Long protected by isolation from the network, industrial sector organizations now find themselves facing increasing cyber risk. The convergence of IT and operational technology (OT) creates new opportunities for efficiency and innovation–and introduces the possibility of exploitation.
Industrial automation and control systems (IACS) are increasingly targeted by threat actors. Unlike IT environments, OT systems often rely on third-party vendors and contractors; this, unfortunately, often leaves extra doors open for bad actors.
The risks of compromise for essential infrastructure are catastrophic. To mitigate risk, organizations must adopt a defense-in-depth approach, guided by the horizontal standards in IEC 62443. Encryption is a critical component of this strategy, providing a safeguard against data interception, manipulation, and unauthorized access.
Let’s dig into the specific challenges of industrial cybersecurity, the importance of encryption, and how to implement PKI to protect critical infrastructure.
What is IEC 62443?
The IEC 62443 series provides a comprehensive framework for securing industrial control systems (ICS). Unlike IT systems, ICS have unique characteristics and stringent performance, availability, and longevity requirements. Moreover, the consequences of a successful attack on industrial systems can be far more severe, potentially leading to environmental disasters or loss of life.
IEC 62443 addresses these challenges by adopting a holistic approach encompassing not only technology but also human factors, work processes and countermeasures. The standard, developed in collaboration between government and industry, emphasizes risk-based methodology, focusing on protecting critical assets while maintaining operational efficiency.
There are four primary parts to the framework:
- General: Establishing foundational concepts, terminology, and models for IACS security.
- Policy & Procedures: Outlining methods and process to implement and manage IACS security programs, including patch management and security service provider requirements.
- System: Focusing on the system-level security of tools, risk assessments, and overall security requirements.
- Components & Requirements: Providing detailed security specifications for individual embedded devices, network components, and software applications.
IEC 62443 plays a vital role in safeguarding critical infrastructure and mitigating the risks associated with cyberattacks, and cryptography plays its own necessary part in successfully protecting industrial networks.
Where does PKI fit into IEC 62443?
Public key infrastructure (PKI)–a cryptographic system for creating, managing, distributing, storing and revoking digital certificates to verify the identity of entities in electronic communications–is particularly relevant to the transport and application layers of industrial automation and control systems. These layers are responsible for the transmission and structuring of data between the digital architecture of your overall IACS, including devices such as:
- Programmable Logic Controllers (PLCs): Industrial computers controlling machines and processes
- Remote Terminal Units (RTUs): Devices that collect data from sensors and control equipment in remote locations
- Supervisory Control and Data Acquisition (SCADAs): Systems that monitor and control industrial processes, including PLCs and RTUs, to enable high-level supervision over wide surface area
- Human-Machine Interfaces (HMIs): Interfaces allowing humans to interact with machines and processes
The transport layer ensures reliable data delivery through protocols like HTTPS and TLS, which encrypt data in transit. Meanwhile, the application layer defines how data is structured and exchanged, using protocols like Modbus, OPC and DNP3. While these protocols have their own security mechanisms, they often rely on PKI for authentication and encryption.
By leveraging certificates and trusted Certificate Authorities (CAs), PKI establishes a robust trust framework within the industrial control system. This ensures that only authorized devices and systems can communicate, mitigating the risk of unauthorized access and data tampering. The PKI “digital passport” verifies the identity of each entity within the network, hardening the overall security against unwanted intrusion.
Without cryptography and certificates, unauthorized users can intercept data, lurk and move laterally on systems and exploit vulnerabilities for malicious gain. A robust PKI management system blocks those unauthorized points of entry, forcing every digital identity to prove its authenticity before proceeding with data exchange.
What else does PKI affect?
Beyond securing data transmission, PKI plays a pivotal role in several other critical industrial security processes:
- Code signing: Encrypted code signing prevents malicious code injection and guarantees that only authorized software is executed.
- Secure boot: Secure boot protects device startup by verifying the digital signatures of bootloaders and firmware, preventing unauthorized modifications. However, many secure boot implementations rely on native asymmetric cryptography instead of PKI, which can pose risks. While this approach leverages the chip’s built-in security, it often creates dependency on the chip vendor, potentially impacting your product security strategy.
- Over-the-air (OTA) updates: PKI secures the distribution and installation of software updates, protecting against tampering and ensuring only legitimate updates are applied.
- Mobile code execution: PKI authenticates and authorizes the execution of dynamic code, mitigating the risks associated with malicious scripts or applications.
The PKI network communicates between IT and OT systems. PKI secures the distribution and exchange of key material between devices and systems and enables protection of the keys themselves from unauthorized tampering. Unique machine identities marking each device for mutual authentication ensures only authorized devices can access networks and services.
In all of these processes, PKI leverages the power of cryptography to establish a trusted framework for industrial automation and control systems, forcing each device to prove its authenticity every time rather than assuming trustworthiness. Even when cyber attackers may target third-party vendors, PKI can prevent them from reaching your systems. For IACS, where reliability, security and operational continuity are paramount, PKI makes it possible to authenticate, validate and secure the most important elements of your organization’s infrastructure against bad actors.
Automation powers your systems, and it also powers your cybersecurity.
Large-scale industrial operations with numerous devices and systems need automated PKI management tools to consistently protect PKI exchanges across the environment and streamline certificate lifecycle management from issuance and deployment to revocation and renewal. Relying on manual processes for issuing, renewing, storing and revoking certificates just doesn’t make sense–especially when your production line likely uses automation itself.
Automated PKI management reduces administrative burden to your security team and minimizes human error, just as it does in your plants, factories and warehouses. Moreover, automated PKI management helps organizations achieve and maintain compliance with standards like IEC 62443–or any other compliance controls important to your industry.
Integrating industrial PKI management alongside your other security controls creates a comprehensive and layered approach to cybersecurity that complements the holistic strategy of IEC 62443.
Industrial Cyber Resilience Protects Critical Systems
As the stakes in cybersecurity continue to rise, IEC 62443 will likely be joined by other standards and frameworks promoting a defense-in-depth strategy for industrial control systems. PKI plays a pivotal role in this strategy. It provides the foundation for digital trust and security across the industrial environment by securing data transmission, enabling code signing, protecting firmware and facilitating secure updates.
While the journey to a fully secure industrial environment is ongoing, organizations running on legacy equipment should begin proactive steps now. Industrial control system components at the end of their digital life may never receive another security update from the developer, leaving doors open to cyber attack. Reduce the risk exposure of IACS and protect your operations by adopting a risk mitigation approach and security technologies like PKI management for Industrial Control Systems.
Accelerate your journey to IEC 62443 compliance and protect your business by implementing PKI solutions from expert advisors like Keyfactor. Enterprise tools can give you visibility and automate control over your organization’s PKI to avoid critical outages and prevent exploitation.
Ready to see the possibilities of PKI in action? Request a demo and start securing your organization’s future.
