A Comprehensive Framework for Security in Engineering Projects - Based on IEC 62443

Abstract

The standards family IEC 62443 represents an international agreement on best practices for securing Industrial Automation Control Systems (IACS). Engineering projects have to address security, but have limits on cost and resources, which makes it particularly challenging to cover all security topics adequately, as prescribed by IEC 62443. We developed a framework that supports engineering projects in addressing the whole range of security aspects more effectively and efficiently. The framework is structured horizontally and vertically. Horizontally, the framework consists of a set artefacts that cover the security aspects as prescribed by IEC-62443, and that need to be filled out by an engineering project. The vertical structure reflects the organizational hierarchy. In each hierarchical layer, the artefact templates are enriched by increasingly detailed and specific guidance in the form of best practices and references. This enables the exchange and reuse of security designs and best practices across the organization. We describe our experiences in applying the framework in large scale industry projects.