BS IEC 62443-3-3-2013 Industrial communication networks Network and system security System security requirements and security levels《工业通讯网络 网络和系统安全性 安全级和系统安全性要求》.pdf

1、BSI Standards PublicationIndustrial communication networks Network and system securityPart 3-3: System security requirements and security levelsBS IEC 62443-3-3:2013BS IEC 62443-3-3:2013Incorporating corrigendum April 2014BS IEC 62443-3-3:2013 BRITISH STANDARDNational forewordThis British Standard i

2、s the UK implementation of IEC 62443-3-3:2013, incorporating corrigendum April 2014.The UK participation in its preparation was entrusted to Technical Committee GEL/65, Measurement and control.A list of organizations represented on this committee can be obtained on request to its secretary.This publ

3、ication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. The British Standards Institution 2014. Published by BSI Standards Limited 2014ISBN 978 0 580 86794 1ICS 25.040.40; 35.110Compliance with a British Standard cannot confe

4、r immunity from legal obligations.This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 October 2013.Amendments/corrigenda issued since publicationDate Text affected31 May 2014 Implementation of IEC corrigendum April 2014: first bullet point in

5、clause 7.6.4 updated and both rows for SR 3.4 in Table B.1 updatedIEC 62443-3-3Edition 1.0 2013-08INTERNATIONALSTANDARDIndustrial communication networks Network and system security Part 3-3: System security requirements and security levelsINTERNATIONALELECTROTECHNICALCOMMISSIONXCICS 25.040.40; 35.11

6、0PRICE CODEISBN 978-2-8322-1036-9 Registered trademark of the International Electrotechnical CommissionWarning! Make sure that you obtained this publication from an authorized distributor.colourinsideBS IEC 62443-3-3:2013 2 62443-3-3 IEC:2013(E)CONTENTSFOREWORD. 9 0 Introduction 11 0.1 Overview .11

7、0.2 Purpose and intended audience 12 0.3 Usage within other parts of the IEC 62443 series 12 1 Scope.14 2 Normative references .14 3 Terms, definitions, abbreviated terms, acronyms, and conventions.14 3.1 Terms and definitions 14 3.2 Abbreviated terms and acronyms 20 3.3 Conventions 22 4 Common cont

8、rol system security constraints 22 4.1 Overview .22 4.2 Support of essential functions .23 4.3 Compensating countermeasures .23 4.4 Least privilege.24 5 FR 1 Identification and authentication control 24 5.1 Purpose and SL-C(IAC) descriptions .24 5.2 Rationale.24 5.3 SR 1.1 Human user identification

9、and authentication 24 Requirement24 5.3.1Rationale and supplemental guidance .24 5.3.2Requirement enhancements 25 5.3.3Security levels .25 5.3.45.4 SR 1.2 Software process and device identification and authentication 26 Requirement26 5.4.1Rationale and supplemental guidance .26 5.4.2Requirement enha

10、ncements 26 5.4.3Security levels .27 5.4.45.5 SR 1.3 Account management .27 Requirement27 5.5.1Rationale and supplemental guidance .27 5.5.2Requirement enhancements 27 5.5.3Security levels .27 5.5.45.6 SR 1.4 Identifier management 28 Requirement28 5.6.1Rationale and supplemental guidance .28 5.6.2Re

11、quirement enhancements 28 5.6.3Security levels .28 5.6.45.7 SR 1.5 Authenticator management .28 Requirement28 5.7.1Rationale and supplemental guidance .28 5.7.2Requirement enhancements 29 5.7.3Security levels .29 5.7.45.8 SR 1.6 Wireless access management.30 Requirement30 5.8.1BS IEC 62443-3-3:2013

12、2 62443-3-3 IEC:2013(E)CONTENTSFOREWORD. 9 0 Introduction 11 0.1 Overview .11 0.2 Purpose and intended audience 12 0.3 Usage within other parts of the IEC 62443 series 12 1 Scope.14 2 Normative references .14 3 Terms, definitions, abbreviated terms, acronyms, and conventions.14 3.1 Terms and definit

13、ions 14 3.2 Abbreviated terms and acronyms 20 3.3 Conventions 22 4 Common control system security constraints 22 4.1 Overview .22 4.2 Support of essential functions .23 4.3 Compensating countermeasures .23 4.4 Least privilege.24 5 FR 1 Identification and authentication control 24 5.1 Purpose and SL-

14、C(IAC) descriptions .24 5.2 Rationale.24 5.3 SR 1.1 Human user identification and authentication 24 Requirement24 5.3.1Rationale and supplemental guidance .24 5.3.2Requirement enhancements 25 5.3.3Security levels .25 5.3.45.4 SR 1.2 Software process and device identification and authentication 26 Re

