Industrial cybersecurity: the journey towards IEC 62443 compliance

Edoardo Barbieri

on 2 December 2024

Tags: Compliance , IEC62443 , Industrial

Industrial cybersecurity is on every CISO’s mind as manufacturers strive to integrate their IT and OT operations to drive efficiency and productivity. However, with increased connectivity comes heightened risk. This means that securing devices, networks, and systems is a critical challenge. Canonical, the publisher of Ubuntu, recognizes this need and we are committed to advancing our capabilities in line with the IEC 62443 standard — a comprehensive framework for cybersecurity in industrial automation and control systems.

In this blog, we will give a brief overview of the scope of IEC 62443 and outline its relation to other standards in which Canonical is also active. In particular, we will highlight how Canonical’s extensive work in automotive standards, along with its contributions to industry-wide initiatives, is relevant to IEC 62443 compliance due to the shared principles of functional safety, device hardening, and secure lifecycle management. We’ll cover how Canonical is well-positioned to bridge the gap between IT and OT security, enabling industrial enterprises to adopt robust, compliant cybersecurity frameworks. We will conclude by articulating how industrial enterprises can work with the publisher of the most popular Linux distribution to help them on their compliance journey and secure their software development life cycle.

Committing to IEC 62443 compliance – building on our knowledge

IEC 62443 provides a structured approach to managing cybersecurity risk across the lifecycle of industrial systems, from design to decommissioning. It establishes a tiered certification path covering technical controls, secure network architecture, device hardening, and incident response strategies. By focusing on these key areas, IEC 62443 compliance enables companies to protect their systems from nefarious actors.

For Linux systems to continue being the driver of innovation in the industrial space, we need to ensure they have the robustness needed to perform in safety-critical applications, whilst also meeting the need for IEC 62443 compliance. At Canonical, we’re using our voice to help shape developments in areas such as automotive, through our collaboration with ELISA (Enabling Linux In Safety Applications). Partnerships are important in establishing best-practices that help guide the entire user-base.

Just as the automotive sector has to meet stringent safety requirements for vehicle integrity, industrial environments require solutions that secure critical infrastructure, often in complex, interconnected environments where a breach could have significant operational and safety implications. That’s what makes knowledge transfer so valuable.

Knowledge transfer doesn’t just mean reaching out, but looking inwards. We’re asking ourselves how we can adapt what we’re already doing, in order to build IEC 62443 readiness into our solutions. The good news is that many best practices you already follow will overlap with IEC 62443. In Canonical’s case, our experience in meeting automotive standards like ISO 26262 is a great advantage. While ISO 26262, ISO 21434, and IEC 62443 focus on specific domains, they share principles applicable across industries. The connection lies in their mutual emphasis on lifecycle management, risk assessment, and the integration of safety and security practices. Principles such as threat modeling and secure development practices, align with IEC 62443’s requirements, making expertise in one domain transferable to others.

Functional safety in the industrial context

For Canonical, this knowledge overlap between automotive and industrial safety is an opportunity to make practical recommendations around functional safety and cybersecurity to the industrial space. In the current landscape of proliferating cybersecurity threats, factory owners, manufacturing firms and industrial enterprises face a pressing need to secure their assets. Cyber-physical systems in industrial settings, from modern IoT devices to legacy infrastructure and OT solutions, share functional safety requirements with automotive, given their reliance on automated processes where safety and reliability are paramount.

Canonical solutions for automotive contain features suited to security in industry. Long-term support releases ensure that security maintenance doesn’t lapse at short notice; automated hardening tools for specific frameworks keep compliance from encroaching on other priorities; observable device management means organizations can demonstrate and audit compliance. Whilst the ways in which you implement these measures will differ from industry to industry, the fact that they are open source empowers you to tailor them to your needs. That’s what we’ll cover in the next section.

Canonical’s commitment to open-source excellence for industrial cybersecurity

At Canonical, we are dedicated to compliance and elevating the role of open-source software in industrial cybersecurity. Open-source software offers significant advantages. Transparency code means organizations have the flexibility to tailor solutions to meet their specific needs. This also carries benefits for security, with a global community of contributors working to continuously patch and protect the code they all care about. Canonical’s commitment to open-source cybersecurity solutions aims to provide manufacturers with transparent, adaptable security frameworks that support their compliance needs.

With Ubuntu, Canonical provides a secure, certified platform designed to handle industrial workloads, edge computing, and IoT environments. Our OS supports a wide array of devices, with a scalable security architecture ideal for managing industrial IoT devices and protecting critical infrastructure.

Advancing industrial cybersecurity through collaboration and innovation

We are fully committed to supporting industrial pioneers across their digitisation journeys by providing an unmatched experience for consuming open-source software. By fostering partnerships across the silicon spectrum and collaborating with leading industrial companies, we offer solutions that help industrial companies deploy secure, compliant systems that support productivity without compromising on security. As our goal is to help the enterprise embrace open source from end to end, across every class of compute and every class of application, we work with the leading semiconductor companies to combine open source adoption with innovative optimizations to get the most from each new chip. With our semiconductor partners, we develop joint product roadmaps, and enable differentiated hardware and robust product life-cycle support while still anchored to best-in-class Ubuntu.

As you’ve seen, our efforts extend to active participation in industry initiatives and standards bodies, where Canonical contributes to the development of cybersecurity frameworks and best practices. By working alongside other leaders in the field, we ensure that our solutions not only meet today’s standards but are prepared for future challenges, helping industrial companies to benefit from ongoing advancements in open-source security.

Partner with Canonical for secure, compliant industrial solutions

Our partnership can extend to your needs as well. Canonical’s commitment to IEC 62443 compliance stems from our dedication to providing industrial organizations with reliable, scalable cybersecurity solutions. Through our expertise in functional safety, we are uniquely positioned to address the specific needs of industrial environments. Our open-source platforms, designed with security at their core, provide industrial companies with the flexibility and resilience needed to navigate an increasingly complex cybersecurity landscape. By following IEC 62443 guidelines and integrating advanced security features, Canonical’s Ubuntu helps industrial companies meet compliance requirements and strengthen the resilience of their assets.

If your organization is looking to strengthen its cybersecurity stance and achieve IEC 62443 compliance, Canonical is ready to partner with you. Together, we can help you build secure, compliant industrial systems, opening new possibilities for innovation while ensuring robust defenses against evolving cyber threats.

To learn more about open standards and how they can benefit your manufacturing operations, learn from experts at Canonical and Bosch Rexroth. Watch the below webinar to explore the flexibility and automation possibilities enabled by software-defined approaches.