IEC 62443 – Industrial Information Security Standard – Pilz

The development of IT technology is changing all industries, and automation is no exception, with the networking of production equipment and the use of standard protocols such as Ethernet for the physical transmission of data, and standardized protocols such as OPC UA allowing access to controllers through IT systems, making data communication more open.

In the field of automation, the term "security" mainly refers to protecting equipment or machines from unauthorized access from the outside, as well as protecting sensitive data from internal damage, loss, and unauthorized access. It starts with access control at the factory gate and extends to defenses against hacker attacks. Germany IT security expert Ralph Langner believes that it is not always the "bad guys" who cause damage. Many security breaches occur unintentionally, such as co-worker and employee errors.

Industrial Information Security vs IT Information Security

The goal of both industrial and IT security is to protect the confidentiality, integrity and availability of the network. It's just that the priorities of individual goals will be different.

IT information security achieves goal priority

1. Confidentiality

2. Integrity

3. Availability

IT information security, in order to protect user information security and prevent the occurrence of information theft, confidentiality is the first priority, and availability is the last.

Industrial information security achieves goal priorities

1. Availability

2. Integrity

3. Confidentiality

The order in which industrial security achieves goals is reversed. The availability of all components is the first consideration, integrity comes second, and confidentiality is often the last consideration.

Because industrial data is in its original format, it needs to be analyzed in order to capture its value. The availability of the system has a direct impact on the production of the enterprise, and the shutdown or malfunction of the production line may lead to huge economic losses and even the danger of human life. Even after the protection of the industrial control system is breached, the safety of the production process must still be guaranteed, and the loss of people, the environment and assets must be minimized.

Real-time performance is another big difference between industrial information security and IT information security. IT network systems are able to accept tasks to be completed in 1 second or a few seconds, while industrial control systems require response times in the millisecond range.

In addition, industrial information security must ensure continuous operability and stable system access and system performance.

Therefore, traditional information security technology cannot be simply applied to the field of industrial automation.

IEC 62443 – Industrial Information Security Standard – Pilz

　　IEC 62443 – International standard for industrial information security

IEC62443 "Industrial Communication Networks – Network and System Security" is an international standard that comprehensively covers information security issues in the field of automation and provides directional guidance for plant operators and equipment manufacturers to effectively implement security protection.

IEC62443 standard is divided into four parts, 12 documents:

● The first section describes general aspects of information security, such as terms, concepts, models, acronyms, compliance metrics.

● The second part is mainly aimed at the user's information security procedures, mainly including the management, personnel and program design aspects of the rectification information security system, which are the needs of users to consider when establishing their information security procedures.

● The third part focuses on the technical information security requirements required by system integrators to protect their systems. It's mostly what system integrators need to deal with when putting systems together. It includes the method of assigning the overall industrial automation control system design to various zones and channels, as well as the definition and requirements of information security assurance levels.

● The fourth part mainly focuses on the technical information security requirements for individual components provided by the manufacturer. This includes the hardware, software, and information parts of the system, as well as the specific technical information security requirements that need to be considered when developing or acquiring these types of components.

IEC 62443 – Industrial Information Security Standard – Pilz

Sections viewed

Contact

working hours