Iec tr 62443 2 3 2015

I EC TR 62443-2-3 ® Ed i ti on 201 5-06 TECH N I CAL REPORT colour i n si de Secu ri ty for i n d u stri al au tom ati on an d trol system s – I EC TR 62443-2-3:201 5-06(en ) Part 2-3: Patch m an ag em en t i n th e I ACS en vi ron m en t TH I S P U B L I C ATI O N I S C O P YR I G H T P R O TE C TE D C o p yri g h t © I E C , G e n e va , Sw i t z e rl a n d Al l or ri g h t s by re s e rv e d an y e i th e r m ean s , I EC c o p yri g h t yo u r I EC 3, or or l o cal de CH -1 21 I E C's h ave IEC C e n tral ru e U n l ess o t h e r wi s e e l e c t ro n i c or m e m be r an N at i o n al e n q u i ry m em be r s pe ci fi e d , m e ch an i c al , abo u t N ati o n al no p a rt i n cl u d i n g C o m m i tte e o btai n i n g C o m m i tte e th e th i s p u bl i cati o n co u n t ry ad d i ti o n al fo r O ffi ce in of ph o to co p yi n g f u rt h e r ri g h ts of to an d th e th i s re p ro d u c e d re q u e s te r If wi t h o u t yo u h ave pl e as e or u ti l i z e d p e rm i s s i o n an y co n tac t in in an y q u e s ti o n s th e f o rm wri t i n g f ro m ab o u t a d d re s s I EC bel ow or i n fo rm a t i o n Te l : +41 22 91 02 1 Fax: + 41 22 91 03 00 G e n e va i n fo @ i e c ch 20 be p u bl i cati o n , Vare m bé S wi t z e r l a n d m ay m i cro fi l m , ww w i e c c h Abo u t th e I E C Th e I n t e rn a t i o n a l I n te rn ati o n al E l e ct ro te c h n i cal S t a n d a rd s fo r al l Com m i ssi on e l e c t ri c a l , (I E C) e l e c t ro n i c is an d th e re l ate d l e ad i n g g l o b al o rg an i z ati o n th at p re p a re s an d pu bl i s h es tech n o l o g i es Ab o u t I E C p u b l i c a t i o n s Th e te c h n i cal l ate s t e d i ti o n , co n ten t a of IEC c o rri g e n d a p u bl i cati o n s or an is ke p t am e n d m e n t u n der might co n s tan t h ave be en I EC C atal og u e - webstore i ec ch /catal o g u e Th e s tan d - al o n e b i b l i o g rap h i cal Te c h n i cal ap pl i cati o n i n fo rm ati o n on S p e c i fi cati o n s , d o cu m e n ts Avai l ab l e fo r fo r I EC PC, M ac th e I n te rn ati o n al An d ro i d e n ti re S tan d ard s , R e po rts OS , an d o th e r Tab l e ts an d i P ad ad van ce d vari e t y of s e arch e n ab l e s cri t e ri a c o m m i tte e , … ) an d th e Th e wo rl d ' s e l e ctri c al wi th d wn It to ( re fe re n c e al s o g i ve s fi n d I EC i n fo rm ati o n on P l e as e m a ke s u re th at yo u h ave th e d e fi n i ti o n s in ad d i ti o n al on l i n e co n tai n i n g En g l i sh an d l an g u ag e s d i cti o n ary m o re Fre n c h , Al s o Vo c ab u l ary th an wi th e l e ctro n i c 000 as th e an d te rm s e q u i val e n t kn o wn ( I E V) of 30 te rm s an d in I n te rn ati o n al on l i n e I E C G l o ssary - s td i ec ch /g l ossary p u b l i c ati o n s n u m b e r, I E C l e ad i n g te rm s E l e c tro te ch n i cal I EC pu bl i cati on s search - www i ec ch /search pu b Th e by E l ectro ped i a - www el ectro ped i a org co n s u l ti n g Te ch n i cal re vi e w pu bl i s h e d t e xt , by a te ch n i c al p ro j e cts , re p l ace d M o re th an E n g l i sh c l au s e h ave p u bl i cati o n s 77, 60 an d of I EC been 86 an d 000 F re n c h e l e ctro te c h n i c al e xt rac te d p u b l i c ati o n s co l l e c te d fro m fro m i ssu ed e arl i e r te rm i n o l o g y th e Te rm s s i n ce an d 2002 pu b l i c ati o n s e n tri e s Som e of in D e fi n i ti o n s e n t ri e s I EC TC 7, CI SPR I EC J u st Pu bl i s h ed - webstore i ec ch /j u stp u bl i s h ed S ta y up d e tai l s al s o to al l o n ce d ate n ew a on al l n ew pu b l i c ati o n s m o n th by e m l I EC p u b l i c ati o n s re l e as e d J u st Avai l ab l e P u bl i s h ed on l i n e an d I E C Cu s to m er S ervi ce Cen tre - webstore i ec ch /csc If yo u n eed wi s h fu rth e r C e n tre : to g i ve us as s i s tan c e , cs c @ i e c ch yo u r fe e d b ack p l e as e co n tact on th e th i s p u b l i c ati o n C u s to m e r or S e rvi c e I EC TR 62443-2-3 ® Ed i ti on 201 5-06 TECH N I CAL REPORT colour i n si de Secu ri ty for i n d u stri al au tom ati on an d trol system s – Part 2-3: Patch m an ag em en t i n th e I ACS en vi ron m en t I N TERN ATI ON AL ELECTROTECH N I CAL COM M I SSI ON I CS : 25 040 40; 35 040; 35 00 I SBN 978-2-8322-2768-8 Warn i n g ! M ake su re th at you obtai n ed th i s pu bl i cati on from an au th ori zed d i stri bu tor ® Reg i stered tradem ark of th e I n tern ati on al El ectrotech n i cal Com m i ssi on – – I E C TR 4 - - : © I E C C O N TE N TS F O R E WO R D I N TR O D U C TI O N S co p e N o rm a t i ve re f e re n c e s T e rm s , d e f i n i t i o n s , a b b r e vi a te d te rm s a n d a c ro n ym s T e rm s a n d d e f i n i t i o n s Ab b re vi a te d t e rm s a n d ac ro n ym s I n d u s tri a l a u t o m a t i o n a n d c o n tro l s ys t e m p a tc h i n g 1 P a tc h i n g p ro b l e m s fa c e d i n i n d u s tri a l a u to m a t i o n a n d c o n tro l s ys te m s 1 I m p ac t s o f p o o r p a tc h m a n ag e m e n t 1 O b s o l e t e I AC S p a tc h m a n a g e m e n t m i t i g a ti o n 4 P a tc h l i fe c yc l e s ta t e R e c o m m e n d e d re q u i re m e n ts fo r as s e t o wn e r R e c o m m e n d e d re q u i re m e n ts fo r I AC S p ro d u c t s u p p l i e r E x c h a n g i n g p a tc h i n fo rm a t i o n G e n e l P a tc h i n fo rm a t i o n e xc h a n g e fo rm a t P a tc h c o m p a t i b i l i t y i n f o rm a t i o n fi l e n a m e c o n ve n t i o n V P C fi l e s c h e m a V P C fi l e e l e m e n t d e f i n i t i o n s An n e x A ( i n fo rm a t i ve ) VP C XS D fi l e f o r m a t A V P C X S D f i l e f o rm a t s p e c i fi c a ti o n A C o re c o m p o n e n t t yp e s A O ve r vi e w A C o d e T yp e A D a t e Ti m e T yp e A I d e n t i fi e rT yp e A I n d i c a to rT yp e A Te x tT y p e An n e x B ( i n fo rm a t i ve ) I AC S a s s e t o wn e r g u i d a n c e o n p a t ch i n g B An n e x o r g a n i z a t i o n B O ve r vi e w B I n f o rm a ti o n g a th e ri n g B I n ve n to r y o f e x i s t i n g e n vi ro n m e n t B To o l s fo r m an u a l a n d au to m a t i c s c a n n i n g B 3 I AC S p ro d u c t s u p p l i e r c o n t a c t an d re l a t i o n s h i p b u i l d i n g B S u p p o rt ab i l i ty a n d p ro d u c t s u p p l i e r p ro d u c t l i fe c yc l e B E va l u a ti o n a n d as s e s s m e n t o f e x i s t i n g e n vi ro n m e n t B C l a s s i fi c a ti o n a n d c a t e g o ri z a ti o n o f as s e ts /h a rd wa re /s o f twa re 3 B P ro j e c t p l a n n i n g an d i m p l e m e n ta t i o n B O ve r vi e w B D e ve l o p i n g th e b u s i n e s s c a s e B E s ta b l i s h i n g a n d a s s i g n i n g ro l e s an d re s p o n s i b i l i ti e s B 4 Te s ti n g e n vi r o n m e n t a n d i n fras t ru c tu re B I m p l e m e n t b a c ku p a n d re s t o t i o n i n f ras t ru c tu re B E s ta b l i s h i n g p r o d u c t s u p p l i e r p ro c u re m e n t g u i d e l i n e s I E C TR 4 - - : © I E C B – – M o n i to ri n g a n d e va l u a ti o n B O ve r vi e w B M o n i to r i n g a n d i d e n t i fi c at i o n o f s e c u ri t y re l a t e d p a tc h e s B D e t e rm i n i n g p a tc h a p p l i ca b i l i t y B I m p a c t , c ri t i c a l i t y a n d r i s k a s s e s s m e n t 4 B 5 D e c i s i o n fo r i n s ta l l a t i o n B P a tc h t e s t i n g B P a tc h t e s ti n g p ro c e s s B As s e t o wn e r q u a l i fi c a t i o n o f s e c u r i t y p a t ch e s p ri o r to i n s t al l a t i o n B D e t e rm i n i n g p a tc h fi l e a u t h e n t i c i t y B R e vi e w fu n ct i o n al a n d s e c u ri t y c h a n g e s fro m p a tc h e s B I n s t a l l a t i o n p ro c e d u re B 6 P a tc h q u al i f i c a t i o n a n d va l i d a t i o n B P a tc h re m o va l , ro l l b a c k, re s t o t i o n p ro c e d u re s B B B R i s k m i t i g a t i o n a l te rn a t i ve s P a tc h d e p l o ym e n t a n d i n s t a l l a t i o n P a tc h d e p l o y m e n t a n d i n s t a l l a t i o n p ro ce s s B N o t i f i c a t i o n o f a ffe c te d p a rt i e s B P re p ar a ti o n B P h as e d s c h e d u l i n g a n d i n s ta l l a t i o n B V e ri fi ca t i o n o f p a tc h i n s ta l l a t i o n B S t a f f tra i n i n g a n d d r i l l s B O p e r at i n g a n I AC S p a tc h m a n ag e m e n t p r o g m B O ve r vi e w B C h an g e m an ag e m e n t B V u l n e b i l i t y a wa re n e s s B O u t ag e s c h e d u l i n g B S e c u ri t y h a rd e n i n g B I n ve n to r y an d d a t a m a i n t e n a n c e B P ro c u ri n g o r a d d i n g n e w d e vi c e s 5 B 8 P a tc h m a n a g e m e n t re p o r t i n g a n d KP I s 5 An n e x C ( i n fo rm a t i ve ) I AC S p r o d u c t s u p p l i e r / s e rvi c e p ro vi d e r g u i d a n ce o n p a tc h i n g C An n e x o r g a n i z a t i o n C D i s co ve ry o f vu l n e b i l i ti e s C G e n e l C 2 V u l n e b i l i t y d i s c o ve r y an d i d e n t i fi ca t i o n wi t h i n t h e p ro d u c t C V u l n e b i l i t y d i s c o ve r y an d i d e n t i fi ca t i o n wi t h i n e x t e r