Blog
Blog
Anti-patterns in security architecture – part 3
Back-to-back firewall Some wrongly believe that there is a security benefit in ‘doubling up’ on firewalls to implement the same set of controls. In addition, some believe it is beneficial if the two firewalls come from different manufacturers. The thinking...
IEC62443 – Examples of practical requirements implementation – Part 4
Security Assurance Level 3 By definition should an SL3-compliant system be able to withstand intentional violation of its integrity by the use of sophisticated means with moderate resources, IACS-specific skills, and moderate motivation. In practical...
Anti-patterns in security architecture – part 2
Management bypass Defence-in-depth is a widely accepted approach to protecting the critical resources of a system. In addition, a good system architecture practice is to separate the data plane from the management plane. This separation can be achieved with...
IEC62443 – Examples of practical requirements implementation – Part 3
Security Assurance Level 2 Additionally, to the specification of SL1, IEC 62443-3-3 defines a further 23 requirements (or enhancements to SL1) necessary to be compliant with SL2. The most prominent of them are: Just as in the case of SL1 a good number...
Anti-patterns in security architecture – part 1
An Anit-pattern is a common solution or repeated behaviour that is ineffective or has the potential to create more problems than the advantages it is supposed to bring. In security architecture, an anti-pattern is a system design that should be avoided for...
IEC62443 – Examples of practical requirements implementation – Part 2
The IEC 62443 defines four Security Assurance Levels required for the safe operation of ICS systems mapped to the type of possible attack the security level is designed to address. Each ICS must fulfil the requirements applicable to one of the security...
Enterprise Connected Devices – a cyber security challenge – Part 2
Enterprise Connected Devices (ECDs) are all the devices that interact with, hold, or process an organisation’s data and can include end-user devices such as laptops and smartphones, physical devices connected to the Internet (IoT) such as cameras, and...
IEC62443 – Examples of practical requirements implementation – Part 1
IEC 62443 – an introduction In the last decade, industrial automation systems have become the subject of an unprecedented scale of cyber-attacks. Along with the scale of these attacks, their technical sophistication also increases, causing a constantly...
Enterprise Connected Devices – a cyber security challenge – Part 1
What are Enterprise Connected Devices? Enterprise Connected Devices (ECDs) are devices that interact with, hold, or process an organisation’s data and can include such device classes as: End user devices (EUD) – laptops and smartphones including BYOD...
The State of Global Operational Technology 2022 – part 3
SCADAfence, the OT & IoT cybersecurity technology consultancy, conducted a survey on the current state of OT security, the negative consequence of the shortage of qualified workforce in the field, and the general level of risk organisations are currently...