Cyber Security ISA 99 / IEC 62443 D14 DLC-Meet, Jan 2019

Presenter Mayur Mehta Academic: Worked for: Currently working in: “M.Tech” - “BITS Pilani” “Software Systems” (Networks & Networked Systems) “B.E.” - “JNCT/RGPV Bhopal” “Electronics & Communications Engineering” Certifications GICPS, CSM, CTFL & few more Worked for: SEIMENS Schneider Electric PwC Currently working in: Novartis Lead Security Architect OT/ICS Association: ISA (ISA99 / IEC62443), IEEE, SANS-ICS & Other ICS/OT Security Groups

ISA 99 / IEC 62443 standard

History of ISA99 / IEC62443 The ISA99 standards development committee brings together industrial cyber security experts from across the globe to develop ISA standards on industrial automation and control systems security. When the ISA99 committee was formed there was an agreement between ISA and IEC to cooperate on the development of cybersecurity standards. This would avoid the need to create duplicate committees in each organization. This original and ongoing ISA99 work is being utilized by the International Electrotechnical Commission (IEC) in producing the multi-standard IEC 62443 series. ISA/IEC 62443 is a series of standards being developed by two groups: ISA99  ANSI/ISA-62443 IEC TC65/WG10  IEC 62443 In consultation with: ISO/IEC JTC1/SC27  ISO/IEC 2700x

ISA99 Scope ISA99 – IEC 62443 is International in scope Requirement contributions come from other standards like NERC-CIP, NIST, ISO etc. Flexible framework which serves a basis for Country and Local standards as well as Manufacturing guidelines. The ISA99 committee addresses industrial automation and control systems whose compromise could result in any, or all, of the following situations: Endangerment of public or employee safety Loss of public confidence Violation of regulatory requirements Loss of proprietary or confidential information Economic loss Impact on national security.

ISA 99 / IEC 62443 Standards ISA99/IEC-62443 standard is a family of standards with a large scope of use for ICS / OT environments. Some guidelines are rather general, while others are precise, specific and focussed. Many of those guidelines are still in the process of being defined or upgraded.

Training & Certification

ISA/IEC 62443 Cybersecurity Certification Programs Certificate 1: ISA/IEC 62443 Cybersecurity Fundamentals Specialist (online version available) Certificate 2: ISA/IEC 62443 Cybersecurity Risk Assessment Specialist Certificate 3: ISA/IEC 62443 Cybersecurity Design Specialist Certificate 4: ISA/IEC 62443 Cybersecurity Maintenance Specialist ISA/IEC 62443 Cybersecurity Expert: Individuals who achieve Certificates 1, 2, 3, and 4

ISA/IEC 62443 Cybersecurity Certification Programs ISA/IEC 62443 Training Name Days Prerequisite Online version Cost Certification Cybersecurity Fundamentals Specialist 2 3 to 5 years of exp. in the IT cybersecurity + 2 year of exp. in ICS Available 2000 USD (1640 USD for ISA members) IC32 / IC32E Cybersecurity Risk Assessment Specialist 3 certification Not available 2700 USD (2200 USD for ISA members) IC33 Cybersecurity Design Specialist IC34 Cybersecurity Maintenance Specialist IC37 Cost details link Certificate Steps: 1) Complete a designated training program Link 2) Pass a multiple choice exam through the Prometric testing center

D14 initiative Demand for Cyber Security professionals is increasing rapidly Other competing certification programs in the market which are easy so access compared to ISA certification which can only be achieved after attending class rooms trainings at USA. D14 is trying to negotiate a Train the Trainer program with the ISA to train local trainers to reduce the cost of training in D14.

Instructor Qualifications Ten (5) years active related industry experience in the course subject matter. One (1) year (or equivalent) experience teaching adults Ability to use a variety of training aids and instructional methods and to function in a hands-on adult learning environment Ability to relate subject matter to students work experience ISA Membership preferred, but not required To qualify as an instructor for courses marked with  "*" you must be an active and voting member of the related standards committee (IC32* in this case).

Q&A