IEC 62443-3-1 Clause 10.1 – Physical Protection

What it is

Physical protection is layered barriers from the site perimeter to the cabinet and port: fencing, locks, guards, cabinets, port blockers and control of spare media. Barriers must be tailored to the threat (vehicle, explosion, theft, walk-up).

Vulnerabilities addressed

Theft of hosts, insertion of malware via USB, tapping of copper, and any attack that starts by opening a door. Network authentication is bypassed if the attacker has the console.

Typical deployment

Concentric layers: site fence, building access, control-room access, cabinet locks, then disabled unused USB and console ports. Monitoring of perimeters for penetration and tamper patterns.

Known issues and weaknesses

Vegetation and clutter create hiding places. Perimeters that are never walked are theatre. Over-locking can conflict with safety access. Tailoring is site-specific; a generic checklist is not a design.

Use in IACS

Essential for every cyber control that assumes the hardware is still the plant’s hardware.

Recommendations

• Implement several physical barriers around informational and control assets, matched to the specific threat (including explosion or vehicle damage where relevant).
• Define security perimeters and check them daily for penetration, attempted penetration, tampering, or patterns that indicate an imminent physical attack.
• Keep perimeters clear of vegetation and other hiding cover outside the boundary.
• Control USB, console ports and spare media. Tailor measures to the site.