n a l l y s o u rc e d p ro d u c t c o m p o n e n ts C D e ve l o p m e n t , ve ri fi ca t i o n an d va l i d a t i o n o f s e cu ri t y u p d a te s C D i s tri b u t i o n o f c y b e r s e c u ri t y u p d a te s C C o m m u n i c a ti o n a n d o u tre a c h B i b l i o g p h y F i g u re – P a tc h s ta te m o d e l F i g u re – VP C fi l e s c h e m a F i g u re – VP C fi l e s c h e m a d i a g m f o r m a t F i g u re B – I AC S p a tc h m a n ag e m e n t wo rkfl o w F i g u re B – P l a n n i n g a n I AC S p a t c h m a n ag e m e n t p ro c e s s – – I E C TR 4 - - : © I E C F i g u re B – S a m p l e r e s p o n s i b i l i t i e s c h a rt F i g u re B – P a tc h m o n i t o ri n g a n d e va l u a t i o n p ro c e s s F i g u re B – A p a tc h te s ti n g p ro c e s s F i g u re B – A p a tc h d e p l o y m e n t an d i n s ta l l a t i o n p ro c e s s T a b l e – P a tc h l i fe c yc l e s t a te s T a b l e – VP C XS D P a tc h D a ta f i l e e l e m e n ts T a b l e – VP C XS D P a tc h V e n d o r fi l e e l e m e n ts T a b l e – VP C XS D P a tc h f i l e e l e m e n ts T a b l e – VP C XS D V e n d o rP r o d u c t f i l e e l e m e n t s Tab l e A – C o d e T yp e o p t i o n a l a t tri b u t e s T a b l e A – D a t e T i m e T yp e o p t i o n a l a t tri b u te s T a b l e A – I d e n t i fi e rT y p e o p t i o n a l a t t ri b u t e s T a b l e A – I n d i c a to rT yp e o p t i o n al a tt ri b u t e s T a b l e A – T e x tT y p e o p t i o n a l a t tr i b u t e s Tab l e B – S a m p l e p ro d u c t s u p p l i e r p ro f i l e T a b l e B – C o m m u n i c a ti o n c a p a b i l i t i e s T a b l e B – S a m p l e s o f twa re c a t e g o ri z a t i o n T a b l e B – R e s p o n s i b i l i t y as s i g n m e n t d e f i n i ti o n s T a b l e B – S a m p l e s e ve ri t y b a s e d p a tc h m an a g e m e n t t i m e f m e s I E C TR 4 - - : © I E C – – I N TE R N ATI O N AL E LE C TR O TE C H N I C AL C O M M I S S I O N S E C U R I TY F O R I N D U S TR I A L A U TO M A TI O N A N D C O N TR O L S YS TE M S – P ar t - : P at c h m an ag e m e n t i n t h e I A C S e n v i r o n m e n t F O R E WO R D ) T h e I n t e rn a t i o n a l E l e c t r o t e c h n i c a l C o m m i s s i o n ( I E C ) i s a wo r l d w i d e o rg a n i z a t i o n f o r s t a n d a rd i z a t i o n c o m p r i s i n g al l n ati o n al e l e ctro te ch n i cal co m m i ttees (I EC N ati o n al Co m m i ttees) Th e o bj ect of IEC is to pro m o te i n t e rn a t i o n a l c o - o p e r a t i o n o n a l l q u e s t i o n s c o n c e rn i n g s t a n d a rd i z a t i o n i n t h e e l e c t ri c a l a n d e l e c t r o n i c f i e l d s T o th i s end an d Te ch n i cal in ad d i ti o n R e po rts , to o th e r acti vi ti e s , P u bl i cl y Avai l abl e IEC p u bl i s h e s I n te rn ati o n al S pe ci fi cati o n s ( P AS ) an d S tan d ard s , Gu i d es Te ch n i cal ( h e re afte r S p e ci fi cati o n s , re f e r re d to as “I EC P u b l i c a t i o n ( s ) ” ) T h e i r p re p a r a t i o n i s e n t r u s t e d t o t e c h n i c a l c o m m i t t e e s ; a n y I E C N a t i o n a l C o m m i t t e e i n t e r e s t e d in th e su bj ect d e al t wi th m ay p arti ci p ate in th i s p re p a t o ry wo r k I n te rn ati o n al , g o ve rn m e n tal an d n on- g o v e r n m e n t a l o r g a n i z a t i o n s l i a i s i n g w i t h t h e I E C a l s o p a r t i c i p a t e i n t h i s p re p a r a t i o n I E C c o l l a b o t e s c l o s e l y wi t h th e I n te rn ati o n al O rg an i z ati o n fo r S t a n d a rd i z a t i o n (I SO) in acco rd an ce wi t h co n d i ti o n s d e t e rm i n e d by a g r e e m e n t b e t w e e n t h e t w o o rg a n i z a t i o n s 2) T h e f o rm a l d e c i s i o n s o r a g re e m e n t s o f I E C o n t e c h n i c a l m a t t e rs e x p re s s , a s n e a rl y a s p o s s i b l e , a n i n t e r n a t i o n a l sen su s of opi n i on on th e re l e van t s u bj e cts si n ce e ach te ch n i cal com m i ttee h as re p r e s e n t a t i o n fro m al l i n t e re s t e d I E C N a t i o n a l C o m m i t t e e s 3) I E C P u b l i c a t i o n s h a v e t h e f o rm o f r e c o m m e n d a t i o n s f o r i n t e rn a t i o n a l u s e a n d a re a c c e p t e d b y I E C N a t i o n a l C o m m i t t e e s i n t h a t s e n s e W h i l e a l l r e a s o n a b l e e f f o rt s a re m a d e t o e n s u re t h a t t h e t e c h n i c a l c o n t e n t o f I E C P u bl i cati o n s is accu rate , IEC can n o t be h el d re s p o n s i b l e fo r th e wa y in wh i c h th e y a re used or fo r an y m i s i n te rp re tati o n b y an y e n d u s e r 4) In o rd e r to p ro m o t e tran s pare n tl y to i n te rn ati o n al th e m axi m u m u n i f o rm i t y , exte n t IEC possi bl e in N ati o n al th ei r Co m m i ttee s n ati on al an d u n d e r t a ke re g i o n al to appl y IEC pu bl i cati o n s P u bl i cati on s An y d i ve rg e n ce b e t w e e n a n y I E C P u b l i c a t i o n a n d t h e c o r re s p o n d i n g n a t i o n a l o r r e g i o n a l p u b l i c a t i o n s h a l l b e c l e a rl y i n d i c a t e d i n t h e l a t t e r 5) I E C i t s e l f d o e s n o t p r o v i d e a n y a t t e s t a t i o n o f c o n f o rm i t y I n d e p e n d e n t c e r t i f i c a t i o n b o d i e s p ro v i d e c o n f o r m i t y a s s e s s m e n t s e rv i c e s a n d , i n s o m e a re a s , a c c e s s t o I E C m a rks o f c o n f o rm i t y I E C i s n o t re s p o n s i bl e fo r an y s e rv i c e s c a r ri e d o u t b y i n d e p e n d e n t c e r t i f i c a t i o n b o d i e s 6) A l l u s e rs s h o u l d e n s u r e t h a t t h e y h a v e t h e l a t e s t e d i t i o n o f t h i s p u b l i c a t i o n 7) N o l i a b i l i t y s h a l l a t t a c h t o I E C o r i t s d i re c t o rs , e m p l o y e e s , s e rv a n t s o r a g e n t s i n c l u d i n g i n d i v i d u a l e x p e r t s a n d m e m b e rs o f i t s t e c h n i c a l c o m m i t t e e s a n d I E C N a t i o n a l C o m m i t t e e s f o r a n y p e r s o n a l i n j u r y, p ro p e r t y d a m a g e o r oth er d am ag e expen ses of an y n a t u re wh a t s o e v e r , wh e t h e r d i r e c t a ri s i n g out of pu bl i cati o n , use th e o f, or or i n d i re c t , re l i an ce u pon , o r fo r co sts th i s IEC (i n cl u d i n g P u bl i cati o n or l e g al fe e s) an d an y o th er IEC P u bl i cati o n s 8) A t t e n t i o n i s d wn t o t h e N o rm a t i v e r e f e re n c e s c i t e d i n t h i s p u b l i c a t i o n U s e o f t h e r e f e re n c e d p u b l i c a t i o n s i s 9) A t t e n t i o n i s d w n t o t h e p o s s i b i l i t y t h a t s o m e o f t h e e l e m e n t s o f t h i s I E C P u b l i c a t i o n m a y b e t h e s u b j e c t o f i n d i s p e n s a b l e f o r t h e c o r re c t a p p l i c a t i o n o f t h i s p u b l i c a t i o n p a t e n t ri g h t s I E C s h a l l n o t b e h e l d re s p o n s i b l e f o r i d e n t i f y i n g a n y o r a l l s u c h p a t e n t ri g h t s Th e m n tas k o f I E C te ch n i c al c o m m i t t e e s i s t o p re p are I n te rn a t i o n a l S t a n d a rd s H o w e ve r, a t e c h n i ca l c o m m i t te e m ay p ro p o s e th e p u b l i ca t i o n o f a te c h n i c a l re p o rt wh e n i t h as c o l l e c t e d d a ta o f a d i ffe re n t ki n d fro m th a t wh i c h i s n o rm a l l y p u b l i s h e d as an I n t e rn a t i o n a l S ta n d ard , fo r e x am p l e " s ta t e o f th e art " Te c h n i c al R e p o rt p art n e rs h i p wi t h I EC 62443-2-3 I EC t e ch n i c al h as been c o m m i t te e p re p are d 65: by ISA Te c h n i ca l I n d u s tri a l - p ro c e s s C o m m i t te e m e as u re m e n t , 99 c o n t ro l in an d au to m a t i o n Th e te x t o f th i s s ta n d a rd i s b as e d o n t h e fo l l o wi n g d o c u m e n ts : E n q u i ry d f t R e p o r t o n vo t i n g /5 /D T R /5 /R V C F u l l i n fo rm at i o n o n th e vo t i n g fo r t h e ap p ro va l o f th i s te c h n i c al re p o rt c a n b e fo u n d i n th e re p o rt o n vo t i n g i n d i c a te d i n th e ab o ve t ab l e – – I E C TR 4 - - : © I E C Th i s p u b l i c at i o n h as b e e n d f te d i n ac c o rd an c e wi th t h e I S O /I E C D i re c t i ve s , P a rt A l ist of al l p arts in th e I E C 62443 s e ri e s , industrial automation and control systems, pu bl i sh ed u n d er th e g e n e l ti tl e Security for c an b e fo u n d o n th e I E C we b s i t e Th e c o m m i t t e e h as d e c i d e d t h a t th e c o n te n ts o f t h i s p u b l i cat i o n wi l l re m n u n c h an g e d u n t i l th e s t ab i l i t y d ate i n d i cate d on th e I EC we b s i te u n der " h tt p : //w e b s to re i e c c h " in th e d at a re l a te d t o t h e s p e c i fi c p u b l i c a t i o n At t h i s d at e , th e p u b l i c a t i o n wi l l b e • re c o n fi rm e d , • wi th d rawn , • re p l ac e d b y a re vi s e d e d i t i o n , o r • am e n d e d A b i l i n g u al ve rs i o n o f th i s p u b l i c at i o n m a y b e i s s u e d a t a l a t e r d