IEC 62443
A zone of its own around the equipment, without rebuilding the network
IEC 62443 is a series of standards for security in industrial control systems. The standard describes how you divide a plant into zones with controlled connections between them. The division can be hard to carry out.
Zones
Why dividing a plant into zones is hard
Part 3-2 of the standard describes how to divide a plant into zones based on risk. It also describes how to protect the connections between the zones. The standard calls these connections conduits.
The problem is that the division requires you to know every dependency in the network. Changes to the network can also require stopping operations.
A Lock can form a zone around one machine or a group of machines. Encryption and certificates protect the connection into the zone. You do not need to map the whole plant first. You only need to decide who may connect to that particular zone.
The foundational requirements
The seven foundational requirements and what XoT helps with
The standard sets seven foundational requirements. They are called FR 1 to FR 7, where FR stands for foundational requirement. The table shows which of them XoT helps with.
| Requirement | Area | XoT |
|---|---|---|
| FR 1 | Identification and authentication | Yes |
| FR 2 | Control of what users may do | Yes |
| FR 3 | Protection against unauthorised changes to the system | Partly |
| FR 4 | Data confidentiality | Yes |
| FR 5 | Restricted data flow | Yes |
| FR 6 | Timely response to events | Partly |
| FR 7 | Availability of the system | No |
XoT helps fully with four requirements and partly with two. FR 7 concerns the availability of the control system itself. A product for access control cannot guarantee that.
Requirement by requirement
How XoT helps
FR 1 – identification and authentication
Authorisation is based on certificates, not on addresses. The user and the Lock check each other twice a minute.
FR 2 – control of what users may do
The rule states who may connect, to which equipment, from where and when. The Lock stops everything that the rule does not allow.
FR 3 – protection against unauthorised changes, partly
Among other things, this requirement covers protecting communication from being altered on its way. The WireGuard encryption provides that protection. XoT does not affect the protection of the control system itself.
FR 4 – data confidentiality
WireGuard encrypts the traffic between the user and the Lock.
FR 5 – restricted data flow
Traffic only flows between an authorised user and the equipment that the rule covers. The Lock stops all other traffic.
FR 6 – timely response to events, partly
Remote Access logs every connection. You can send the log to a SIEM system, which collects logs from across the organisation. XoT can also be connected to systems that detect intrusions. Those systems do the detecting. Your organisation takes the action.
Security levels
About the security levels SL 1 to SL 4
Part 3-3 of the standard describes four security levels, SL 1 to SL 4. SL stands for security level. The level reflects how skilled and well-resourced the attackers are that the system must withstand.
The system as a whole decides which level a plant reaches, not a single product. That is why we do not claim that XoT gives a particular level. But we can describe exactly what XoT does. That is the material your system integrator needs.
Common questions
Is XoT certified to IEC 62443?
We describe what XoT does in relation to the foundational requirements. Contact us if you have questions about certification.
Can we start without a finished zone model?
Yes. You can start with one machine or a group of machines and continue from there.
How do we describe XoT in our documentation?
Describe the Lock as the boundary of a zone and the connection into it as a protected conduit. We are happy to describe how the connection is protected.
What we write here is our interpretation of the standard. It is not a certification.
Ask for material
We are happy to explain how XoT relates to the foundational requirements in IEC 62443.