Zum Inhalt springen

ALPHA holistic cybersecurity concept

Structure of the ICS (Industrial Control System):

The obvious difference between the IT and OT domains is that the IT and OT domains merge by using the established communication protocols (TCP/IP, UDP).

The ICS model according to the Purdue scheme:

There are a total of 6 levels and 4 zones. Cybersecurity must be adequately implemented at each level. The communication between the 4 zones must be safeguarded appropriately with the help of so-called conduits.


Cybersecurity Workflow

ALPHA will have to assess the cybersecurity requirements of the Asset Owner (or to create those according to some regulatory framework after assessing the ICS infrastructure of the customer) and to communicate clearly down the line those requirements to the System Integrator and Product Manufacturer. Consequently – after having done this – ALPHA will have to check the solution regarding its compliance with the initial requirements of the asset owner.

There are three main stakeholders in the definition of the cybersecurity framework:

If the IEC 62443 standardization framework is taken as a reference the process will have the following structure:

  1. Asset Owner is determining the targeted Security Level (SL).

2. IEC 62443-2-1 helps to assess and establish the cybersecurity policies for the asset owner. IEC 62443-2-4 helps to communicate these policies to the system integrators and component manufacturers down the line.

ALPHA will have to concentrate on these two regulatory frameworks in the first place. IEC 62443 provides Foundational Requirements (FR) to be met.

3. Every FR must be mapped to the corresponding System Requirement (SR) and Component Requirement (CR):

4. Dealing with the SL non-conformities: