IEC 62443-3-1 Clause 5.4 – Physical/Token Authentication

Teaching note: Paraphrased from IEC/TR 62443-3-1:2009 (ISA-TR99.00.01-2007) for learning. The technical report is informational, not a requirements standard. Confirm wording in the published TR. Later normative parts (2-1, 3-3, 4-2) state the shalls.

Reference: IEC/TR 62443-3-1:2009 (ISA-TR99.00.01-2007), Clause 5.4
Related: Clause 5 | 5.5 Smart cards | 10.1 Physical protection | MFA

Technology categories: Overview | Cl. 5 | Cl. 6 | Cl. 7 | Cl. 8 | Cl. 9 | Cl. 10

What it is

Something you have: access card, dongle, USB token or similar physical token presented to a reader or host.

Vulnerabilities addressed

Guessable passwords and shared console logins. A token raises the bar for walk-up use of an engineering station or HMI.

Typical deployment

Door access and/or computer login. In a control room that is already physically controlled, the card alone may enable control actions after the person has been admitted.

Known issues and weaknesses

Lost, shared or left-in-the-reader tokens.
Tokens without a second factor are weak if the host is not in a secure area.
Issuance and revocation processes are easy to skip.

Use in IACS

The TR judged physical/token authentication as having a strong potential role in IACS, especially combined with a PIN or password.

Recommendations

Use a token as a single factor only when the host is already in a physically controlled area.
Where additional security is warranted, combine the token with a password or PIN (two-factor).
Plan lost/stolen revocation before rollout. Do not leave tokens in unattended consoles.