ISA-IEC-62443 Helping Asset Owners Determine Required Security Levels to Meet Business and Risk Needs

Helping Asset Owners Determine Required Security Levels to Meet Business and Risk Needs Detailed Explanation

In ISA/IEC 62443, Security Levels (SL) serve as standardized metrics to measure a system's capability to resist threats. Asset owners play a critical role in determining appropriate security levels based on business priorities, risk levels, and the potential impacts of security breaches.

This section will be explained in clear and logical steps with beginner-friendly details.

2.1 Security Levels (SL)

Definition and Role of Security Levels

Security Levels (SLs) are used to categorize and measure how resilient a system or zone within IACS is to specific types of cyber threats. The SLs guide asset owners in selecting the appropriate security controls for different parts of the system.

The four security levels in ISA/IEC 62443 are:

Security Level (SL)	Definition	Protection Objectives	Example Threats
SL1	Protection against basic errors and simple attacks.	Protect from accidental errors and basic threats.	Human errors, accidental data deletion.
SL2	Protection against simple malicious attackers.	Counter low-skilled attackers with limited capabilities.	Automated scripts, basic malware, network scanning.
SL3	Protection against moderately skilled attackers.	Resist skilled attackers using advanced tools.	Targeted attacks, penetration tools, remote Trojans.
SL4	Protection against highly complex attacks.	Defend against advanced persistent threats (APT) and nation-state attacks.	APT attacks, nation-state actors.

Role of Security Levels

1. Guides Protection Measures: SLs help determine which security controls are necessary to protect assets based on their risk level and importance.
2. Zone-based Assignment:
   • Each zone and conduit within an IACS system can be assigned a different SL based on its specific threats and criticality.
3. Aligns with Security Requirements: Higher SLs impose stricter security requirements (SRs), as shown in this example:
   • SL1: Basic measures (e.g., simple authentication).
   • SL3: Requires strong authentication, encrypted communications, and intrusion detection systems (IDS).
   • SL4: Requires advanced security, like multi-factor authentication (MFA) and advanced threat detection.

Detailed Example of SLs and Corresponding Requirements

Category of Security Controls	SL1	SL2	SL3	SL4
Access Control	Basic authentication	Role-Based Access Control (RBAC)	Strong authentication, multi-factor MFA	Strong authentication with hardware security modules (HSM)
Network Security	Basic firewall	Network segmentation, simple firewalls	Encrypted communications, IDS	Advanced firewalls, Advanced Threat Protection (ATP)
System Integrity	Basic checks	File integrity checks	Real-time integrity monitoring	Advanced real-time integrity protection
Event Monitoring & Response	Logging	Automated log analysis	Real-time monitoring and alerts	Automated response, advanced event correlation analysis

2.2 How Do Asset Owners Determine Security Levels?

Asset owners are responsible for ensuring that their IACS systems meet appropriate security levels. To determine the correct SL for zones and conduits, asset owners follow a structured process.

Step 1: Identify Critical Assets

The first step is to identify the critical assets in the IACS system, including hardware, software, and data.

1. Categorize Assets:
   Assets are grouped based on their function and importance:

   • Control Devices: PLCs, DCSs, RTUs.
   • Data Storage and Transmission: SCADA databases, network communication pathways.
   • Operator Interfaces: HMIs, workstations.

2. Assess Asset Importance:
   Analyze the impact on the business if an asset is compromised:

   • Production Impact: Will production stop or slow down?
   • Safety Impact: Will physical safety be at risk?
   • Financial Impact: How much monetary loss would occur?
   • Reputational Impact: Will it damage the company’s reputation?

Step 2: Analyze Potential Threats and Risks

In this step, asset owners analyze the threats that assets may face.

1. Identify Threat Types:

   • External Threats: Hackers, APT attacks, malware.
   • Internal Threats: Malicious employees, misconfigurations, human errors.
   • Natural Threats: Power outages, equipment failures, natural disasters.

2. Threat Modeling:
   Use techniques such as attack path analysis to determine:

   • How attackers might exploit vulnerabilities (e.g., weak passwords, unpatched systems).
   • What the impact of a successful attack would be on the asset or zone.

Step 3: Conduct Risk Assessment

Risk assessment quantifies the threats and vulnerabilities to prioritize mitigation.

1. Risk Formula:

2. Steps to Assess Risk:

   • Identify Threats and Vulnerabilities: Use tools like vulnerability scanners or penetration testing tools.
   • Analyze Impact: Evaluate the potential damage caused by a successful attack.
   • Categorize Risks: Risks are categorized as High, Medium, or Low:
     • High Risk: Requires immediate action.
     • Medium Risk: Should be addressed soon.
     • Low Risk: Minimal priority.

Step 4: Determine Security Levels

Based on the results of the risk assessment and the criticality of assets, assign appropriate Security Levels (SL) to each zone and conduit.

