← Home

IEC 62443-1-1 Clause 4 – The Situation

Clause 4 – The Situation in ISA/IEC 62443-1-1 explains why IACS cybersecurity has become increasingly important. The fundamental issue is that Industrial Automation and Control Systems (IACS) have become more connected, more complex and more dependent on technologies and relationships that increase their attack surface.

Teaching note: Summaries paraphrase ISA/IEC 62443-1-1 for learning. They are not a substitute for the normative text of the standard.

Reference: ISA/IEC 62443-1-1, Clause 4
Related: Introduction to IACS Security | IEC 62443-1-1 Clause 5.7 – Policies, Procedures & Guidelines | IEC 62443-1-1 Clause 6 – Models | Industrial Cyber Attacks | Defence in Depth | ISA/IEC 62443 overview

ISA/IEC 62443-1-1 Clause 4 – The Situation
Figure 1 – ISA/IEC 62443-1-1 Clause 4: The Situation — why IACS cybersecurity is critical: increased connectivity and evolving threats create real-world consequences (4.1 General, 4.2 Current Systems, 4.3 Current Trends, 4.4 Potential Impact).

4.1 General — Why IACS security is different

IACS cybersecurity is particularly important because IACS directly control physical processes. A security breach can therefore cause consequences far beyond loss of information:

Threats are not limited to external attackers:

IT compromise → primarily information and business consequences.

IACS compromise → potentially physical, safety, environmental and societal consequences.

The more technology, connectivity and external relationships an organization introduces, the greater the potential security risk.

4.2 Current Systems — The fundamental change

IACS have moved from isolated, proprietary architectures to connected, standardized environments. The shift can be summarised as follows.

From: isolated + proprietary IACS

To: connected + standardized IACS

Benefits

Security trade-off

More connectivity = more business value + more attack surface. Standardization and information sharing make systems easier to integrate, but also make them more susceptible to misuse and attack.

A major problem is complexity. It can become difficult to determine:

Who can access → when → what → from where → how

4.3 Current Trends — Why security emphasis is increasing

Clause 4.3 describes the trends driving increased attention to IACS cybersecurity. The table below summarises each trend and its security implication.

Trend Security implication
1. Increasing malicious code / attacks More attempts to compromise systems
2. COTS + IT/OT integration IACS inherit vulnerabilities from common IT technologies
3. Attack tools widely available Attack capability is no longer limited to highly skilled attackers
4. More third parties Joint ventures, partners and outsourced services increase the number of parties with security responsibilities
5. Threat actors becoming more serious Threat has expanded from amateurs and insiders to organised criminals and terrorists
6. Adoption of IP IACS inherit network-layer vulnerabilities common to business systems

The trend in one sentence: IACS are becoming more connected, standardized, accessible and dependent on third parties while attackers are becoming more capable and numerous.

This combination increases IACS risk and creates the need for more structured cybersecurity practices, policies and procedures.

4.4 Potential Impact

If an attacker gains access to an IACS, potential impacts include:

Information

Integrity

Availability

Physical / process

People / society

Key Takeaways

Standards References