15、quirement26 5.4.1Rationale and supplemental guidance .26 5.4.2Requirement enhancements 26 5.4.3Security levels .27 5.4.45.5 SR 1.3 Account management .27 Requirement27 5.5.1Rationale and supplemental guidance .27 5.5.2Requirement enhancements 27 5.5.3Security levels .27 5.5.45.6 SR 1.4 Identifier ma

16、nagement 28 Requirement28 5.6.1Rationale and supplemental guidance .28 5.6.2Requirement enhancements 28 5.6.3Security levels .28 5.6.45.7 SR 1.5 Authenticator management .28 Requirement28 5.7.1Rationale and supplemental guidance .28 5.7.2Requirement enhancements 29 5.7.3Security levels .29 5.7.45.8

17、SR 1.6 Wireless access management.30 Requirement30 5.8.1BS IEC 62443-3-3:201362443-3-3 IEC:2013(E) 3 Rationale and supplemental guidance .30 5.8.2Requirement enhancements 30 5.8.3Security levels .30 5.8.45.9 SR 1.7 Strength of password-based authentication.30 Requirement30 5.9.1Rationale and supplem

18、ental guidance .30 5.9.2Requirement enhancements 31 5.9.3Security levels .31 5.9.45.10 SR 1.8 Public key infrastructure (PKI) certificates.31 Requirement31 5.10.1Rationale and supplemental guidance .31 5.10.2Requirement enhancements 32 5.10.3Security levels .32 5.10.45.11 SR 1.9 Strength of public k

19、ey authentication 32 Requirement32 5.11.1Rationale and supplemental guidance .32 5.11.2Requirement enhancements 33 5.11.3Security levels .33 5.11.45.12 SR 1.10 Authenticator feedback .33 Requirement33 5.12.1Rationale and supplemental guidance . 33 5.12.2Requirement enhancements 33 5.12.3Security lev

20、els .33 5.12.45.13 SR 1.11 Unsuccessful login attempts34 Requirement34 5.13.1Rationale and supplemental guidance .34 5.13.2Requirement enhancements 34 5.13.3Security levels .34 5.13.45.14 SR 1.12 System use notification .34 Requirement34 5.14.1Rationale and supplemental guidance .34 5.14.2Requiremen

21、t enhancements 35 5.14.3Security levels .35 5.14.45.15 SR 1.13 Access via untrusted networks 35 Requirement35 5.15.1Rationale and supplemental guidance .35 5.15.2Requirement enhancements 35 5.15.3Security levels .35 5.15.46 FR 2 Use control .36 6.1 Purpose and SL-C(UC) descriptions 36 6.2 Rationale.

22、36 6.3 SR 2.1 Authorization enforcement 36 Requirement36 6.3.1Rationale and supplemental guidance .36 6.3.2Requirement enhancements 37 6.3.3Security levels .37 6.3.46.4 SR 2.2 Wireless use control .37 Requirement37 6.4.1Rationale and supplemental guidance .38 6.4.2BS IEC 62443-3-3:2013 4 62443-3-3 I

23、EC:2013(E)Requirement enhancements 38 6.4.3Security levels .38 6.4.46.5 SR 2.3 Use control for portable and mobile devices38 Requirement38 6.5.1Rationale and supplemental guidance .38 6.5.2Requirement enhancements 39 6.5.3Security levels .39 6.5.46.6 SR 2.4 Mobile code 39 Requirement39 6.6.1Rational

24、e and supplemental guidance .39 6.6.2Requirement enhancements 39 6.6.3Security levels .39 6.6.46.7 SR 2.5 Session lock .40 Requirement40 6.7.1Rationale and supplemental guidance .40 6.7.2Requirement enhancements 40 6.7.3Security levels .40 6.7.46.8 SR 2.6 Remote session termination40 Requirement40 6

25、.8.1Rationale and supplemental guidance .40 6.8.2Requirement enhancements 40 6.8.3Security levels .41 6.8.46.9 SR 2.7 Concurrent session control .41 Requirement41 6.9.1Rationale and supplemental guidance .41 6.9.2Requirement enhancements 41 6.9.3Security levels .41 6.9.46.10 SR 2.8 Auditable events

26、.41 Requirement41 6.10.1Rationale and supplemental guidance .41 6.10.2Requirement enhancements 42 6.10.3Security levels .42 6.10.46.11 SR 2.9 Audit storage capacity.42 Requirement42 6.11.1Rationale and supplemental guidance .42 6.11.2Requirement enhancements 42 6.11.3Security levels .43 6.11.46.12 S

27、R 2.10 Response to audit processing failures.43 Requirement43 6.12.1Rationale and supplemental guidance .43 6.12.2Requirement enhancements 43 6.12.3Security levels .43 6.12.46.13 SR 2.11 Timestamps 43 Requirement43 6.13.1Rationale and supplemental guidance .43 6.13.2Requirement enhancements 44 6.13.

