IEC TR 62443-2-3:2015 Security for industrial automation and control systems

Part 2-3: Patch management in the IACS environment

Summary of IEC/TS 62443-2-3:2015

IEC/TS 62443-2-3:2015, titled "Security for industrial automation and control systems (IACS) - Part 2-3: Patch management in the IACS environment," provides technical guidance on managing patches for IACS environments. Its goal is to establish best practices for managing vulnerabilities and ensuring the security of IACS systems through a structured patch management process.

Key Objectives:

• Patch Management Process: The standard outlines the procedures for identifying, assessing, and applying patches to IACS components, which include industrial control systems, supervisory control and data acquisition (SCADA) systems, and distributed control systems (DCS).

• Collaboration: It emphasizes the collaboration between asset owners, integrators, and suppliers to ensure patches are applied securely and with minimal disruption.

• Risk-based Approach: Given that IACS systems often operate continuously and cannot tolerate downtime, IEC/TS 62443-2-3 promotes a risk-based approach to applying patches, prioritizing the most critical patches.

Key Aspects of Patch Management

1. Patch Identification:

2. Regularly monitoring for patch notifications from component suppliers.

3. Evaluating patches for relevance to the IACS environment.

4. Risk Assessment:

5. Assessing the impact of applying the patch on system operations.

6. Evaluating the risk of not applying the patch (vulnerabilities vs. operational risks).

7. Testing:

8. Patches must be thoroughly tested in a lab or isolated environment to ensure they do not introduce new vulnerabilities or cause disruptions to the system.

9. Deployment and Validation:

10. Implementing a step-by-step patch deployment process.

11. Validating the effectiveness of patches and ensuring system stability after application.

12. Documentation:

13. Maintaining thorough records of patches applied, including dates, vulnerabilities addressed, and system performance after patching.

14. Post-Patch Monitoring:

15. Monitoring the system for any issues post-patching, ensuring the patches work as intended and identifying any unforeseen operational disruptions.

Key Takeaways

• Collaboration is Essential: Patch management requires active collaboration between asset owners, system integrators, and component suppliers to ensure smooth, secure, and effective patching in IACS environments.

• Minimizing Downtime: Given the continuous nature of industrial operations, patch management must be carefully planned and executed to minimize operational disruptions.

• Risk-based Patching: Prioritizing patches based on the severity of the vulnerability and the potential impact on the system is critical for balancing security needs with operational requirements.

• Testing is Crucial: Patches should never be applied directly to a live system without prior testing, ensuring they do not interfere with system operations.

• Ongoing Process: Patch management is an ongoing activity, requiring continuous monitoring, updates, and improvements as new vulnerabilities and patches are discovered.

In summary, IEC/TS 62443-2-3 provides essential guidance for maintaining the security and operational continuity of IACS environments through a structured patch management process that balances security needs with the operational constraints of industrial systems.