at e I M P O R TA N T t h at i t – u n d er s t an d i n g c o l o u r Th e c o n t n s p ri n t er o f ' c o l o u r c o l o u r s i t s i n s i d e' w h i c h c o n t en t s l o g o ar e U s ers o n t h e c o ver c o n s i d ered s h o u l d p ag e t o t h eref o re o f t h i s b e p r i n t p u b l i c at i o n u s efu l t h i s f o r i n d i c at e s t h e d o c u m en t c o rrec t u s i n g a I E C TR 4 - - : © I E C – – I N TR O D U C TI O N C yb e r s e c u r i t y i s a n i n c re a s i n g l y i m p o rt a n t t o p i c i n m o d e rn o rg an i z a t i o n s M a n y o r g a n i z a t i o n s i n vo l ve d i n i n fo rm a t i o n te c h n o l o g y ( I T) a n d b u s i n e s s h a ve b e e n c o n c e rn e d wi th c y b e r s e c u ri t y fo r m a n y ye a rs a n d h a ve we l l - e s tab l i s h e d i n fo rm a t i o n s e cu ri t y m an a g e m e n t s ys t e m s ( I S M S ) in pl ace as d e fi n e d I n t e rn a t i o n a l Th e s e by th e I n te rn a t i o n a l E l e c tr o t e c h n i c al m an ag em en t O rg a n i z a ti o n Com m ission s ys te m s p ro vi d e an (I EC) , in o rg a n i z a t i o n fo r S t a n d a rd i z a t i o n I S O /I E C 0 wi th a an d (I SO) an d th e I S O /I E C 0 we l l - e s t a b l i s h e d m e th o d for p ro t e c t i n g i t s as s e ts fro m c y b e r- a t ta cks I n d u s tri a l Au t o m at i o n an d C o n tr o l S y s te m s ( I AC S ) s u p p l i e rs an d o wn e rs a re u si n g co m m e rc i a l - o ff- t h e - s h e l f ( C O TS ) t e c h n o l o g y d e ve l o p e d fo r b u s i n e s s s ys t e m s i n th e i r e ve r yd a y p ro ce s s e s Th i s p ro vi d e s an i n c re a s e d o p p o rtu n i t y fo r c yb e r- a t t ac k ag n s t th e I AC S e q u i p m e n t , s i n c e C O TS s ys t e m s are m o re wi d e l y kn o wn a n d u s e d Th e re h as a l s o b e e n n e w i n te re s t i n I C S s e c u ri t y re s e a rc h t h a t h as u n c o ve re d n u m e ro u s d e vi c e vu l n e b i l i ti e s a s we l l S u c c e s s fu l a t t a c ks a g n s t i n d u s t ri a l s ys t e m s m a y l e ad to h e al t h , s a fe t y a n d e n vi ro n m e n ta l (H S E ) co n seq u en ces O rg a n i z a t i o n s m ay t ry to u se th e bu si n ess c yb e r s e c u ri t y s t te g y to a d d re s s s e cu ri t y fo r I AC S w i t h o u t u n d e rs ta n d i n g t h e c o n s e q u e n ce s Wh i l e m a n y o f t h e s e s o l u t i o n s ca n b e a p p l i e d to I AC S , th e y n e e d t o b e a p p l i e d i n th e c o rre c t wa y t o e l i m i n a t e i n ad ve rte n t c o n s e q u e n c e s Th i s t e c h n i c a l re p o r t a d d re s s e s t h e p a tc h m a n ag e m e n t as p e c t o f I AC S c yb e r s e c u r i t y P a tc h m an a g e m e n t i s p ar t o f a c o m p r e h e n s i ve c yb e r s e c u ri t y s t te g y t h a t i n cre a s e s c yb e r s e c u ri t y th ro u g h t h e i n s t a l l a t i o n o f p a tc h e s , a l s o c a l l e d s o ft wa re u p d a te s , s o f twa re u p g d e s , fi r m wa re u p g d e s , s e rvi c e p a c ks , h o t fi x e s , b as i c i n p u t o u t p u t s ys t e m ( B I O S ) u p d a te s an d o th e r d i g i t a l e l e c t ro n i c p ro g m vu l n e b i l i ti e s i n d u s t ry u pd ate s Th i s c o n c e rn s p ro d u c t s u p p l i e rs te ch n i c a l as s o ci ated I t al s o th a t re s o l ve re p o rt wi t h d e s c ri b e s bu g s, i n tr o d u c e s I AC S th e re l i a b i l i t y an d /o r o p e b i l i t y o f th e I AC S p a tc h i m p ac t s o p e b i l i ty , to th e re l i ab i l i t y re a d e r m a n ag e m e n t p o o r p a t ch m an y fo r of as s e t an d th e c yb e r s e c u ri t y p ro b l e m s o w n e rs m a n a g e m e n t c an an d h a ve an d I AC S on th e – – S E C U R I TY F O R AND P ar t 2-3: P at c h I E C TR 4 - - : © I E C I N D U S TR I A L C O N TR O L m an ag e m e n t A U TO M A TI O N S YS T E M S i n th e – I ACS en vi r o n m en t Sc o p e Th i s p a rt o f I E C 4 , wh i c h i s a Te c h n i c a l R e p o rt , d e s c ri b e s re q u i re m e n ts fo r a s s e t o wn e rs a n d i n d u s t ri a l a u t o m a ti o n a n d c o n tro l s ys te m ( I AC S ) p ro d u c t s u p p l i e rs t h a t h a ve e s t a b l i s h e d a n d a re n o w m a i n ta i n i n g a n I AC S p at ch m a n ag e m e n t p ro g m Th i s Te c h n i c a l R e p o rt re c o m m e n d s a d e f i n e d fo rm a t f o r th e d i s t ri b u t i o n o f i n fo r m a t i o n a b o u t s e c u r i t y p a tc h e s fro m a s s e t o w n e rs t o I AC S p ro d u c t s u p p l i e rs , a d e fi n i t i o n o f s om e o f th e ac t i vi t i e s a s s o c i a t e d w i th t h e d e ve l o p m e n t o f t h e p a tc h i n fo rm a t i o n b y I AC S p ro d u c t s u p p l i e rs a n d d e p l o ym e n t an d i n s ta l l a t i o n o f t h e p a tc h e s b y a s s e t o wn e rs Th e e x c h a n g e fo rm a t a n d ac t i vi ti e s a re d e fi n e d fo r u s e i n s e c u ri t y re l a t e d p a tc h e s ; h o we ve r, i t m ay a l s o b e a p p l i c a b l e fo r n o n - s e c u ri t y re l a t e d p a tc h e s o r u p d a te s Th e Te c h n i c a l R e p o r t d o e s n o t d i ffe re n ti a te b e twe e n p a tc h e s m a d e a va i l a b l e fo r th e o p e ti n g s ys t e m s (OSs) , s u p p l i e rs th at ap p l i c at i o n s su ppl y th e or d e vi c e s i n fra s tru c tu re It does not c o m p o n e n ts d i f fe re n t i a t e or th e I AC S b e twe e n th e appl i cati o n s ; it p ro d u c t p ro vi d e s g u i d a n c e fo r a l l p a tc h e s a p p l i c a b l e t o t h e I AC S Ad d i t i o n a l l y, t h e t y p e o f p a tc h c a n b e f o r t h e re s o l u t i o n o f b u g s , re l i a b i l i t y i s s u e s , o p e b i l i t y i s s u e s o r s e c u ri t y vu l n e rab i l i t i e s N O TE Th i s Te ch n i cal R e p o r t d o e s n o t p ro v i d e g u i d a n c e o n t h e e t h i c s a n d a p p ro a c h e s f o r t h e d i s c o v e ry a n d d i s c l o s u re o f s e c u ri t y v u l n e r a b i l i t i e s a f f e c t i n g I A C S T h i s i s a g e n e r a l i s s u e o u t s i d e t h e s c o p e o f t h i s re p o rt N O TE Th i s Te ch n i cal R e p o rt does not p ro vi d e g u i d an ce on th e m i ti g ati o n of vu l n e rab i l i ti e s in th e p e ri o d b e t we e n w h e n t h e v u l n e r a b i l i t y i s d i s c o v e r e d a n d t h e d a t e t h a t t h e p a t c h re s o l v i n g t h e v u l n e b i l i t y i s c re a t e d F o r g u i d a n c e o n m u l t i p l e c o u n t e rm e a s u re s t o m i t i g a t e s e c u ri t y ri s ks a s p a r t o f a n I A C S s e c u r i t y m a n a g e m e n t s y s t e m (I AC S - S M S ) , re f e r t o , An n e xe s B , B an d B i n th i s Te ch n i cal R e p o rt a n d o th e r d o cu m en ts i n th e I E C 4 s e ri e s N o r m at i v e r ef er en c es Th e fo l l o wi n g d o c u m e n ts , i n wh o l e o r i n p a rt , are n o rm a ti ve l y r e fe re n c e d i n t h i s d o c u m e n t a n d a re i n d i s p e n s a b l e fo r i ts a p p l i c a t i o n F o r d a t e d re f e re n c e s , o n l y t h e e d i ti o n c i t e d ap p l i e s F o r u n d ate d re fe re n c e s , th e l ate st e d i ti o n of th e r e fe re n c e d d ocu m e n t (i n cl u d i n g an y am e n d m e n ts) appl i e s I EC TS 62443- -1 , Industrial communication networks – Network and system security – Part -1 : Terminology, concepts and models I E C 62443-2-1 , Industrial communication networks – Network and system security – Part 2-1 : Establishing an industrial automation and control system security program 3 For Te r m s , d ef i n i t i o n s , Te r m s th e an d ab b r e v i at e d t erm s an d ac r o n y m s d ef i n i t i o n s p u rp o s e s of th i s d ocu m en t, th e t e rm s an d d e fi n i ti o n s re fe re n c e s s p e c i fi e d i n C l a u s e , as we l l as th e fo l l o w i n g , a p p l y : g i ve n in th e n o rm a t i ve – 50 – • I E C TR 4 - - : © I E C e n h a n c i n g th e I AC S to n e w ve rs i o n s wi th e n h an c e d u s e r fu n c t i o n a l i t y M a n y u s e rs o f o l d e r s ys t e m s c a n j u s t i f y th e e x p e n s e o f ad d i n g n e w fu n c ti o n a l i t y a t t h e s a m e t i m e th e s ys t e m i s u p d a t e d E n h a n c e m e n ts a re o f te n p o s s i b l e wh e n t h e re i s a n a p p l i c a t i o n u p g d e p a t h I f n o u p g d e p a th e x i s ts , t h e n th e ch o i c e s a re to a b an d o n t h e s ys te m o r t o re p l a ce i t • a b a n d o n i n g o r re t i ri n g t h e I AC S W h i l e t h e a p p l i c a t i o n wa s p ro b a b l y e s s e n t i a l wh e n i t w as i n i ti al l y i n s ta l l e d , o fte n o th er n e we r ap p l i ca t i o n s d u p l i ca t e th e ol d er a p p l i c at i o n ’ s fu n c ti o n a l i t y , b u t d o n o t h a ve th e fu n c t i o n s t u rn e d o n T h e o l d e r ap p l i c at i o n s we re ke p t i n p l a c e b e c a u s e i t wa s l e s s p a i n fu l to ke e p t h e m g o i n g t h a n to e l i m i n a te th e m a n d u s e th e a l te rn a t i ve N o w wi t h a possi bl e i n c re