IEC62443-4-2-wtf? Operational Technology Device Security

The talk opens by framing operational technology, where availability matters most. Outages in factories, elevators, power grids or refineries can cost money or cause physical harm. The speaker then walks through typical OT network layers, from field devices with analog or serial links up to plant networks, and explains how VPNs, vendor laptops and removable media can bring outside risk into otherwise isolated sites.

The core of the talk is the IEC 62443-4-2 component standard. The speaker describes its security levels, from SL1, which protects against accidental misuse, up to SL4, the highest level aimed at nation-state attackers. Most device requirements are functional, so they can be verified by checking that a feature such as TLS exists, but they say nothing about implementation bugs. The development process requirements, including threat modeling, reviews and traceability, are described as heavy and hard to apply at lower levels, and the speaker notes the standard gives little guidance on developer feedback or security culture.

The closing section questions whether certification delivers real security. Certification bodies interpret the standard differently, the standard is not revised as threats change, and buyers often cannot tell a secure device from an insecure one. The speaker concludes that compliance and security both matter but are different goals, that teams need motivation and feedback to build secure products, and that security-minded engineers inside companies can still improve devices within these constraints.