IEC 62443-4:2018 pdf download.Security for industrial automation and control systems
1 Scope
This part of IEC 62443 specifies process requirements for the secure development of products used in industrial automation and control systems. It defines a secure development life-cycle (SDL) for the purpose of developing and maintaining secure products. This life-cycle includes security requirements definition, secure design， secure implementation (including coding guidelines)， verification and validation, defect management, patch management and product end-of-life. These requirements can be applied to new or existing processes for developing, maintaining and retiring hardware, software or firmware for new or existing products. These requirements apply to the developer and maintainer of the product, but not to the integrator or user of the product. A summary list of the requirements in this document can be found in Annex B.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.
IEC 62443-2-4:2015，Security for industrial automation and control systems 一Part 2-4:Security program requirements for IACS service providers
IEC 62443-2-4:201 5/AMD1:2017
3.1.1 abuse case
test case used to perform negative operations of a use case
Note 1 to entry: Abuse case tests are simulated attacks often based on the threat model. An abuse case is a type of complete interaction between a system and one or more actors where the results of the interaction are intentionally intended to be harmful to the system, one of the actors or one of the stakeholders in the system.
3.1.9 authentication
provision of assurance that a claimed characteristic of an identity is correct
Note 1 to entry: Not all credentials used to authenticate an identity are created equally. The trustworthiness of the credential is determined by the configured authentication mechanism. Hardware or software-based mechanisms can force users to prove their identity before accessing data on a device. A typical example is proving the identity of a user usually through an identity provider.
Note 2 to entry: Authentication includes verifying human users as well as non-human users such as devices or processes.
3.1.10 automation solution
control system and any complementary hardware and software components that have been installed and configured to operate in an IACS
Note 1 to entry: Automation Solution is used as a proper noun in this part of the IEC 62443 series.
Note 2 to entry: The difference between the control system and the Automation Solution is that the control system is incorporated into the Automation Solution design (for example, a specific number of workstations, controllers and devices in a specific configuration)， which is then implemented. The resulting configuration is referred to as the Automation Solution.IEC 62443-4 pdf download.