate all users, processes, and devices that attempt to establish a logical connection to the system. This means that the IACS should have a robust account management system that can create, modify, delete, and monitor user accounts and their privileges. It also means that the IACS should enforce strong password policies that can prevent unauthorized access or compromise of user credentials. Password strength refers to the level of difficulty for an attacker to guess or crack a password. It depends on factors such as length, complexity, randomness, and uniqueness of the password.

SR 1.2 requires that the IACS shall provide the capability to enforce the use of logical connections in accordance with the security policy of the organization. This means that the IACS should have a mechanism to control the access rights and permissions of users, processes, and devices based on their roles, responsibilities, and needs. It also means that the IACS should have a mechanism to audit and log the activities and events related to access control, such as successful or failed login attempts, password changes, privilege escalations, or unauthorized actions.

Therefore, account management and password strength are the critical variables related to access control, as they directly affect the identification, authentication, and authorization of users, processes, and devices in the IACS.

References:

• ISA/IEC 62443-3-3:2013, Security for industrial automation and control systems - Part 3-3: System security requirements and security levels1
• ISA/IEC 62443 Cybersecurity Fundamentals Specialist Certificate Program2
• ISA/IEC 62443 Cybersecurity Library3
• Using the ISA/IEC 62443 Standards to Secure Your Control Systems4