as e d ri s k o f c o m p ro m i s e , it is b e t t e r to s wi tc h to s u p p o r ta b l e a p p l i c a ti o n s • re p l a c i n g t h e I AC S wi t h a n e w s u p p o rt e d I AC S T h i s i s u s u a l l y t h e m o s t t i m e c o n s u m i n g a l te rn a t i ve , b u t w h e n a l l e l s e f l s , c ri t i c a l , th e n c ri t i c a l , th en t h e re it is m ay econ o m i c h a ve to i t m a y b e t h e l e a s t ri s ky c h o i c e I f t h e ap p l i c a t i o n i s j u s t i fi c a t i o n be fo r aban d o n ed , re p l a c e m e n t becau s e of If th e th e appl i cati o n ri s k an d i m p ac t is not of a c o m p ro m i s e I n th o s e i n d u s tr i e s th a t a re re q u i re d b y re g u l a t i o n s t o fo l l o w c yb e r s e c u ri t y s tan d ard s , t h o s e as s e t o wn e rs ar e al s o u s u a l l y re q u i re d t o d o c u m e n t t h o s e m i t i g a t i n g c o n tro l s p u t i n p l ac e i n l i e u o f i n s t al l i n g p a tc h e s I n s o m e c a s e s , t h e u s e o f m i t i g a t i n g c o n tro l s i s e as i e r t h a n p a tc h i n s ta l l a t i o n S o m e b e n e fi ts o f m i t i g a t i n g c o n tro l s a re : • vu l n e b i l i ti e s p ro d u c t m ay be su ppl i er m i ti g ate d i n d epen d en t b e fo re of th e p ro d u c t p a tc h i s re l e as e d d e ve l o p m e n t o r a p p r o ve d by th e p ro d u c t b y th e I AC S su ppl i er or h a rd wa re /s o f t wa re m an u fa c t u re r ; • l e s s i m p ac t o n p r o d u c t fu n c ti o n a l i t y; • l e s s te s t i n g b y a s s e t o wn e r m a y b e re q u i re d , a l l o wi n g f as te r m i t i g a ti o n o f t h e vu l n e b i l i t y; • l o we r re s i s ta n c e to i m p l e m e n ta t i o n b y a s s e t o wn e rs a s i t m a y n o t r e q u i re d e vi c e s t o b e re b o o te d o r t h e p r o c e s s t o b e s h u td o wn ; an d • s u p p o rt o f l e g a c y p ro d u c ts fo r wh i c h vu l n e b i l i t i e s m a y c o n t i n u e t o b e d i s c o ve r e d , bu t wh i c h a re n o l o n g e r p a tc h e d o r s u p p o r te d b y th e o r i g i n a l p ro d u c t s u p p l i e r L as tl y , a n y m i t i g a ti n g c o n tro l s t h a t a re i m p l e m e n t e d s h o u l d o n l y b e va l i d fo r a s p e c i fi c t i m e fra m e ( s u c h as , o n e ye ar) b e fo re th e y ar e re - e val u a t e d , to e n s u re t h e y a re s t i l l a c c e p ta b l e fo r an o th e r t e rm B.7 B P at c h d ep l o y m en t P at c h an d d ep l o y m en t an d i n s t al l at i o n i n s t al l at i o n p ro ces s F i g u re B i l l u s t te s a p a t c h d e p l o ym e n t a n d i n s ta l l a t i o n p ro c e s s N o t i fi c a t i o n P re p a ti o n Sch ed u l i n g I n sta l l a ti on V e r i fi c a t i o n Tra i n i n g IEC Fi g u r e B N o t i f i c at i o n B.6 of – A p at c h af f e c t e d d ep l o ym en t an d i n s t al l at i o n p ro c es s p ar t i e s D e p e n d i n g o n t h e s i z e a n d s tr u c tu re o f t h e as s e t o w n e r’ s o rg a n i z a ti o n , m a i n t e n a n c e c o n t rac t s a n d wa rran t i e s wi th t h e ve n d o r , t h e i n s ta l l a t i o n o f p a tc h e s m a y b e h a n d l e d b y t h e s a m e g ro u p re s p o n s i b l e fo r t e s ti n g , p e r fo r m e d b y s p e c i fi c p e rs o n n e l a t e ac h fac i l i t y o r o u t s o u rc e d t o a n i n te g t o r o r I AC S p ro d u c t s u p p l i e r I E C TR 4 - - : © I E C – 51 – Th e p e rs o n n e l re s p o n s i b l e fo r i n s t a l l a t i o n o f p a tc h e s s h o u l d b e tra i n e d o n t h e p ro c e d u re s f o r safe an d I AC S re l i ab l e p ro d u c t i n s ta l l a t i o n s u p p l i e r, see fro m B te s t i n g An y i n fo rm a t i o n an d an d kn o wl e d g e ro l l - b a c k p ro c e d u re s shou ld g a th e re d be fro m d i s tri b u t e d th e to th e re s p o n s i b l e p e rs o n n e l In c a s e s wh e re te s t i n g an d i n s t al l a ti o n are p e rfo rm e d b y d i f fe re n t o rg an i z a t i o n a l g ro u p s , it m a y b e n e c e s s a ry to p ro vi d e s u f fi c i e n t j u s t i fi c a ti o n fo r wh y t h e p a tc h s h o u l d b e i n s t a l l e d , i n co n tras t to l e a vi n g t h e vu l n e b i l i t y , o r p ro vi d i n g co m p e n s a t i n g c o n tr o l s B P r e p ar at i o n D e p e n d i n g o n t h e s i z e an d c o m p l e x i ty o f t h e o r g a n i z a t i o n , c o u n t o f d e vi c e s , p h ys i c a l l o c a t i o n s an d d a t a n e t wo rk c o m m u n i c a ti o n a va i l a b l e , t h e re m ay be s i g n i fi can t p re p a ti o n s re q u i re d b e fo re t h e p a tc h e s ca n b e i n s ta l l e d Th e m ost co m m on ch a l l e n g e m u l ti p l e l o c a t i o n s a n d is d e vi c e s d e t e rm i n i n g h ow th e u p d a te fi l es shou ld T h e I AC S d e vi c e s m a y b e a i r - g a p p e d be fr o m d i s t ri b u t e d to o th e r n e t wo rks , p ro te c t e d b y fi re w al l s , c o n n e c t e d b y u n i d i re c t i o n a l g a te wa ys o r c o n n e c te d b y s l o w wi d e a re a n e two rk ( WAN ) l i n ks p ro h i b i t i n g th e t r an s fe r o f l a rg e fi l e s Th e fo l l o wi n g o p t i o n s m a y b e u s e d fo r d i s t ri b u t i o n o f u p d a t e fi l e s : • l e ve g e au to m a t e d p a tc h d e p l o ym e n t t o o l s th a t s u p p o rt tra n s f e r s p e e d t h ro t tl i n g a n d l o w p ri o ri t i z a t i o n as t o re d u c e i m p a c t o n t h e n e two rk o r d e vi c e ; • d i s tri b u te u p d a te fi l e s u s i n g o th e r c o m m u n i c a t i o n n e t wo rks t h a t wi l l n o t i m p a c t th e I AC S , i n c l u d i n g th e d i s t ri b u ti o n a n d p o s ti n g o f u p d a te f i l e s t o l o c a l o r d i s tri b u t e d fi l e s e r ve rs th at p e rs o n n e l c a n d o wn l o a d fro m i n th e p ro d u c ti o n e n vi r o n m e n t ; • re m o ve t h e t ar g e t d e vi c e fro m o p e t i o n s an d I AC S n e two rk( s ) to p e r fo r m p a tc h i n g i n an o ff l i n e s t a t e ; • • c o p y u p d a t e fi l e s to re a d - o n l y p o rt a b l e m e d i a s u c h a s C D o r D VD ; a n d co py u p d a te d ri ve s In fi l es th i s to c as e , re ad - wri t e s peci al p o rt a b l e c a re h as to m edi a be su ch t a ke n to as U SB e n s u re m e m o ry th a t th e or p o rta b l e fi l e s an d m e d i a ar e n o t ta m p e re d wi t h o r i n f e c t e d wi th m a l i ci o u s c o d e wh i l e i n tra n s i t , h ard s to g e th a t c o u l d i n c re as e t h e r i s k t o th e I AC S P e rs o n n e l re s p o n s i b l e fo r p a tc h i n s t a l l a t i o n m ay n o t h a ve p a rt i c i p a te d i n p a t ch te s t i n g , an d m a y h a ve t o re vi e w a l l i n s t ru c t i o n s a n d p r o c e d u re s p ro vi d e d t o t h e m to e n s u re c o n s i s te n c y wi th te s t i n g a n d re l i a b l e i n s ta l l a t i o n B P h as e d s c h ed u l i n g an d i n s t al l at i o n Aft e r th e u p d a te fi l e s h a ve b e e n d i s tri b u te d a n d /o r t h e p l a n fo r t h e i r d i s tri b u t i o n i s c o m p l e t e d , n ext is sch e d u l i n g p a tc h i n s ta l l a t i o n Sch ed u l i n g i n s ta l l a t i o n of p a tc h e s is a l o cal m a t te r d e te r m i n e d b y t h e o wn e r /o p e to r t o m i n i m i z e d i s r u p t i o n o f th e p ro d u c ti o n s c h e d u l e fo r t h e s ys te m Th i s m a y b e e x t re m e l y c h a l l e n g i n g d e p e n d i n g o n th e t yp e o f I AC S e n vi r o n m e n t , b u t o p ti o n s i n c l u d e : • wa i t i n g u n t i l t h e n e x t s c h e d u l e d o u ta g e ; • q u e u i n g p a t ch i n g a c t i vi t i e s d u r i n g th e n e x t u n s c h e d u l e d o u ta g e ; N OTE T h i s m a y r e q u i r e t h a t t h e t i n e d p e rs o n n e l a re r e a d y o n s h o rt n o t i c e N OTE P e r f o r m i n g p a t c h i n g a c t i v i t i e s d u r i n g a n u n s c h e d u l e d o u t a g e i s t yp i c a l l y c o n s i d e re d t h e i n t ro d u c t i o n o f a d d i t i o n a l p o t e n t i a l ri s k • u p d a t i n g s tan d b y/s e c o n d a ry d e vi c e s f i rs t , fa i l - o ve r t o t h e s t an d b y, ve ri fy i ts o p e rab i l i t y a n d re l i a b i l i t y , an d th e n c o m p l e t e th e ac ti ve /p ri m a ry d e vi c e ; • s c h e d u l i n g i n d i vi d u a l m a i n t e n a n c e wi n d o ws fo r a f fe c te d d e vi c e s wh e r e t h e y are a s s u m e d t o b e o ffl i n e a n d /o r u n a va i l a b l e f o r o p e t i o n s ; an d – 52 – • i n s ta l l i n g I E C TR 4 - - : © I E C p a t c h e s i n p h a s e s t o g ro u p s o f d e vi c e s o r l o c a t i o n s a s p e rm i t te d b y b u s i n e s s c o n s tra i n ts a n d a va i l a b i l i t y o f s ki l l e d p e rs o n n e l Th e d u t i o n o f t i m e re q u i re d fo r p a t c h i n g o p e t i o n s s h o u l d b e we l l u n d e rs t o o d Th e ti m e re q u i re d a n d re s u l ts ar e r e a s o n a b l y p re d i c t a b l e i f t h e ap p ro p ri a t e t e s t i n g h a s b e