Question
What do the IEC 62443 security levels SL 0 to SL 4 mean, and what are they used for?
Answer
They grade how strong an attacker a component must withstand, from no protection (SL 0) up to a sophisticated, well-resourced, highly motivated attacker with IACS-specific knowledge (SL 4). They are used to tailor the IEC 62443-4-2 component controls.
* Each security level is defined by the attacker it must hold off. *
IEC 62443 is the security standard for industrial automation and control systems (IACS). Each level is defined by the attacker it holds off, not by a list of features:
| Level | Protects against |
|---|---|
| SL 0 | No special requirement |
| SL 1 | Unintentional or accidental misuse |
| SL 2 | Intentional misuse by simple means: few resources, general skills, low motivation |
| SL 3 | Sophisticated means, moderate resources, IACS-specific knowledge, moderate motivation |
| SL 4 | Sophisticated means, extensive resources, IACS-specific knowledge, high motivation |
The SL is set per component or product. It then decides which requirements of part 4-2 apply. Higher levels add requirement enhancements, for example hardware-backed key storage. The jump from SL 1 to SL 2 is the jump from accidents to deliberate attackers. From SL 3 upwards the attacker knows industrial systems specifically.
Go deeper:
ISA — ISA/IEC 62443 series of standards — the standards body page with the part structure- IEC 62443 (Wikipedia) — overview of all parts, security levels and maturity levels
Note saved — thanks!
Question
What separates a good security requirement from a bad or an ugly one?
Answer
A good one is specific and verifiable: it names the component, the control and the exact expected state. Bad ones point in a direction but cannot be tested. Ugly ones are slogans.
| Product requirement | Technical requirement | |
|---|---|---|
| Good | "The system shall be certified to Common Criteria protection profile PP0084, to fulfil MNO certification requirements" | "The Control Unit Windows Firewall shall block all inbound and outbound connections on all Ethernet and Wi-Fi interfaces, except TCP 443 inbound from 10.123.12.3" |
| Bad | "Relevant components shall be FIPS certification ready" | "All network interfaces shall be protected by firewalls" |
| Ugly | "The product shall provide state-of-the-art security" | "The system shall be hardened" |
The good examples are S.M.A.R.T. (specific, measurable, achievable, relevant, time-bound). They also carry their rationale: PP0084 is required because the mobile network operator demands it. A tester can write a pass or fail test straight from them. "Relevant components" and "FIPS ready" leave open which components and what "ready" means. "State of the art" and "hardened" cannot fail any test, so they guarantee nothing.
Go deeper:
- SMART criteria (Wikipedia) — origin and variants of the S.M.A.R.T. checklist
Note saved — thanks!