Challenges Of Using IEC 62443 To Secure IIoT

Summary

Ryan de Souza, a principal Solutions architect at AWS, discusses the application of 62443 standards to the Industrial Internet of Things (IIoT). He covers the evolution of industrial IoT, its impact on operational technology (OT), and the security challenges it introduces. De Souza highlights the importance of the ISA/IEC 62443 standards in securing OT environments and the need for updates to accommodate IIoT devices. He also touches on the role of cloud providers in IIoT security and the available certifications like the ISASecure certification for IIoT components.

Takeaways

• 😀 Ryan de Souza, a principal Solutions architect at AWS, discussed the application of 62443 standards to the Industrial Internet of Things (IIoT).
• 🏭 Industrial IoT is utilized across various industries to improve operational efficiencies, reduce downtime, enhance product quality, and create new revenue opportunities.
• 🌐 The evolving manufacturing data landscape is influenced by the convergence of Operational Technology (OT) and Information Technology (IT), leading to industrial digital transformation.
• 🔒 Security is a critical factor slowing the transition to full OT and IT convergence due to the need to protect the expanding attack surface introduced by IIoT devices.
• 📚 The 62443 standards, developed by ISA and IEC, provide comprehensive security guidance for industrial automation and control systems, though they predate IIoT.
• 🚧 Challenges in applying 62443 to IIoT include the need for updated standards to reflect IIoT's impact on OT environments and the lack of a formal role for cloud providers.
• 🔄 The introduction of IIoT upsets the traditional ISA 95 model, necessitating a move towards a zero trust security model to address the increased attack surface.
• 🌐 Technical Report 62443-4-3 offers prescriptive guidance for asset owners on integrating IIoT into OT environments while adhering to 62443 security standards.
• 🏢 The shared responsibility model in cloud security involves cloud providers securing the cloud infrastructure and asset owners securing their applications and data within the cloud.
• ⛑️ ISA Secure offers certifications like the IoT Component Security Assurance Certification for IIoT devices and is working on a system certification that will consider IIoT use cases.

Q & A

What is the main topic of the session presented by Ryan de Souza?

The main topic of the session is the application of 62443 standards to the Industrial Internet of Things (IIoT), discussing changes in the standards and certifications relevant to IIoT.

What roles does Ryan de Souza hold at AWS?

Ryan de Souza is a Principal Solutions Architect at AWS.

What are the key use cases for Industrial IoT (IIoT) devices?

Key use cases for IIoT devices include improving operational efficiencies, reducing unplanned downtime through predictive maintenance, enhancing product quality, improving supply chain management, and creating new revenue opportunities with smart products and services.

How does the introduction of IIoT change the traditional OT environment?

The introduction of IIoT changes the traditional OT environment by integrating modern devices like IP-based cameras and edge gateways, leading to increased connectivity, data exchange, and new functionalities, while also expanding the attack surface and introducing new security risks.

What are the challenges in applying 62443 standards to IIoT?

Challenges include the fact that 62443 predates IIoT and thus needs updating, the lack of a formal role for cloud providers in the standards, and the need for a shift from a segmented environment to a zero trust security model due to the increased connectivity of IIoT devices.

What is the significance of the technical report 62443-4-3?

The technical report 62443-4-3 provides prescriptive guidance for asset owners on introducing IIoT into OT environments while adhering to 62443 security standards. It discusses the application of 62443 to IIoT and is seen as valuable for asset owners.

What is the purpose of the Zone and Conduit models in the context of IIoT?

The Zone and Conduit models are used to understand threats and vulnerabilities in IIoT environments, informing risk assessments and helping to manage the security of different layers of the OT stack.

What is the shared responsibility model for cloud security?

The shared responsibility model distinguishes between 'security of the cloud' and 'security in the cloud'. Cloud providers are responsible for security of the cloud infrastructure, while asset owners are responsible for security in the cloud, which includes their applications and data within the cloud.

What security capabilities can cloud providers offer to support IIoT implementations?

Cloud providers can offer capabilities such as connected asset inventory, identity and access control, over-the-air updates, securing the industrial edge, encrypting data at rest and in transit, alerting and monitoring, security analytics, and backup and recovery of OT and IIoT data.

What certifications are available or in progress for IIoT devices and systems?

The IIoT Component Security Assurance Certification is available for IIoT devices and gateways, based on 62443-4-1 and 62443-4-2 standards. The System Certification, which will consider IIoT use cases, is a work in progress and will be based on 62443-4-1, 62443-3-3, and 62443-2-4.