e n p e r fo rm e d Th e p a t ch i n g wi n d o w sh ou l d be of s u f fi c i e n t d u t i o n to al l o w b a cki n g up th e d e vi c e ( as n e e d e d ) , i n s t a l l i n g th e p a tc h , ve ri fi c a t i o n o r tro u b l e s h o o t i n g a n d r o l l - b a c k i f u n s u c c e s s fu l B Ve r i f i c at i o n of p at c h i n s t al l at i o n Th e f i n a l s te p o f p a tc h d e p l o y m e n t a n d i n s t al l a ti o n p ro c e s s i s th e ve ri fi ca t i o n th a t t h e p a tc h wa s i n s t a l l e d t o a l l a ffe c te d d e vi c e s a n d t h e vu l n e b i l i t y h a s b e e n m i ti g a t e d ( b y p a t ch i n g o r co m p e n s a t i n g c o n tro l s ) Th e as se t own e r sh ou l d sel ect a d e ad l i n e fo r th e i n s ta l l a t i o n of th e patch e s a n d /o r co m p e n s a t i n g c o n t ro l s s o t h a t i t c an b e ve ri fi e d s h o rt l y a fte r t h e d e a d l i n e D e p e n d i n g o n t h e cri t i ca l i t y o f th e s e c u ri t y p a tc h , d i ffe re n t d e a d l i n e s m a y b e c h o s e n M e th o d s fo r ve ri f yi n g th e i n s ta l l a t i o n o f t h e p a tc h o r vu l n e b i l i t y m i ti g a t i o n i n c l u d e : • c o m p a ri n g t h e i n s ta l l e d ve rs i o n o f s o ft ware b e fo re a n d a fte r t h e ch a n g e ; • r e vi e wi n g o f l o g s fr o m c o n fi g u t i o n ch a n g e d e t e ct i o n s ys t e m s ; • r e vi e wi n g o f r e p o r ts f ro m p a t ch m a n ag e m e n t s o l u t i o n s ve r i f yi n g t h e re s p e c t i ve p a tc h e s a re i n s ta l l e d a n d fi l e s u p d a te d ; • co u n ti n g th e n u m ber of d e vi c e s pl an n e d fo r u p g d e , ag n s t th o s e co m pl e te d s u c c e s s fu l l y; • p e rfo rm i n g a vu l n e b i l i t y s c a n o f th e a f fe c te d d e vi c e s ; a n d • t e s t i n g th e c o rre c t i m p l e m e n t a t i o n o f co m p e n s a t i n g c o n t ro l s Th e as s e t o wn e r s h o u l d p e rfo rm t h e ve ri f i c a t i o n T h e m e t h o d c h o s e n i s a t t h e d i s c re ti o n o f t h e as s e t o wn e r B Th e S t af f ass e t t r n i n g o wn e r an d shou ld d ri l l s d e ve l o p an d i m pl em en t t i n i n g fo r p e rs o n n e l i n vo l ve d wi t h an d re s p o n s i b l e fo r p a tc h m a n a g e m e n t T h i s s h o u l d i n c l u d e p o l i c i e s , s t a n d a rd s , p ro c e d u re s a n d fo rm s u sed fo r th e as s e t o wn e r’ s p a tc h m an ag e m e n t p ro g m At minimum, th e tra i n i n g sh ou l d i n cl u d e: • p o l i c i e s o n p a tc h a n d vu l n e b i l i t y m a n a g e m e n t ; • t h e as s e t o wn e r’ s d e te rm i n a t i o n o f t h e p a tc h i n g wo rkfl o w a n d t h e d e fa u l t i n t e rva l s a t wh i ch m o n i to ri n g , te s t i n g a n d i n s t al l a t i o n s h o u l d o c c u r; • s t a n d a rd s an d p ro c e d u re s on how to p e rfo rm patch e va l u a ti o n , p a t ch te s t i n g , p a tc h i n s ta l l a t i o n , r e p o r t i n g a n d ve r i fi c a ti o n ; • use o f fo rm s as so ci ated wi th p a tc h m a n ag e m e n t ( f o r e xa m p l e , p a tc h e va l u a ti o n fo rm s , ch a n g e re q u e s t fo rm s , p a tc h te s t i n g f o r m s , e tc ) ; a n d • re g u l a t o r y re q u i re m e n ts fo r c e rta i n d e vi c e s , h o w to c o rre c tl y c o l l e c t a n d s t o re e vi d e n c e re c o rd s o f a d h e re n c e t o t h e p a tc h m a n a g e m e n t p ro g r am Af t e r t h e tr n i n g h as be e n su ppl i ed to e xi s ti n g an d fu tu re p e rs o n n e l r e s p o n s i b l e f o r p a tc h m an a g e m e n t , an i n i t i a l ta b l e - to p e x e rc i s e m a y b e p e rfo rm e d t o wa l k- t h ro u g h t h e p ro c e d u re s a n d p a p e rwo rk as a fi n a l t i n i n g e x e rc i s e Due to th e r e c u rri n g need to p e r fo rm p a tc h m an a g e m e n t , it is not n e ce s s ar y to sch ed u l e s i m u l a te d d ri l l s o f t h e p ro c e d u re s as t h e y s h o u l d b e re p e a t e d a t re g u l a r i n t e r va l s a n ywa y I EC TR B.8 62443-2-3: 201 Op e r at i n g B th e as s e t i n s tal l e d E s tab l i s h i n g o p ti m i z e d B Th e o wn e r th e i r a p atch i n g C h an g e ass e t d rawi n g s i n ab i l i ty to th e co n te xt Th e th e of acti vi ty Trai n i n g an d patch an d th e aware n e s s pro ce s s patch e s d rawi n g s • Ve ri fi cati o n • If o f I AC S th at th e au d i t is m an ag e m e n t, fu rth e r I AC S , e ffo rts an d of are h as th e not te s te d p ro g ram s u s tai n e d or s e cu ri ty vu l n e rab i l i ti e s i n to e xi s ti n g au th o ri z e d , of m ay poor ch an g e re vi e we d l ead to ch an g e ch an g e th e th re at to on I EC m an ag e m e n t an d co n tro l l e d u n au th o ri z e d m an ag e m e n t re s u l ts , u n e xpl n e d an d i n cl u d e re l i ab i l i ty ch an g e m an ag e m e n t p ro g ram sh ou l d an an d e n vi ro n m e n t, R e g ard l e s s th e bel on g ap pro p ri ate is is of th e an in th e th e y re vi e we d ri s k shou ld cl e arl y ad h e re to acco m m o d ate u n d e rs ta n d an d ap p ro ve d co m p ari n g o r n o t i n s tal l i n g cyber s e cu ri ty an d th e p atch th at p atch th e m an ag e m e n t i d e n ti fy th e r i s ks in of i n s tal l i n g ad d i ti o n p e rs o n n e l fo r ch an g e is to th e e va l u a t i n g com pl ete d acc u te l y p ro ce d u re s ta rg e t ch an g e patch i m m e d i ate l y afte r th e ch an g e p art o f th e i n s tal l ati o n e xp e ri e n ce e n g i n e e ri n g s u cce ss fu l l y an d c l e a rl y as fo r d e p l o ym e n t an d as se s s m e n t co n tro l s p e rfo rm e d sh ou ld m an ag em e n t ‑ 2‑ a d e vi c e s , re l at e d te s ti n g to patch re s u l ts an d p ro ce s s e s re fe r to th e I S O /I E C 27000 s e ri e s [1 ] c o n s tan t d i s c o ve re d bu si n ess i n cre as i n g th e to ch an g i n g vi g i l an ce z e ro - d ay n e two rk i s tre n d i n te n ti o n s , au to m ati o n e n s u re _ u nder be d o cu m e n tati o n of so au th o ri z e d wi th co n ti n u o u s l y m al ware ’ s p re ca u ti o n s e d i ti o n an d sh ou l d m an ag em e n t shou ld th o s e ch an g e m n tai n Wh i l e th e re of co n tro l s p ro ce s s e s aw ar e n e s s aware n e s s s ys te m s ch an g e o rd e r re s u l ts 62443 l an d s cap e th i s to wo rk s e cu ri ty was re co rd s ve ri fi c a t i o n an d a an d p e rfo rm e d th e Vu l n e r ab i l i t y Secon d p ro g m ph as e ch an g e i n s tru m e n ta ti o n ch an g e i n fo rm a ti o n o f s tan d ard s are p e rs o n n e l th e y are i n cl u d e s ys te m U pd ate not patch i n g p ro ce s s su bj ect co m p e n s ati n g • i n s tal l ati o n is ch an g e o r u p d ate s patch e s does th e of e xi s ti n g b e fo re s e c u ri ty- re l ate d cri ti cal I AC S i n co n s i s te n t E xi s ti n g to i n cl u d e shou ld co n tro l of a d h e re i m pl em en ti n g tra d i t i o n a l i n cl u d e if o f re d u ci n g I n d i cati o n s p e rfo rm e d p ro c e s s shou l d Th e I AC S m an ag e m e n t sh ou ld p ro ce s s patch , re co g n i z e bu t o p e ti o n s m an ag e m e n t to m an ag e m e n t m an ag e m e n t Th e B patch d o cu m e n tati o n , pro ce ss , For enoug h , m an ag e m e n t th e acti vi ti e s An y u p g rad e s , an patch i n to o b j e c t i ve ch an g e s track wh o m an ag e m e n t Th e al l to patch of m an ag e m e n t th e th e I AC S n ow d i ffi cu l t ch an g e m an ag e m e n t m an ag e m e n t • p r o g r am fo l l o wi n g : ch an g e • is are n o t fu l fi l l i n te g rate th at ch an g e s i ssu es i n cl u d e th e i r th e y p ro g ram poor i n acc u te • – m an ag e m e n t es tabl i s h e d sh ou l d A u n d o cu m e n te d • p at c h patch , th e y wi l l e n s u re ap p ro pri ate l y • – 53 m an ag e m en t o wn e r to an d h as fi rs t o ve r t i m e p ro ce s s e s In I ACS 201 Ov er vi ew Afte r an d an © I EC d evel o pm e n t in i ts a of It ve ry an d ta rg e t an d e ffe cts on can I AC S Th u s re m n th at th at be an s ys te m s s e cu re th at e as y p ath au to m ati o n as s e t ass e t e xi s t vu l n e b i l i t i e s targ e ti n g e n vi ro n m e n t i m po rtan t vu l n e rab i l i ti e s th re ats m a l wa re th e i r s ys te m s is th e o wn e rs Th e s e must affe c t i n to th e th e i r I AC S s ys te m s m ay o wn e rs be h a rm fu l shou ld an d t a ke it th e – 54 – I E C TR 4 - - : © I E C I n o rd e r t o fa c i l i t a te as s e t o wn e rs a wa re n e s s o f t h e n e w vu l n e b i l i ti e s th a t a re f o u n d , as w e l l as p ro vi d i n g d e ta i l s o n t h e o l d e r vu l n e b i l i ti e s , t h e re are a va ri e t y o f we b s i t e s a va i l a b l e s u c h as th o s e p ro vi d e d by I AC S p ro d u c t s u p p l i e rs an d C o m p u te r E m e rg e n c y R e ad i n e s s Te a m s ( C E R Ts ) C yb e r E m e rg e n c y Respon se Te a m s or G o ve rn m e n t e n t i t i e s s u c h a s a co u n try’ s C E R T a n d th e I C S - C E R T o p e te d b y th e U S D e p