28、3Security levels .44 6.13.46.14 SR 2.12 Non-repudiation 44 Requirement44 6.14.1BS IEC 62443-3-3:2013 4 62443-3-3 IEC:2013(E)Requirement enhancements 38 6.4.3Security levels .38 6.4.46.5 SR 2.3 Use control for portable and mobile devices38 Requirement38 6.5.1Rationale and supplemental guidance .38 6.

29、5.2Requirement enhancements 39 6.5.3Security levels .39 6.5.46.6 SR 2.4 Mobile code 39 Requirement39 6.6.1Rationale and supplemental guidance .39 6.6.2Requirement enhancements 39 6.6.3Security levels .39 6.6.46.7 SR 2.5 Session lock .40 Requirement40 6.7.1Rationale and supplemental guidance .40 6.7.

30、2Requirement enhancements 40 6.7.3Security levels .40 6.7.46.8 SR 2.6 Remote session termination40 Requirement40 6.8.1Rationale and supplemental guidance .40 6.8.2Requirement enhancements 40 6.8.3Security levels .41 6.8.46.9 SR 2.7 Concurrent session control .41 Requirement41 6.9.1Rationale and supp

31、lemental guidance .41 6.9.2Requirement enhancements 41 6.9.3Security levels .41 6.9.46.10 SR 2.8 Auditable events .41 Requirement41 6.10.1Rationale and supplemental guidance .41 6.10.2Requirement enhancements 42 6.10.3Security levels .42 6.10.46.11 SR 2.9 Audit storage capacity.42 Requirement42 6.11

32、.1Rationale and supplemental guidance .42 6.11.2Requirement enhancements 42 6.11.3Security levels .43 6.11.46.12 SR 2.10 Response to audit processing failures.43 Requirement43 6.12.1Rationale and supplemental guidance .43 6.12.2Requirement enhancements 43 6.12.3Security levels .43 6.12.46.13 SR 2.11

33、 Timestamps 43 Requirement43 6.13.1Rationale and supplemental guidance .43 6.13.2Requirement enhancements 44 6.13.3Security levels .44 6.13.46.14 SR 2.12 Non-repudiation 44 Requirement44 6.14.1BS IEC 62443-3-3:201362443-3-3 IEC:2013(E) 5 Rationale and supplemental guidance .44 6.14.2Requirement enha

34、ncements 44 6.14.3Security levels .44 6.14.47 FR 3 System integrity 45 7.1 Purpose and SL-C(SI) descriptions45 7.2 Rationale.45 7.3 SR 3.1 Communication integrity45 Requirement45 7.3.1Rationale and supplemental guidance .45 7.3.2Requirement enhancements 46 7.3.3Security levels .46 7.3.47.4 SR 3.2 Ma

35、licious code protection .46 Requirement46 7.4.1Rationale and supplemental guidance .46 7.4.2Requirement enhancements 47 7.4.3Security levels .47 7.4.47.5 SR 3.3 Security functionality verification.47 Requirement47 7.5.1Rationale and supplemental guidance .47 7.5.2Requirement enhancements 48 7.5.3Sec

36、urity levels .48 7.5.47.6 SR 3.4 Software and information integrity.48 Requirement48 7.6.1Rationale and supplemental guidance .48 7.6.2Requirement enhancements 49 7.6.3Security levels .49 7.6.47.7 SR 3.5 Input validation .49 Requirement49 7.7.1Rationale and supplemental guidance .49 7.7.2Requirement

37、 enhancements 49 7.7.3Security levels .49 7.7.47.8 SR 3.6 Deterministic output 50 Requirement50 7.8.1Rationale and supplemental guidance .50 7.8.2Requirement enhancements 50 7.8.3Security levels .50 7.8.47.9 SR 3.7 Error handling.50 Requirement50 7.9.1Rationale and supplemental guidance .50 7.9.2Req

38、uirement enhancements 50 7.9.3Security levels .51 7.9.47.10 SR 3.8 Session integrity .51 Requirement51 7.10.1Rationale and supplemental guidance .51 7.10.2Requirement enhancements 51 7.10.3Security levels .51 7.10.47.11 SR 3.9 Protection of audit information 52 Requirement52 7.11.1Rationale and supp

