IEC TR 62443-2-3:2015
(Main)Security for industrial automation and control systems - Part 2-3: Patch management in the IACS environment
Security for industrial automation and control systems - Part 2-3: Patch management in the IACS environment
IEC TR 62443-2-3:2015(E) describes requirements for asset owners and industrial automation and control system (IACS) product suppliers that have established and are now maintaining an IACS patch management program. This Technical Report recommends a defined format for the distribution of information about security patches from asset owners to IACS product suppliers, a definition of some of the activities associated with the development of the patch information by IACS product suppliers and deployment and installation of the patches by asset owners. The exchange format and activities are defined for use in security related patches; however, it may also be applicable for non-security related patches or updates.
General Information
Standards Content (Sample)
IEC TR 62443-2-3 ®
Edition 1.0 2015-06
TECHNICAL
REPORT
colour
inside
Security for industrial automation and control systems –
Part 2-3: Patch management in the IACS environment
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form
or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from
either IEC or IEC's member National Committee in the country of the requester. If you have any questions about IEC
copyright or have an enquiry about obtaining additional rights to this publication, please contact the address below or
your local IEC member National Committee for further information.
IEC Central Office Tel.: +41 22 919 02 11
3, rue de Varembé Fax: +41 22 919 03 00
CH-1211 Geneva 20 info@iec.ch
Switzerland www.iec.ch
About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.
About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigenda or an amendment might have been published.
IEC Catalogue - webstore.iec.ch/catalogue Electropedia - www.electropedia.org
The stand-alone application for consulting the entire The world's leading online dictionary of electronic and
bibliographical information on IEC International Standards, electrical terms containing more than 30 000 terms and
Technical Specifications, Technical Reports and other definitions in English and French, with equivalent terms in 15
documents. Available for PC, Mac OS, Android Tablets and additional languages. Also known as the International
iPad. Electrotechnical Vocabulary (IEV) online.
IEC publications search - www.iec.ch/searchpub IEC Glossary - std.iec.ch/glossary
The advanced search enables to find IEC publications by a More than 60 000 electrotechnical terminology entries in
variety of criteria (reference number, text, technical English and French extracted from the Terms and Definitions
committee,…). It also gives information on projects, replaced clause of IEC publications issued since 2002. Some entries
and withdrawn publications. have been collected from earlier publications of IEC TC 37,
77, 86 and CISPR.
IEC Just Published - webstore.iec.ch/justpublished
Stay up to date on all new IEC publications. Just Published IEC Customer Service Centre - webstore.iec.ch/csc
details all new publications released. Available online and If you wish to give us your feedback on this publication or
also once a month by email. need further assistance, please contact the Customer Service
Centre: csc@iec.ch.
IEC TR 62443-2-3 ®
Edition 1.0 2015-06
TECHNICAL
REPORT
colour
inside
Security for industrial automation and control systems –
Part 2-3: Patch management in the IACS environment
INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
ICS : 25.040.40; 35.040; 35.100 ISBN 978-2-8322-2768-8
– 2 – IEC TR 62443-2-3:2015 © IEC 2015
CONTENTS
FOREWORD . 5
INTRODUCTION . 7
1 Scope . 8
2 Normative references. 8
3 Terms, definitions, abbreviated terms and acronyms . 8
3.1 Terms and definitions . 8
3.2 Abbreviated terms and acronyms . 9
4 Industrial automation and control system patching . 11
4.1 Patching problems faced in industrial automation and control systems . 11
4.2 Impacts of poor patch management . 11
4.3 Obsolete IACS patch management mitigation . 12
4.4 Patch lifecycle state . 12
5 Recommended requirements for asset owner . 13
6 Recommended requirements for IACS product supplier . 14
7 Exchanging patch information . 14
7.1 General . 14
7.2 Patch information exchange format . 15
7.3 Patch compatibility information filename convention . 15
7.4 VPC file schema . 15
7.5 VPC file element definitions . 17
Annex A (informative) VPC XSD file format . 21
A.1 VPC XSD file format specification . 21
A.2 Core component types . 23
A.2.1 Overview . 23
A.2.2 CodeType . 23
A.2.3 DateTimeType . 24
A.2.4 IdentifierType . 24
A.2.5 IndicatorType . 25
A.2.6 TextType . 25
Annex B (informative) IACS asset owner guidance on patching . 26
B.1 Annex organization . 26
B.2 Overview. 26
B.3 Information gathering . 27
B.3.1 Inventory of existing environment . 27
B.3.2 Tools for manual and automatic scanning . 29
B.3.3 IACS product supplier contact and relationship building . 30
B.3.4 Supportability and product supplier product lifecycle . 32
B.3.5 Evaluation and assessment of existing environment . 32
B.3.6 Classification and categorization of assets/hardware/software. 33
B.4 Project planning and implementation . 36
B.4.1 Overview . 36
B.4.2 Developing the business case . 37
B.4.3 Establishing and assigning roles and responsibilities . 38
B.4.4 Testing environment and infrastructure . 40
B.4.5 Implement backup and restoration infrastructure . 41
B.4.6 Establishing product supplier procurement guidelines . 42
B.5 Monitoring and evaluation . 42
B.5.1 Overview . 42
B.5.2 Monitoring and identification of security related patches . 43
B.5.3 Determining patch applicability . 43
B.5.4 Impact, criticality and risk assessment . 44
B.5.5 Decision for installation . 45
B.6 Patch testing . 45
B.6.1 Patch testing process . 45
B.6.2 Asset owner qualification of security patches prior to installation . 46
B.6.3 Determining patch file authenticity . 46
B.6.4 Review functional and security changes from patches . 46
B.6.5 Installation procedure . 47
B.6.6 Patch qualification and validation . 48
B.6.7 Patch removal, roll back, restoration procedures . 48
B.6.8 Risk mitigation alternatives . 49
B.7 Patch deployment and installation . 50
B.7.1 Patch deployment and installation process . 50
B.7.2 Notification of affected parties . 50
B.7.3 Preparation . 51
B.7.4 Phased scheduling and installation . 51
B.7.5 Verification of patch installation . 52
B.7.6 Staff training and drills . 52
B.8 Operating an IACS patch management program . 53
B.8.1 Overview . 53
B.8.2 Change management . 53
B.8.3 Vulnerability awareness . 53
B.8.4 Outage scheduling . 54
B.8.5 Security hardening . 54
B.8.6 Inventory and data maintenance . 54
B.8.7 Procuring or adding new devices . 55
B.8.8 Patch management reporting and KPIs . 55
Annex C (informative) IACS product supplier / service provider guidance on patching . 56
C.1 Annex organization . 56
C.2 Discovery of vulnerabilities . 56
C.2.1 General . 56
C.2.2 Vulnerability discovery and identification within the product . 57
C.2.3 Vulnerability discovery and identification within externally sourced
product components . 57
C.3 Development, verification and validation of security updates . 58
C.4 Distribution of cyber security updates . 58
C.5 Communication and outreach . 58
Bibliography . 60
Figure 1 – Patch state model . 13
Figure 2 – VPC file schema . 16
Figure 3 – VPC file schema diagram format . 17
Figure B.1 – IACS patch management workflow . 27
Figure B.2 – Planning an IACS patch management process . 36
– 4 – IEC TR 62443-2-3:2015 © IEC 2015
Figure B.3 – Sample responsibilities chart . 40
Figure B.4 – Patch monitoring and evaluation process . 42
Figure B.5 – A patch testing process . 45
Figure B.6 – A patch deployment and installation process .
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.