a rt m e n t o f H o m e l a n d S e c u ri t y , as we l l as o th e r s i tu ati o n al a ware n e s s o rg an i z a t i o n s s u c h a s t h e O p e n - S o u rc e Vu l n e b i l i t y D a t ab as e [ ] an d th e S AN S I n te rn e t S to rm C e n te r [ ] a re ve r y u s e fu l i n p ro vi d i n g a l e r t n o t i fi c a t i o n s Th e s e o rg an i z a t i o n s an d t h e i r we b s i te s a l s o m a y p ro vi d e d e ta i l s o n c o u n te rm e as u re s th a t ca n be ta ke n in o rd e r to h el p p ro t e c t a g n s t th e new fo u n d th r e a ts It is s tro n g l y re c o m m e n d e d th a t as s e t o wn e rs ch e ck t h e s e s i t e s t h ro u g h o u t t h e we e k, o r e ve n b e t t e r, s i g n u p fo r e m a i l n o ti fi c a t i o n s a s t h e a l e rts a re p u b l i s h e d B Ou t ag e As s e t o wn e rs s c h ed u l i n g sh ou l d as se s s th e ap p l i ca b i l i t y of th e vu l n e b i l i t y to t h e i r s ys t e m s as al e rt n o ti fi ca t i o n s a re re l e a s e d a n n o u n c i n g t h e n e w vu l n e b i l i ti e s I f t h e re a re s ys t e m s i n s co p e o f th e vu l n e b i l i t y, a p p ro p ri a t e ac t i o n s m a y i n c l u d e p a tc h i n g t h e s ys t e m s i n th e n e x t c yc l e ( o n c e th e I AC S ve n d o r h a s a p p ro ve d t h e p a tc h e s ) o r m a y i n c l u d e t a ki n g c o u n t e rm e as u re s i n t h e e ve n t th a t p a tc h e s ar e n o t a va i l a b l e fo r t h e s ys te m s , o r th e s ys t e m s c a n n o t b e i m m e d i a t e l y p a t ch e d d u e t o t h e i r c ri ti c a l i t y a n d , o f co u rs e , t h e i m p a c t o f ta ki n g t h e s ys te m s o f fl i n e O n c e t h e as s e s s m e n t h as b e e n m a d e an d t h e a p p r o p ri a t e n e x t s te p s h a ve b e e n d e t e rm i n e d , i t m ay be l i ke l y i n som e case s t h at t h e s ys t e m s can n o t be p a tc h e d u n ti l th e n e x t o u tag e , p l a n n e d o r n o t I t i s i m p o rta n t to s c h e d u l e th e s ys t e m p a t ch i n g i n to t h e o u t a g e wi n d o w w h e n i t i s f e a s i b l e t o d o Al s o i m p o rt an t i s to i n c l u d e a d d i t i o n al t i m e i n to th e a c ti vi t y , i n c a s e t h e re a re co m p l i c a t i o n s sh ou l d be e n co u n te re d te s t e d in a d u ri n g th e p a tc h i n g n o n - p ro d u c ti o n p ro c e s s e n vi ro n m e n t Wh e n ah e ad of a va i l a b l e , th e o u ta g e s ys te m p at c h i n g wi n d o w, to h el p m i n i m i z e p o te n t i a l i s s u e s c a u s e d b y th e p a tc h i n g Wh e n s ys t e m s c a n n o t i m m e d i a te l y b e p a tc h e d d u e to th e a g e o f t h e O S , b e c a u s e p a tc h e s ar e not ye t a va i l ab l e , or fo r an y o th er re a s o n , it is i m p o rt a n t to e n s u re a p p ro p ri a te co u n te rm e a s u re s are ta ke n t o m i t i g a t e t h e ri s ks an d t o re d u c e th e a t t ac k s u rfac e , wh e re i t i s fe as i b l e to d o s o , u n t i l th e s ys t e m s c a n b e u p g d e d o r p a tc h e d B Secu ri t y h ar d e n i n g S e c u ri t y h a rd e n i n g in th e c o n te x t of p a tc h m an a g e m e n t is th e i m p l e m e n t a ti o n of s e c u ri t y co n t ro l s a n d t h e re m o va l o f c o m p o n e n ts , fe a tu r e s a n d p ri vi l e g e s t h a t a re n o t re q u i re d S e c u ri t y h a rd e n i n g d o e s n o t r e p l ac e p a tc h m a n a g e m e n t , i t re d u ce s t h e a p p l i c a b l e p a tc h e s b y re m o vi n g u n n e c e s s a ry s o ft ware , wh i c h t h e n d o e s n o t n e e d to b e p a tc h e d a n d p o s s i b l y l i m i t s th e e ffe c ts o f c e rt n e xp l o i ts F o r m o re i n fo rm a t i o n on s e cu ri t y h a rd e n i n g fo r I AC S re fe r t o t h e p l a t fo rm p ro d u c t s u p p l i e r d o c u m e n t a ti o n , t h e I AC S p ro d u c t s u p p l i e r, I E C 4 - - [ ] , U S N a t i o n a l S e c u ri ty Ag e n c y ( N S A) s e c u ri t y g u i d e s [ ] a n d o th e r s e c u ri t y re s o u rc e s B I n ven t o r y an d d at a m n t e n an c e I t i s c ri ti c a l t h a t a c o m p a n y kn o w wh a t a s s e t s ar e i n th e i r I AC S e n vi r o n m e n t Kn o wi n g wh a t ve rs i o n s of OSs, fi rm wa re an d i n s ta l l e d ap p l i ca ti o n s is eq u al l y i m p o rt an t , e s peci al l y wh e n vu l n e b i l i ti e s are a n n o u n c e d an d a s s e t o wn e rs n e e d t o m ake a d e t e rm i n a t i o n a s t o wh e t h e r th e i r s ys te m s a re at ri s k or n o t Wi th m an y I AC S e n vi ro n m e n ts tod ay co n s i s ti n g of a co n g l o m e t i o n o f s ys t e m s wi t h d i ffe re n t c ri t i ca l i ty l e ve l s , ap p l i c a ti o n ve rs i o n s a n d O S s , i t c an be ve r y pen d i n g d i f fi cu l t Wi t h a to t ck g o al th o s e s ys t e m s o f e n s u ri n g al l th at s ys t e m s h a ve a re been p a tc h e d u p - t o - d a te , an d i n cl u d i n g th o s e th at f i rm wa re a re s ti l l re vi s i o n s , ap p l i c a ti o n ve rs i o n s a n d p a tc h e s i n o r d e r to b e s t m i t i g a t e th e vu l n e rab i l i t i e s , tr ac ki n g th e s e as s e t d e t a i l s i s n e c e s s a ry Wi t h o u t t o o l s th a t a u t o m at e th i s , i t c an b e c o m e an ard u o u s an d t i m e c o n s u m i n g t a s k th a t i s l i ke l y to n o t h a p p e n i n a c o n s i s te n t m an n e r I E C TR 4 - - : © I E C – 55 – Au t o m a t i n g t h e i n ve n t o ry m a i n t e n a n ce , i n c l u d i n g p a tc h an d a p p l i c a t i o n ve rs i o n s , p ro vi d e s a q u i ck re fe re n c e p o i n t fo r u n d e rs t an d i n g th e c u rre n t p o s t u re o f t h e I AC S e n vi r o n m e n t Wh e n th e vu l n e b i l i t y i n ve n t o r y an d n o ti ces p ro vi d e a re a re l e as e d , q u i ck th e an a l ys i s as s e t as to o wn e rs wh a t can th e n s ys te m s e as i l y m ay be re fe re n c e i m p a c te d th e i r by th e vu l n e b i l i ti e s Th e m o re d e ta i l s th a t a re c o l l e c t e d b y th e s ys t e m p ro vi d i n g t h e i n ve n to ry, t h e e as i e r it is s ys t e m s to a re p ri o ri t i z e d m ake th e d e t e rm i n at i o n cate g o ri z e d ac c o rd i n g l y , by an d of cri ti cal i ty, m i ti g a t i n g th e p o te n t i a l i m p ac t vu l n e rab i l i t i e s s teps can be For a ffe c t i n g ta ke n exam pl e , th ose i f t h e c ri t i c al if th e s ys te m s s ys t e m s I AC S can be can n o t be p a t ch e d q u i c kl y B Pro c u ri n g or ad d i n g n ew d evi c es As th e I AC S e n vi ro n m e n t s c o n t i n u e to g ro w , n e w s ys t e m s an d s p a re p a rts wi l l l i ke l y b e a d d e d t o t h e e n vi ro n m e n t a n d p u t o n th e s a m e n e two rk s e g m e n t s a s e x i s ti n g I AC S s ys te m s N e w s ys t e m s , i n cl u d i n g p a t ch e s P l aci n g OS u p g r ad e s th e s e on vu l n e r ab l e e x i s ti n g s ys t e m s h a rd wa re , in th e m ay I AC S be l a cki n g e n vi ro n m e n t th e not l ates t onl y s e cu ri ty p u ts th os e s ys t e m s a t ri s k, b u t t h e y t h e n b e c o m e t h e we a ke s t l i n k o n t h a t n e two rk an d c a n p o t e n t i a l l y a l l o w t h e o t h e r s ys t e m s t o b e c o m e c o m p r o m i s e d I t i s i m p o rta n t t o e n s u re n e w s ys t e m s are fu l l y p a tc h e d p ri o r t o c o n n e c t i n g t h e m t o t h e I AC S n e t wo rk Th e s e s ys t e m s c a n b e p a tc h e d wh i l e d i s c o n n e c t e d fro m t h e n e two rk t h r o u g h th e u s e o f re m o va b l e m e d i a , l o c a l p a tc h s e r ve rs o r b y c o n n e c t i n g t h e m to a n o n - p r o d u c ti o n o r n o n - c ri ti c a l n e tw o rk In ad d i t i o n s u p p l i e rs ’ to ap p l y i n g s e cu ri ty re c o m m e n d at i o n s fo r p a tc h e s , h ar d e n i n g ass e t th e o wn e rs n ew sh ou ld s ys te m s to al so fo l l o w i n cl u d e th e a c t i vi ti e s p ro d u c t su ch as d i s a b l i n g u n n e c e s s a ry s e rvi c e s , u s e r ac c o u n ts , a c t i va t i n g h o s t fi re wa l l s a n d o t h e r h a rd e n i n g ac t i vi ti e s B 8 Th e P at c h i m p a c ts of m an ag e m e n t poor p at c h r ep o rt i n g an d m an ag e m en t c o n ti n u o u s i m p ro ve m e n t p ro c e s s KPI s sh ou ld be m e a s u re d u sing KP I s th a t f ac i l i ta t e a Th e fo l l o wi n g a re e x am p l e s o f KP I s th a t m a y b e u s e d to m e a s u re p a t ch m a n ag e m e n t e f fe c ti ve n e s s : • n u m b e r o f a s s e t s c o m p ro m i s e d d u e t o m i s s i n g p a tc h e s ; • n u m b e r o f kn o wn vu l n e b i l i ti e s wi t h o u t au t h o ri z e d p a t c h e s ; • n u m b e r o f p a tc h e s a va i l a b l e ; • n u m b e r o f p a tc h e s a p p l i e d ; • n u m b e r o f a s s e ts n o t p at ch e d g re a t e r th a n d a y s ; • a ve g e n u m b e r o f d a ys re q u i re d to p a tc h a l l a s s e ts ; • n u m b e r o f kn o wn p a tc h e s i n e ac h s ta t e ( s e e Tab l e ) ; an