IEC 62443-3-1 Clause 8.3 – Intrusion Detection Systems

Teaching note: Paraphrased from IEC/TR 62443-3-1:2009 (ISA-TR99.00.01-2007) for learning. The technical report is informational, not a requirements standard. Confirm wording in the published TR. Later normative parts (2-1, 3-3, 4-2) state the shalls.

Reference: IEC/TR 62443-3-1:2009 (ISA-TR99.00.01-2007), Clause 8.3
Related: Clause 8 | Intrusion Prevention Systems | Detection in Depth | FR 6 | 8.1 Log auditing

Technology categories: Overview | Cl. 5 | Cl. 6 | Cl. 7 | Cl. 8 | Cl. 9 | Cl. 10

What it is

An intrusion detection system (IDS) monitors network (NIDS) or host (HIDS) activity for misuse or anomaly and generates alerts. It does not normally block traffic. Blocking products are intrusion prevention systems (IPS) — not a 3-1 table-of-contents item; treat them as a later technology with a higher availability risk on process traffic.

Vulnerabilities addressed

Attacks and policy violations that have already passed prevention controls. IDS is the alarm, not the lock.

Typical deployment

Span or TAP on a conduit; host agents on servers. Tune signatures and baselines to industrial protocols or expect a flood of false positives.

Known issues and weaknesses

False positives on legitimate process traffic.
Encrypted tunnels hide payload from NIDS.
Automated response on a control network can cause a self-inflicted outage.

Use in IACS

Fit for IACS when first deployed in detect-only mode. Teaching note: industrial protocol-aware IDS is now available; the TR’s “no automated response until accuracy is trusted” rule is unchanged.

Recommendations

Initial IACS IDS configuration = detect-only. Do not enable automated response actions on incoming or outgoing process traffic.
Change that default only when the security management team believes detection accuracy is high enough that blocking will not harm essential functions.