Appendix 2. II

Security standards – quick reference

Standards related to Industrial IoT security discussed in this book are summarized here for quick referenence.

Device endpoint security

• CWE: Common Weakness Enumeration
• FIPS 140-2: Security Requirements for Cryptographic Modules
• FIPS 180-4: NIST-CSRC Secure Hash Standard (SHS)
• ISO/IEC 197702: Specification on Software Tagging
• ISA 62443-1-1: Security for Industrial Automation and Control Systems Part 1 – Terminology, Concepts, and Models
• ISA/IEC 62443-3-3: Security for Industrial Automation and Control Systems Part 3-3 – System Security Requirements and Security Levels
• ISO/IEC 15408: Common Criteria for Information Technology Security Evaluation
• NIST SP 800-155: Boot-process integrity measurement
• NIST SP 800-53: Security and Privacy Controls for Federal Information Systems and Organizations

Industrial connectivity infrastructure security

• ISA95: Purdue Enterprise Reference Architecture Enterprise-Control System Integration
• ISA-99: Industrial Automation and Control Systems Security (https://www.isa.org/isa99/)
• IEC 62443: Industrial Network and System Security
• IEC 62541: OPC Unified Architecture Specification
• IEC 61850: Substation Automation Protocols
• IEEE 1588: IEEE Standard for a Precision Clock Synchronization Protocol for Network Measurement and Control Systems
• NIST SP 800-53 Rev 4: Recommended Security and Privacy Controls for Federal Information Systems and Organizations
• NIST SP 800-82 Rev 2: Guide to Industrial Control Systems (ICS) Security, May 2015
• NIST SP 800-52: Guidelines on the Selection and Use of Transport-Layer Security
• TIA-942-A (http://www.tia-942.org/): ANSI/TIA-942-A: Telecommunications Infrastructure Standard for Datacenters (http://blog.siemon.com/standards/tia-942-and-tia-942-a-%E2%80%9Cdata-center-infrastructure%E2%80%9D-standards)

Edge-cloud security

• ISO/IEC 27001: A high-level management systems standard and its associated cloud-service-specific standards: ISO/IEC 27017 (for security) and ISO/IEC 27018 (for protection of personal data)
• Standards addressing specific aspects of cloud computing: ISO/IEC 27033 for network security, ISO/IEC 27034 for application security, ISO/IEC 19086 for cloud service SLAs
• Technology-specific security standards: Such as OASIS KMIP (key management), FIPS 140-2 (approved cryptographic modules), and OASIS SAML 2.0 (security assertions, used in IdAM implementations)
• ISO/IEC 20889: Standardizes de-identification techniques
• US National Institute of Standards and Technology (NIST) Special Publication 800-175B: Provides guidance on strong cryptographic methods
• NIST SP 800-144: Guidelines on Security and Privacy in Public Cloud Computing

 

 

Some useful documents on cloud security include the following:

• CSCC white paper Cloud Security Standards: What to Expect and What to Negotiate V2.0 (http://www.cloud-council.org/deliverables/CSCC-Cloud-Security-Standards-What-to-Expect-and-What-to-Negotiate.pdf)
• Cloud Control Matrix: https://downloads.cloudsecurityalliance.org/initiatives/ccm/CCM_v3_Info_Sheet.pdf
• Cloud Customer Architecture for Securing Workloads on Cloud Services: Published by Cloud Security Council
• SAFEcode/CSA: Practices for Secure Development of Cloud Applications
• Cloud computing –Benefits, risks, and recommendations for information security: Published by European Union Agency for Network and Information Security (ENISA)