d • m i n i m u m , m a x i m u m a n d a ve g e t i m e kn o wn p a tc h e s a re i n e ac h s ta t e – 56 – An n ex I EC TR 62443-2-3:201 © I EC 201 C ( i n f o rm at i ve ) I A CS C prod u ct An n ex Th i s an n e x p ro vi d e s p ro d u ct / s er v i c e p r o vi d er g u i d an c e on p at c h i n g o r g an i z at i o n u p d a t e s /p a t c h e s I AC S s u p p l i er for g u i d an ce cybe r s u p p l i e rs , to I AC S s e cu ri ty th i s an n e x p ro d u c t s u p p l i e rs vu l n e rab i l i t i e s appl i es to in an y th e i r i n d e ve l o p i n g p ro d u c ts d e ve l o p e r of a an d Al th o u g h s e cu ri ty d i s tri b u ti n g ad d re s s e d p atch i n te n d e d to fo r d i s tri b u ti o n S e cu ri ty patch p ro vi d e rs I EC 62443 N ot only ‑ ‑ P atch p atch Th e • • [3] u po n an an d d i s c o ve ry , be I AC S th e i r in of i n, s o ftware wh i ch of u pd ate s e cu ri ty u pd ate s n e ce s sary I n an d – I AC S I AC S as I EC capabi l i ti e s th e i r s e cu ri ty as s e t th e be o wn we l l as s e rvi ce 62443-2-4 fo r s e r vi c e patch e s , vu l n e rab i l i ti e s d e fi n e d pol i cy in th e bu t of I AC S be [2 ] th e i r an y an d p ro vi d e rs patch th i rd - party p ro d u c t su ppl i er are th e on I AC S pro ce ss e s ch an g e b e fo re p atch an d re l e as e m an ag e m e n t fo r I AC S cybe r s e cu ri ty s e cu ri ty u pd ate s fo r, d e pe n d en t to I AC S d epen d en t s e cu ri ty co m pl e ted u pd ate of i d e n ti fyi n g s u p p l i e rs th e d u ri n g e val u ate d as p e cts g u i d an ce Al l th e al l on R i g o ro u s acti vi ti e s : g u i d an ce co n s i d e re d i n s tal l m aj o r p ro vi d e s u pd ate , care fu l l y s o ftwa re va l i d a ti o n u pd ates o rg a n i z a ti o n a re p ro d u cts Th i s s e cu ri ty d e s cri b i n g fo l l o wi n g p ro vi d e s – an d to cybe r su ppl i er th i rd - p arty s e cu ri ty o wn e rs a th e Th i s u p d at e s m u st to of ch an g e s s u p p l i e r' s d e ve l o p m e n t al s o th at on m o n i to ri n g th e ad d i ti o n fo r i n te g to rs an s e cu ri ty sh ou l d p ro d u ct h ave fo cu s e s s ec u r i t y s e cu ri ty val i d ati o n to m an ag e d i s tri b u ti o n e n s u re v u l n e r ab i l i t i e s Devel o p m en t of c yb e r re co rd i n g shou l d an n e x vu l n e b i l i ti e s u pon I AC S d epen d I AC S can su ppl i er Th i s an d th e m an ag e m e n t p ro d u ct set su ppl i er ad d re s s re s u l ts d e ve l o p m e n t p ro d u ct to s e rvi ce s p ro ce s s fo rm al i z e d Di s co ver y al so p ro d u cts te s t ava i l ab l e co m p re h e n s i ve p ro d u c t m ust th e i r be m an ag e m e n t a I AC S wh i ch ve ri fi cati o n sh ou ld p atch p ro vi d e proce s s co n fi g u rati o n of m an ag e m e n t sh ou ld Th e d e l i ve r mu st m an ag e m e n t s o ftware i n fo rm ati o n wh o u sing p ro d u c t u pd ate patch th e i r s u p p l i e rs th i rd - p arty d e ve l o p m e n t mu st o wn i n cl u d e patch fo r s o ftware an d i n fo rm ati o n m an ag e m en t p ro ce s s e s • Di s tri b u ti o n an d • ti m e l y of C o m m u n i c at i o n co m m u n i cati o n C Di s c o very C an d wi th of of i n f o r m at i o n cyb e r o u t r eac h as se t – s e c u ri ty – Th i s Th i s gu ides u pd ate s , gu ides an d th e th e I AC S re l e van t I AC S p ro d u c t su ppl i er i n fo rm ati o n p ro d u c t to su ppl i er i n ass e t on s e cu re o wn e rs m n tai n i n g o wn e rs v u l n e r ab i l i t i e s G en e r al D i s c o ve r y patch an d i d e n ti fi cati o n m an ag e m e n t _ s ecu ri t y d i s tri b u ti o n U n der d evel o pm e n t p ro ce s s of th e s e cu ri ty vu l n e b i l i ti e s in I AC S is a ke y acti vi ty fo r th e I EC TR a) 62443-2-3: 201 Th e I AC S d i s co ve ry b) p ro d u ct fo r Vu l n e rab i l i t y re s o u rc e s , c) cod e I AC S p ro d u c t A as vu l n e rab i l i ty po te n ti al 2) l e ve l of th e 3) ro o t 4) co m pl e xi ty cau se of th e s p e c i fi c ( th i rd - p arty) s u p p l i e rs a) m n tai n ch an g e an d I AC S list wi th i n of m o n i to r fo r as s es s vu l n e rab i l i t i e s d o cu m e n t C in pl ace an d Th e re to o l s C E R Ts ) p ro ce d u re s wh i ch on m ay an d an sh ou ld ( fo r an d aspe cts are a of vari e ty e xam pl e p ri va te ad d re s s i d e n ti fi cati o n an al ys i s th e be is ve n d o r' s an d I AC S sh ou ld p ro d u c t vu l n e rab i l i ty of d i s co ve ry pro to co l fu z z e rs ) , co m m u n i cati o n s Th e th e s e sh ou l d be d efi n e d i n th e patch d e te rm i n e th e fo l l o wi n g : s u p p l i e r' s a it m ay i n co rpo rate m ay be co m po n e n ts n eed pro d u cts to m ay s e cu re l y a p ro vi d e d be va ri e t y by i n co rp o rat e d i n te rac t wi th a of e xte rn al i n to va ri e t y of p ro d u cts i d e n t i f i c at i o n an o th e r s u p p l i e r) h e te ro g e n e o u s ; s o ftwa re I AC S t h e re i n te ract d i s co ve ry I AC S wi th i n s u p p l i e r' s th at th e prod u ct pro d u cts h a ve been i n s tal l e d , al l th e an d d i s c o ver y in for d epl o ye d cri ti cal i ty, d e pl o ye d th e cri ti cal i ty an d th e i r s o ftware wi th wh i ch th e I AC S cu s to m e r’ s n eeds; s ys te m s ; i n cl u d i n g h a rd wa re i n an d h ard ware s ys te m s ; co n s i d e rs p ro to c o l s , i n te ract vu l n e rab i l i ty Vu l n e r ab i l i t y d e pl o ye d d i s co ve re d d i s co ve re d m u st pro to co l s , in pol i cy tech n o l o g i es , p ro d u c ts an y p ro d u ct o th e r vu l n e b i l i ti e s th e ( i m pact tech n o l o g i es , c) e) al l u s e rs ; h ard ware mu st vu l n e rab i l i t y s u p p l i e r' s th e sh ou l d : th e p ro d u c ts ad d re s s end d i s c o ver y h a ve an d be o th e r d i s co ve ry Th e re fo re , b) d) a d e s cri b i n g au to m ate d ( an d an d L i ke w i s e , I AC S s u p p l i e rs a s u p p l i e r' s sh ou ld i d e n ti fi cati o n th e I AC S p ro to co l s an pro d u ct pol i cy an d p ro to co l s ; Vu l n e r ab i l i t y R e g ard i n g I AC S an d on an al ys i s ; an d C 2 – e xpo s u re ; i m p act te ch n o l o g i e s te ch n o l o g i e s, pol i cy d i s co ve ry of h e te ro g e n e o u s a te s ti n g , I CS-CERT vu l n e b i l i ty l e ve l s u p p l i e r' s h ave 57 po l i cy ) An y sh ou l d p ro ce d u re s s u p p l i e r' s of – pe n e trati o n e val u ati o n , fre q u e n c y 201 p ro d u ct( s ) d i s co ve ry su ch m an ag e m e n t d) I EC su ppl i er th e i r s tati c Th e © s ys te m s ; an d d i scu ss i o n s s o ftware wi th wi th ass e t wh i ch o wn e rs th e I AC S an d d e te rm i n e d i d e n t i f i c at i o n wi th i n ex t er n al l y s o u rc ed pro d u ct c o m p o n en t s R e g ard i n g su ppl i er a) m n tai n th ei r b) i n c o rp o rate d te ch n o l o g i e s , p ro to co l s , h ard ware an d s o ftware , th e I AC S p ro d u c t sh ou l d : a li st of th e te ch n o l o g i e s , p ro to c o l s , h a rd ware an d s o ftware i n c o rp o te d i n to p ro d u c ts ; h a ve a vu l n e b i l i t y d i s co ve ry po l i cy th at co n s i d e rs th e i r th i rd - p arty ve n d o r' s patch pol i ci es; c) m o n i to r co m p o n e n t tech n o l o g i es , p ro to co l s , h ard ware an d s o ftware for vu l n e b i l i ti e s an d patch e s ; d) e) as s e s s ve ri fy th e f) vu l n e rab i l i ti e s an d val i d a te , s e cu ri ty d ocu m en t p atch e s , on u pd ates th e m i ti g ate d th e I AC S re l e as e d vu l n e rab i l i ty, possi bl y by by th i rd - p arty p ro d u c t th e i t su ppl i er te ch n o l o g y cri ti cal i ty i n co rp o ti n g patch e s i n to ch an g e cri ti cal i ty; s ys te m s , an d d e te rm i n e d th e fo r th e p l at fo rm an d m ap app l i cab i l i ty s u p p l i e rs ; to m an ag e m e n t s p e c i fi c s ys te m an d e ffi cacy of an d th i rd - party ve n d o r – C Dev el o p m en t , B as ed th e a on I AC S th e • Th e te s t scope th e an d th e fu n cti o n al – i m p act on th e s e cu ri ty – a vo i d i n g Th e i n tro d u c i n g patch ' s co n n e cte d – I AC S not au to m ati o n th at co u l d be th e to I AC S u sed to su g g es ted fi re wal l – su g g es ted i n tru s i o n – s ys te m a) c o rre c t i ve m ad e d e fi n e d u p d at e s patch va l i d a t e bas e d on 201 a fo r th e m an ag e m e n t m i ti g ati o n th at ( fo r po l i cy, e xam pl e , vu l n e rab i l i ty cri ti cal i ty assessm en t an d of of th e th e I AC S ; I AC S ; an d in pro ce d u re co n s i d e ri n g th e sh ou l d ass e t be d ocu m en ted o wn e r' s patch an d th e m an ag em e n t s ce n ari o s : a s e cu re d way; an d i n te rn e t su ppl i er th e shou ld attack al s o s u rface p ro vi d e Th e a l ist of co m pe n s ati n g co m p e n s ati n g co n tro l s mi ght co n tro l s i n cl u d e: ru l e s ; d e tecti o n acti o n i n vo l vi n g m an ag e m e n t co n si d e rati o n s ve ri fi cati o n , Be s u pp l i e r' s an d I EC s ys te m (I DS) r u l e s /s i g n a t u r