IEC 62443
A zone of its own around the equipment, without rebuilding the network
IEC 62443 is a series of standards for security in industrial control systems. The standard describes how you divide a plant into zones with controlled connections between them. The division can be hard to carry out.
Zones
Why dividing a plant into zones is hard
Part 3-2 of the standard describes how to divide a plant into zones based on risk. It also describes how to protect the connections between the zones. The standard calls these connections conduits. Together they are known as zones and conduits.
The problem is that the division requires you to know every dependency in the network. Changes to the network can also require stopping operations.
A Lock can form a zone around one machine or a group of machines. Encryption and certificates protect the connection into the zone. You do not need to map the whole plant first. You only need to decide who may connect to that particular zone. Traffic Discovery in the Lock shows which traffic is needed between the zones.
The foundational requirements
The seven foundational requirements and what XoT helps with
The standard sets seven foundational requirements. They are called FR 1 to FR 7, where FR stands for foundational requirement. The table shows which of them XoT helps with. The rows where XoT helps are highlighted in green.
| Requirement | Area | XoT |
|---|---|---|
| FR 1 | Identification and authentication | Yes |
| FR 2 | Control of what users may do | Yes |
| FR 3 | Protection against unauthorised changes to the system | Partly |
| FR 4 | Data confidentiality | Yes |
| FR 5 | Restricted data flow | Yes |
| FR 6 | Timely response to events | Partly |
| FR 7 | Availability of the system | No |
XoT helps fully with four requirements and partly with two. FR 7 concerns the availability of the control system itself. A product for access control cannot guarantee that.
Requirement by requirement
How XoT helps
FR 1 – identification and authentication
Authorisation is based on certificates, not on addresses. The user and the Lock check each other twice a minute.
FR 2 – control of what users may do
The policy states who may connect, to which equipment, from where and when. The Lock stops everything that the policy does not allow. The requirement also covers logging of security events. The XMS logs every connection and every change to policies and access rights, with the time and who made it.
FR 3 – protection against unauthorised changes, partly
Among other things, this requirement covers protecting communication from being altered on its way. The WireGuard encryption provides that protection. XoT does not affect the protection of the control system itself.
FR 4 – data confidentiality
WireGuard encrypts the traffic between the user and the Lock.
FR 5 – restricted data flow
Traffic only flows between an authorised user and the equipment that the rule covers. The Lock stops all other traffic.
FR 6 – timely response to events, partly
The XMS logs every connection and can send the log to a SIEM system, which collects logs from across the organisation. The Lock can send a copy of the traffic to an intrusion detection system. If the SIEM detects a threat, it can revoke access or isolate a session in XoT. The procedures for handling the event are your organisation's responsibility.
Security levels
About the security levels SL 1 to SL 4
Part 3-3 of the standard describes four security levels, SL 1 to SL 4. SL stands for security level. The level reflects how skilled and well-resourced the attackers are that the system must withstand.
The system as a whole decides which level a plant reaches, not a single product. That is why we do not claim that XoT gives a particular level. But we can describe exactly what XoT does. That is the material your system integrator needs.
Common questions
Is XoT certified to IEC 62443?
No. Our development follows the practices in part 4-1, which covers secure product development. We claim no maturity level and no security level.
Can we start without a finished zone model?
Yes. You can start with one machine or a group of machines and continue from there.
How do we describe XoT in our documentation?
Describe the Lock as the boundary of a zone and the connection into it as a protected conduit. We are happy to describe how the connection is protected.
What we write here is our interpretation of the standard. It is not a certification.
Xertified as a supplier
Assess us as a supplier
This page shows how XoT helps you. Our own development follows the practices in part 4-1 of the standard. How we develop and test XoT is described under Quality.
Ask for material
We are happy to explain how XoT relates to the foundational requirements in IEC 62443.