39、lemental guidance .52 7.11.2BS IEC 62443-3-3:2013 6 62443-3-3 IEC:2013(E)Requirement enhancements 52 7.11.3Security levels . 52 7.11.48 FR 4 Data confidentiality .52 8.1 Purpose and SL-C(DC) descriptions 52 8.2 Rationale.52 8.3 SR 4.1 Information confidentiality .53 Requirement53 8.3.1Rationale and

40、supplemental guidance .53 8.3.2Requirement enhancements 53 8.3.3Security levels .53 8.3.48.4 SR 4.2 Information persistence.54 Requirement54 8.4.1Rationale and supplemental guidance .54 8.4.2Requirement enhancements 54 8.4.3Security levels .54 8.4.48.5 SR 4.3 Use of cryptography54 Requirement54 8.5.

41、1Rationale and supplemental guidance .55 8.5.2Requirement enhancements 55 8.5.3Security levels .55 8.5.49 FR 5 Restricted data flow 55 9.1 Purpose and SL-C(RDF) descriptions 55 9.2 Rationale.55 9.3 SR 5.1 Network segmentation 56 Requirement56 9.3.1Rationale and supplemental guidance .56 9.3.2Require

42、ment enhancements 56 9.3.3Security levels .57 9.3.49.4 SR 5.2 Zone boundary protection .57 Requirement57 9.4.1Rationale and supplemental guidance .57 9.4.2Requirement enhancements 57 9.4.3Security levels .58 9.4.49.5 SR 5.3 General purpose person-to-person communication restrictions .58 Requirement5

43、8 9.5.1Rationale and supplemental guidance .58 9.5.2Requirement enhancements 58 9.5.3Security levels .59 9.5.49.6 SR 5.4 Application partitioning59 Requirement59 9.6.1Rationale and supplemental guidance .59 9.6.2Requirement enhancements 59 9.6.3Security levels .59 9.6.410 FR 6 Timely response to eve

44、nts 59 10.1 Purpose and SL-C(TRE) descriptions 59 10.2 Rationale.60 10.3 SR 6.1 Audit log accessibility .60 Requirement60 10.3.1Rationale and supplemental guidance .60 10.3.2BS IEC 62443-3-3:2013 6 62443-3-3 IEC:2013(E)Requirement enhancements 52 7.11.3Security levels . 52 7.11.48 FR 4 Data confiden

45、tiality .52 8.1 Purpose and SL-C(DC) descriptions 52 8.2 Rationale.52 8.3 SR 4.1 Information confidentiality .53 Requirement53 8.3.1Rationale and supplemental guidance .53 8.3.2Requirement enhancements 53 8.3.3Security levels .53 8.3.48.4 SR 4.2 Information persistence.54 Requirement54 8.4.1Rational

46、e and supplemental guidance .54 8.4.2Requirement enhancements 54 8.4.3Security levels .54 8.4.48.5 SR 4.3 Use of cryptography54 Requirement54 8.5.1Rationale and supplemental guidance .55 8.5.2Requirement enhancements 55 8.5.3Security levels .55 8.5.49 FR 5 Restricted data flow 55 9.1 Purpose and SL-

47、C(RDF) descriptions 55 9.2 Rationale.55 9.3 SR 5.1 Network segmentation 56 Requirement56 9.3.1Rationale and supplemental guidance .56 9.3.2Requirement enhancements 56 9.3.3Security levels .57 9.3.49.4 SR 5.2 Zone boundary protection .57 Requirement57 9.4.1Rationale and supplemental guidance .57 9.4.

48、2Requirement enhancements 57 9.4.3Security levels .58 9.4.49.5 SR 5.3 General purpose person-to-person communication restrictions .58 Requirement58 9.5.1Rationale and supplemental guidance .58 9.5.2Requirement enhancements 58 9.5.3Security levels .59 9.5.49.6 SR 5.4 Application partitioning59 Requir

49、ement59 9.6.1Rationale and supplemental guidance .59 9.6.2Requirement enhancements 59 9.6.3Security levels .59 9.6.410 FR 6 Timely response to events 59 10.1 Purpose and SL-C(TRE) descriptions 59 10.2 Rationale.60 10.3 SR 6.1 Audit log accessibility .60 Requirement60 10.3.1Rationale and supplemental guidance .60 10.3.2BS IEC 62443-3-3:201362443-3-3 IEC:2013(E) 7 Requirement enhancements 60 1