Asset	Potential Threats	Risk Level	Assigned Security Level
Production Control Network (PLC)	Malicious attacks, remote intrusion	High Risk	SL3
SCADA Database	Data leakage, data tampering	Medium Risk	SL2
Field Sensors	Accidental failures, human errors	Low Risk	SL1

Step 5: Implement Security Control Measures

Deploy security controls corresponding to the determined Security Level:

Category	SL1	SL2	SL3	SL4
Access Control	Basic authentication	RBAC	Strong authentication, MFA	HSM-based authentication, MFA
Network Security	Basic firewall	Network segmentation	IDS, encrypted communication	Advanced firewalls, ATP
System Integrity	Basic checks	File integrity verification	Real-time integrity monitoring	Advanced real-time integrity protection
Event Monitoring	Simple logging	Automated log analysis	Real-time monitoring and alerting	Advanced event correlation and response

2.3 Responsibilities of Asset Owners

Asset owners hold the ultimate responsibility for determining and implementing appropriate security levels. Their responsibilities include:

1. Identify Key Assets and Risks: Work with system integrators and suppliers to conduct a thorough risk assessment.
2. Assign Security Levels: Define SLs for zones and conduits based on business and risk priorities.
3. Implement Security Controls: Collaborate with system integrators to deploy the necessary protective measures.
4. Continuous Improvement: Regularly perform risk assessments, monitor system security, and update security controls to address new threats.

Summary

• Security Levels (SL) help asset owners align security measures with risk levels and business needs.
• Asset owners must follow a systematic process: identify critical assets, analyze threats, conduct risk assessments, and assign SLs.
• Proper implementation of SL-specific security controls ensures the IACS system remains protected against evolving cyber threats.

Helping Asset Owners Determine Required Security Levels to Meet Business and Risk Needs (Additional Content)

1. Introduction of Foundational Requirements (FRs) and Security Requirements (SRs)

The ISA/IEC 62443-3-3 standard introduces a structured method to help asset owners define Security Levels (SLs) using Foundational Requirements (FRs) and their corresponding Security Requirements (SRs).

What are FRs and SRs?

• Foundational Requirements (FRs): These are the seven security domains that form the basis of protection for IACS.
• Security Requirements (SRs): Each FR consists of multiple SRs that provide specific, testable requirements aligned with SLs.

List of the Seven Foundational Requirements (FRs)

FR Code	Foundational Requirement	Purpose
FR1	Identification and Authentication Control	Ensure only authorized users and devices can access the system
FR2	Use Control	Restrict system access and privileges based on user roles and tasks
FR3	System Integrity	Ensure systems and software remain unaltered and function as intended
FR4	Data Confidentiality	Protect sensitive information from unauthorized disclosure
FR5	Restricted Data Flow	Control how data moves between zones and systems
FR6	Timely Response to Events	Detect, report, and respond quickly to security-related events
FR7	Resource Availability	Ensure system availability even under attack or during failure conditions

Each SL (from SL1 to SL4) specifies a different depth of implementation for each SR. For example:

• FR1.1 (Account Management) at SL1 might require basic password login.
• The same FR1.1 at SL3 could require strong passwords with MFA and role binding.

Why this matters to asset owners:

When determining required SLs, asset owners must not only set a general SL (e.g., SL2) for a zone but also ensure that the corresponding SRs under each FR are fully implemented.

2. Clear Expression of the Risk Formula

While "Risk = Threat × Vulnerability × Impact" is a conceptual model, ISA/IEC 62443 encourages a simplified quantitative model:

Risk = Likelihood × Impact

• Likelihood: The estimated probability that a given threat will exploit a vulnerability.
• Impact: The expected consequence if the threat succeeds (financial loss, safety risk, etc.).

This formula helps prioritize security investment based on real-world risk rather than theoretical possibility.

Example:

Asset	Likelihood	Impact	Risk Score
SCADA database	High	High	High
HMI workstation	Medium	Low	Medium
Sensor data	Low	Low	Low

Asset owners use this formula during risk assessment (usually in collaboration with integrators) to assign SLs and justify which zones require enhanced protections.

3. Multi-Stakeholder Collaboration in SL Determination

While asset owners hold final responsibility for defining SLs, effective security planning is not a solo effort. ISA/IEC 62443 emphasizes cross-role collaboration across the security lifecycle.

Key Collaborators:

Stakeholder	Role in SL Decision-Making
Asset Owner	Leads SL determination based on business goals, risk tolerance, and operational requirements
System Integrator	Assesses network architecture, recommends segmentation, and implements controls aligned with SL
Product Supplier	Provides components (e.g., PLCs, HMIs) that are certified or tested for required SL capabilities
Maintenance Provider	Assures ongoing compliance with SLs through updates, monitoring, and incident handling

Why this collaboration is critical:

• System Integrators may suggest SL3 for zones exposed to external networks.
• Product Suppliers ensure their devices can meet SL3 requirements under FRs/SRs.
• Maintenance Providers ensure patching schedules align with SL-defined protection.

This multi-role engagement supports consistency, interoperability, and accountability, which is a core value in ISA/IEC 62443.

Summary of Enhancements

Topic	Enhancement Summary
FR/SR Integration	Asset owners must implement FR-aligned SRs based on the SL assigned to each zone or conduit
Risk Formula Expansion	Introduced "Risk = Likelihood × Impact" for practical risk prioritization during SL decisions
Stakeholder Collaboration	Highlighted how Asset Owners work with Integrators, Suppliers, and Maintainers throughout SL planning