Access control is the process of granting or denying specific requests to obtain and use information and related information processing services. It is one of the foundational requirements (FRs) of the ISA/IEC 62443 standards for securing industrial automation and control systems (IACSs). According to the ISA/IEC 62443-3-3 standard, access control includes the following system requirements (SRs):
SR 1.1: Identification and authentication control
SR 1.2: Use control
SR 1.3: System integrity
SR 1.4: Data confidentiality
SR 1.5: Restricted data flow
SR 1.6: Timely response to events
SR 1.7: Resource availability
Among these SRs, the ones that are most related to the critical variables of account management and password strength are SR 1.1 and SR 1.2. SR 1.1 requires that the IACS shall provide the capability to uniquely identify and authenticate all users, processes, and devices that attempt to establish a logical connection to the system. This means that the IACS should have a robust account management system that can create, modify, delete, and monitor user accounts and their privileges. It also means that the IACS should enforce strong password policies that can prevent unauthorized access or compromise of user credentials. Password strength refers to the level of difficulty for an attacker to guess or crack a password. It depends on factors such as length, complexity, randomness, and uniqueness of the password.
SR 1.2 requires that the IACS shall provide the capability to enforce the use of logical connections in accordance with the security policy of the organization. This means that the IACS should have a mechanism to control the access rights and permissions of users, processes, and devices based on their roles, responsibilities, and needs. It also means that the IACS should have a mechanism to audit and log the activities and events related to access control, such as successful or failed login attempts, password changes, privilege escalations, or unauthorized actions.
Therefore, account management and password strength are the critical variables related to access control, as they directly affect the identification, authentication, and authorization of users, processes, and devices in the IACS.
[References:, ISA/IEC 62443-3-3:2013, Security for industrial automation and control systems - Part 3-3: System security requirements and security levels1, ISA/IEC 62443 Cybersecurity Fundamentals Specialist Certificate Program2, ISA/IEC 62443 Cybersecurity Library3, Using the ISA/IEC 62443 Standards to Secure Your Control Systems4, ]
