What is PD IEC/TR 62443-2-3 – Industrial automation and control systems about?
PD IEC/TR 62443-2-3 is an international standard that discusses patch management in the IACS environment for industrial and control systems. Automation in the industrial workplace provides the advantages of improving productivity and quality while reducing errors and waste, increasing safety, and adding flexibility to the manufacturing process.
PD IEC/TR 62443-2-3 describes requirements for asset owners and industrial automation and control system (IACS) product suppliers that have established and are now maintaining an IACS patch management program.
PD IEC/TR 62443-2-3 recommends a defined format for the distribution of information about security patches from asset owners to IACS product suppliers, a definition of some of the activities associated with the development of the patch information by IACS product suppliers and deployment and installation of the patches by asset owners. The exchange format and activities are defined for use in security-related patches; however, they may also be applicable for non-security related patches or updates.
Note: PD IEC/TR 62443-2-3 does not differentiate between patches made available for the operating systems (OSs), applications or devices. It does not differentiate between the product suppliers that supply the infrastructure components or the IACS applications; it guides all patches applicable to the IACS. Additionally, the type of patch can be for the resolution of bugs, reliability issues, operability issues or security vulnerabilities.
Who is PD IEC/TR 62443-2-3 – Industrial automation and control systems for?
PD IEC/TR 62443-2-3 on patch management of security for industrial automation and control systems applies to:
- Manufacturer of automation machines
- Quality testing personnel
Why should you use PD IEC/TR 62443-2-3 – Industrial automation and control systems?
Patch management is a set of processes used to monitor patch releases, decide which patches should be installed to which system under consideration (SuC), if the patch should be tested before installation on a production SuC, at which specified time the patch should be installed and of tracking the successful installation.
PD IEC/TR 62443-2-3 provides guidance on which Industrial automation and control systems (IACS) suppliers and owners are using commercial-off-the-shelf (COTS) technology developed for business systems in their everyday processes. This provides an increased opportunity for cyber-attack against the IACS equipment since COTS systems are more widely known and used.
PD IEC/TR 62443-2-3 addresses the patch management aspect of IACS cyber security. Patch management is part of a comprehensive cyber security strategy that increases cyber security through the installation of patches, also called software updates, software upgrades, firmware upgrades, service packs, hotfixes, basic input-output system (BIOS) updates and other digital electronic program updates that resolve bugs, operability, reliability and cyber security vulnerabilities.