ISA/IEC 62443 is the sole de-facto internationally recognized standard for cybersecurity in industrial automation and control systems (IACS), created through consensus. It serves as a thorough guide for organizations to manage their cybersecurity risk, but there is no magical solution. Similar to safety, cybersecurity necessitates constant monitoring, particularly with seemingly insignificant matters. The ISA/IEC 62443 provides a strategy, but its effectiveness rests with the plant-management team.

In the ISA/IEC 62443, there are 7 Foundational Requirements. One of these is ‘Use Control‘.

A simple example to illustrate this Foundational Requirement ‘Use Control’, is the key switch a lot of PLCs have. As seen above, this physical key may operate in varying modes, depending on the manufacturer. In general, in Run mode, the PLC or controller cannot be altered locally or over the network. In Program mode, modifications to the device can be made, whereas Remote mode generally enables programmers to remotely modify the device’s status.

As mentioned before, the ISA Global Cybersecurity Alliance, which sponsors the PLC Security Top 20 List, recommends that operators “keep the PLC in Run mode. If PLCs are not in Run mode, there should be an alarm to the operators.”

The key switch, being a physical thing, is the most effective means to prevent unauthorized modification of critical PLC or controller code. Despite this, the key is routinely left in the Program or Remote position because it is convenient for the maintenance team. The rationale for this approach is that it eliminates productivity loss that results from walking up to the device with the key, changing position, walking back to the workstation, making changes, and then restoring the key position and removing the key. While this is true, it overlooks the potential loss of productivity involved in a cybersecurity incident caused by unauthorized modification of the PLC or controller.