e s ; an d h a rd e n i n g co n fi g u ti o n m ad e s ec u ri t y © re co n fi g u ti o n ; Di s tri b u ti o n Be to pro d u ct – Afte r th e ve ri fy 62443-2-3:201 re co m m e n d ati o n ) i n s tal l ati o n fo l l o wi n g re d u ce p ro d u c t Ad d i ti o n al an d i n te rn e t – E ve ry by of TR vu l n e rab i l i ti e s cre ate d co n n e cte d Th e be re q u i re m e n ts n ew be co ve ri n g I AC S shoul d re q u i re m e n ts d e pl o ym e n t sh ou l d – gu ided c re at e , co n fi g u rati o n patch e s I EC co n s i d e r: on C b) fo r – v al i d at i o n as sco pe , c o rre c t i ve i m p act an d • a an d an d sh ou l d – p ro ce s s e s , • or an al ys i s p ro ce d u re s • an al ys i s , su ppl i er u p g d e i m p act • c ri ti cal i ty p ro d u c t s e cu ri ty v er i f i c at i o n 58 th e of c y b er I AC S ava i l ab l e in avai l ab l e are a p atch co ve re d a be o th e r cre ate d sh ou l d pe rfo rm e d usin g a ch an g e p arts of th e I EC 62443 s e ri e s u p d at e s s u p p l i e r' s c o n fo rm an ce wi th i n in s ec u ri t y pro d u ct to s ys te m wi th u pd ates th e re as o n ab l e sh ou l d : s u pp l i e r' s ti m e po l i cy fram e , in vi a a s e cu re c o n fo rm an ce ch an n e l wi th th e s u p p l i e r' s po l i cy c) P ro vi d e s e cu re d) P ro vi d e p ro d u ct e) U se C An o wn e rs th e as s e t th e i n fo rm ati o n VP C XM L o wn e r fi l e m ay, m an ag em e n t p ro d u ct wi th a m ean s of ve ri fy i n g p atch i n te g ri ty, su ch as a cryp to g raph i cal l y su ppl i er m aki n g on acq u i ri n g th i rd - party s o ftwa re u p d ate s u pon wh i ch th e I AC S d epen d s Co m m u n i c at i o n patch a) ass e t h as h th e i r fo rm at an d fro m patch th e XM L S ch e m a d e fi n ed in An n e x A o u t r eac h ti m e d o cu m e n ts shou ld fo l l o wi n g faci l i tate to or ti m e , to acce s s m an ag e m e n t n eed re p o rt a acce ss to I AC S s u s pe cte d attack pro d u ct or su ppl i er e xpe rti se , vu l n e b i l i t y Th e I AC S th e ass e t b y: po l i cy an d pro ce d u re d o cu m e n ts a vai l a b l e to o wn e rs ; b) ad d re s s i n g as s e t own e r co m m u n i cati o n s in th e i r p atch m an ag e m e n t po l i cy an d p ro ce d u re d o cu m e n ts ; c) d o cu m e n ti n g vary, co m m u n i cati o n s d epen d i n g u pon ch an n e l s vu l n e rab i l i ty an d fo r vu l n e b i l i t y patch cri ti c al i t y; an d patch m essag es , wh i ch m ay I E C TR 4 - - : © I E C d) p ro vi d i n g a m e an s fo r as s e t o wn e rs – 59 – to co n tact th e I AC S p ro d u ct su ppl i er fo r ti m e l y te ch n i cal as s i s tan ce ; e) p ro vi d i n g a m ean s fo r as s e t o w n e rs to co n tact th e I AC S p ro d u ct su ppl i er re g ard i n g a s u s p e c t e d a t t a c k o r vu l n e r a b i l i t y ; a n d f) co m m u n i cati n g to th e as s e t o w n e rs an d s ys te m i n c l u d i n g s i g n i f i c a n t d a t e s a n d s u p p o r t l e ve l s i n te g rato rs ab o u t l i fe c yc l e s u p p o rt , – 60 – I E C TR 4 - - : © I E C B i b l i o g rap h y N O TE to T h i s b i b l i o g r a p h y i n c l u d e s re f e r e n c e s t o s o u r c e s u s e d i n t h e c r e a t i o n o f t h i s s t a n d a r d a s we l l a s re f e r e n c e s s o u rc e s th at m ay d th e re ad e r in d e ve l o pi n g a g re a t e r u n d e rs tan d i n g of c yb e r s e c u ri t y as a wh o l e an d d e v e l o p i n g a m a n a g e m e n t s y s t e m N o t a l l re f e re n c e s i n t h i s b i b l i o g p h y a re r e f e r r e d t o t h r o u g h o u t t h e t e x t o f t h i s s t a n d a rd T h e r e f e re n c e s h a v e b e e n b ro ke n d o w n i n t o d i f f e r e n t c a t e g o ri e s d e p e n d i n g o n t h e t y p e o f s o u r c e t h e y are Ref er en c es [1 ] [2 ] [3 ] Ot h er [4 ] to o t h er p ar t s , th e I EC 62443 s er i es : 62443‑ 4‑ , s t an d ar d s an d r ef er en c es : I SO 639-1 :2002 – Codes for the representation of names of languages – Part : Alpha- Codes for the representation of names of countries and their subdivisions – Part : Country codes I SO 31 66-2:2007 – [7] I SO 421 7:2008 – [1 ] of Industrial communication networks – Security for industrial and control systems – Part 4-1 : Product development requirements IEC [6 ] Ot h er an t i c i p at e d , I E C 4 - - , Security for industrial process measurement and control – Part 2-4: Certification of IACS supplier security policies and practices I SO 31 66-1 :2006 – [1 0] an d Industrial communication networks – Network and system security – Part 2-1 : Establishing an industrial automation and control system security program [5 ] [9] ex i s t i n g I EC 62443‑ 2‑ , code [8 ] both Codes for the representation of names of countries and their subdivisions – Part 2: Country subdivision code Codes for the representation of currencies and funds I S O : 0 – Data elements and interchange formats – Information interchange – Representation of dates and times E C E /TR AD E /C /C E F AC T /2 0 /2 – Trade Codes for Units of Measure used in International E C E /TR AD E /C /C E F AC T /2 0 /2 – Codes for Passengers, Types of Cargo, Packages and Packaging Materials (with Complementary Codes for Package Names) d o c u m en t s an d p u b l i s h ed r es o u r c es : Good Practice Guide: Manage Third-Party Risk, C e n tre fo r P ro t e c ti o n o f N a t i o n a l I n fra s tru c t u re ( C P N I ) [1 ] Good Practice Guide: Patch Management, C e n tr e fo r P ro t e c t i o n o f N a t i o n al I n fra s tru c t u re ( C P N I ) [1 ] Recommended Practice for Patch Management of Control Systems , U n i te d S t a t e s D e p a rt m e n t o f H o m e l a n d S e c u ri t y ( D H S ) [1 4] Cyber Security Procurement Language for Control Systems , U n i te d S t a te s D e p a rt m e n t o f H o m e l an d S e c u ri t y ( D H S ) [1 ] Common Industrial Control System Vulnerability Disclosure Framework, C o n tro l S ys t e m s J o i n t Wo rki n g G ro u p ( I C S J W G ) I n d u s tr i a l I E C TR 4 - - : © I E C [1 ] – 61 – Cross-Sector Roadmap for Cybersecurity of Control Systems , I n d u s tri a l C o n tro l S y s te m s J o i n t W o rki n g G r o u p ( I C S J WG ) [1 7] [1 ] Security Update Guide, Second Edition , M i c ro s o ft Security Guidelines for the Electricity Sector: Patch Management for Control Systems , N o r th Am e ri c a n E l e c tri c R e l i a b i l i t y C o u n c i l ( N E R C ) C o n tro l S y s te m s S e c u ri t y Wo rki n g G r o u p ( C S S WG ) [1 ] N I S T S pe ci al P u bl i cati o n 0 - 40 , Creating a Patch and Vulnerability Management Program [2 ] N I S T S p e c i a l P u b l i ca t i o n 0 - Guide to SCA DA and Industrial Control Systems Security We b s i t e s : [2 ] M i cr o s o ft U p d a te M a n ag e m e n t P ro ce s s , a va i l a b l e a t < h t : //te c h n e t m i c ro s o f t c o m /e n u s /l i b r ar y /c c7 0 as p x > [2 ] U n i te d N a t i o n s , C e n tre fo r Tra d e F a c i l i ta t i o n an d E l e c tro n i c B u s i n e s s ( U N /C E F AC T) , a va i l a b l e a t < h t t p : //www u n e c e o rg /ce f ac t > [2 ] E l e c t ro n i c B u s i n e s s u s i n g e Xt e n s i b l e M a rku p La n g u a g e ( e b XM L ) , a va i l a b l e a t < h t t p : //www e b xm l o r g > [2 4] [2 ] O rg a n i z a ti o n fo r P ro d u c t i o n Te c h n o l o g y, a va i l a b l e a t < h t : //www wb f o rg /> M i c ro s o f t M a n u fa c t u ri n g U s e rs G ro u p ( M s M U G ) , Au t o m a t i o n F e d e t i o n , a va i l a b l e a t < h t t p : //www m s m u g o rg /> [2 ] I n d u s tr i a l C o n tr o l S ys t e m s C yb e r S e c u ri t y Al e r ts , B u l l e t i n s , Ti p s , U n i t e d S t a t e s I n d u s tr i a l C o n tr o l S ys t e m s C yb e r E m e rg e n c y R e s p o n s e Te am ( I C S - C E R T) , a vai l a b l e a t < h t : //www u s - c e r t g o v/c o n tr o l _s y s te m s /i c s - c e rt /> [2 7] P a tc h M a n a g e m e n t a n d W S U S M a i l i n g L i s t , S h avl i k Te c h n o l o g i e s , L LC , a vai l a b l e a t < h t t p : //www p a tc h m a n a g e m e n t o rg /> [2 ] S e c u ri t y C o n f i g u t i o n G u i d e s , N a t i o n a l S e c u r i t y Ag e n c y ( N S A) , a va i l a b l e a t < h ttp : //www n s a g o v/i a/m i ti g ati o n _g u i d an ce /s e cu ri ty_co n fi g u rati o n _g u i d e s /i n d e x s h tm l > [2 ] O p e n - S o u rce V u l n e b i l i t y D a t ab as e , a va i l a b l e a t < h t t p : //www o s vd b o rg > [3 ] S AN S I n te r n e t S t o rm C e n t e r, a va i l a b l e a t < h t t p : //i s c s a n s e d u /> [3 ] M as s ac h u s e t t s I n s t i tu t e o f Te c h n o l o g y I n te rd i s c i p l i n a ry C o n s o rt i u m fo r I m p ro vi n g C ri t i ca l I n fras tru c t u re C yb e rs e c u ri t y , I AC S c yb e r - s e c u ri t y re s e a rc h a va i l a b l e a t < h t t p : //i c m i t e d u > _ INTERNATIONAL ELECTROTECHNICAL COMMISSION 3, rue de Varembé PO Box 31 CH-1 21 Geneva 20 Switzerland Tel: + 41 22 91 02 1 Fax: + 41 22 91 03 00 info@iec.ch www.iec.ch