Skip to content
OT AssociatesPURE PLAY OT SECURITY
← The OT Field Guide
05

Security levels: match the defence to the adversary

Set a target security level for each zone from the threat it faces, then measure the level its controls actually achieve.

5 min readInteractive figureISA/IEC 62443-3-3ISA/IEC 62443-3-2
Interactive figure
Target versus achieved security level, zone: basic process control
Who must this zone withstand?
Per foundational requirement
AchievedTarget
  • FR1 Identification & authentication
    −1
  • FR2 Use control
    −1
  • FR3 System integrity
    −2
  • FR4 Data confidentiality
    −2
  • FR5 Restricted data flow
    met
  • FR6 Timely response to events
    −1
  • FR7 Resource availability
    −1

Target SL 3. 6 of 7 foundational requirements fall short. That gap, zone by zone, is the security programme.

Move the adversary. The target follows the threat; the achieved level is what the zone really has today.

Move the adversary and watch the target security level and the gap change.

Four levels of adversary

ISA/IEC 62443 defines security levels by the attacker a zone must withstand. SL 1 protects against casual or coincidental violation. SL 2 against intentional attack with simple means, low resources and generic skills. SL 3 against sophisticated means with moderate resources and system-specific skills. SL 4 against sophisticated means with extended resources, such as a nation state.

Target, capability, achieved

The target level (SL-T) is set during risk assessment. The capability level (SL-C) is what the chosen components and systems can deliver. The achieved level (SL-A) is what is actually in place once configured and operated. The gap between target and achieved is the work.

This turns security from a list of good practices into an engineering requirement that can be specified in a capital project, verified at commissioning and measured over time.

Takeaways
  1. 01Security level is defined by the adversary, not the asset.
  2. 02Specify SL-T, verify SL-C, measure SL-A.
  3. 03Close the gap zone by zone, starting with the highest consequence.