Pinned post
Marco (Marc) Ayala
Verified account This account is verified. Learn more@ICS_SCADA
Complex Control Systems | ICS/SIS/SCADA 30yr Field Exp: O&G, Chem, Maritime | Tech News | ISA Fellow | InfraGard | Security | GoM | Free Thinker
7.4K Following 6.4K Followers 20K Posts
Latest posts 5
๐๐๐จ๐: The six FBI Cyber Branch recommendations for industrial refrigeration and cold-chain controllers map cleanly to core International Society of Automation (ISA) ISA/IEC 62443 requirements.
Many of these you have heard me say well over a thousand times...
ย ย โข ๐ง๐ฎ๐ธ๐ฒ ๐ฐ๐ผ๐ป๐๐ฟ๐ผ๐น๐น๐ฒ๐ฟ๐ ๐ผ๐ณ๐ณ ๐๐ต๐ฒ ๐ฝ๐๐ฏ๐น๐ถ๐ฐ ๐ถ๐ป๐๐ฒ๐ฟ๐ป๐ฒ๐ โ 62443-2-1:2024 SPE 3 (segmentation from non-IACS/external networks) + zones and conduits (3-2) + 62443-๐ฏ-๐ฏ ๐๐ฅ 5 (Restricted Data Flow).
ย ย โข ๐ฃ๐๐ ๐ฎ๐ฐ๐ฐ๐ฒ๐๐ ๐ฏ๐ฒ๐ต๐ถ๐ป๐ฑ ๐ฎ ๐ณ๐ถ๐ฟ๐ฒ๐๐ฎ๐น๐น โ Same SPE 3 and FR 5 requirements. Firewalls enforce the zone boundary and conduit rules.
ย ย โข ๐๐ต๐ฎ๐ป๐ด๐ฒ ๐ฑ๐ฒ๐ณ๐ฎ๐๐น๐ ๐ฝ๐ฎ๐๐๐๐ผ๐ฟ๐ฑ๐ โ 62443-2-1:2024 SPE 6 (user access control) + 62443-3-3 SR 1.5 (Authenticator management under FR 1).
ย ย โข ๐๐ฒ๐ฎ๐ฟ๐ป ๐ต๐ผ๐ ๐๐ฒ๐ป๐ฑ๐ผ๐ฟ๐ ๐ฐ๐ผ๐ป๐ณ๐ถ๐ด๐๐ฟ๐ฒ ๐ฑ๐ฒ๐๐ถ๐ฐ๐ฒ๐ โ 62443-2-1:2024 SPE 2 (configuration management) and SPE 4 (component hardening). For OEMs and integrators, see 62443-2-4 (security program requirements for IACS service providers).
ย ย โข ๐ฆ๐ฒ๐ ๐๐ฎ๐ณ๐ฒ (๐ผ๐ฝ๐ฒ๐ฟ๐ฎ๐๐ถ๐ป๐ด) ๐๐ฒ๐บ๐ฝ๐ฒ๐ฟ๐ฎ๐๐๐ฟ๐ฒ ๐น๐ถ๐บ๐ถ๐๐ โ Protect critical setpoints through 62443-3-3 FR 3 (System Integrity), FR 2 (Use Control), and the 3-2 risk assessment that accounts for physical consequences.
ย ย โข ๐๐ป๐๐๐ฟ๐ฒ ๐ฎ๐น๐ฒ๐ฟ๐๐ ๐ฟ๐ฒ๐ฎ๐ฐ๐ต ๐๐ต๐ฒ ๐ฟ๐ถ๐ด๐ต๐ ๐ฐ๐ผ๐ป๐๐ฎ๐ฐ๐๐ โ 62443-2-1:2024 SPE 7 (event and incident management) + 62443-3-3 FR 6 (Timely Response to Events).
These are practical implementations of the standardsโ requirements for secure, reliable operation of systems with physical consequences. lnkd.in/p/gUht6sBd
#isa62443 #iec62443 #iacs #icscyber
Many of these you have heard me say well over a thousand times...
ย ย โข ๐ง๐ฎ๐ธ๐ฒ ๐ฐ๐ผ๐ป๐๐ฟ๐ผ๐น๐น๐ฒ๐ฟ๐ ๐ผ๐ณ๐ณ ๐๐ต๐ฒ ๐ฝ๐๐ฏ๐น๐ถ๐ฐ ๐ถ๐ป๐๐ฒ๐ฟ๐ป๐ฒ๐ โ 62443-2-1:2024 SPE 3 (segmentation from non-IACS/external networks) + zones and conduits (3-2) + 62443-๐ฏ-๐ฏ ๐๐ฅ 5 (Restricted Data Flow).
ย ย โข ๐ฃ๐๐ ๐ฎ๐ฐ๐ฐ๐ฒ๐๐ ๐ฏ๐ฒ๐ต๐ถ๐ป๐ฑ ๐ฎ ๐ณ๐ถ๐ฟ๐ฒ๐๐ฎ๐น๐น โ Same SPE 3 and FR 5 requirements. Firewalls enforce the zone boundary and conduit rules.
ย ย โข ๐๐ต๐ฎ๐ป๐ด๐ฒ ๐ฑ๐ฒ๐ณ๐ฎ๐๐น๐ ๐ฝ๐ฎ๐๐๐๐ผ๐ฟ๐ฑ๐ โ 62443-2-1:2024 SPE 6 (user access control) + 62443-3-3 SR 1.5 (Authenticator management under FR 1).
ย ย โข ๐๐ฒ๐ฎ๐ฟ๐ป ๐ต๐ผ๐ ๐๐ฒ๐ป๐ฑ๐ผ๐ฟ๐ ๐ฐ๐ผ๐ป๐ณ๐ถ๐ด๐๐ฟ๐ฒ ๐ฑ๐ฒ๐๐ถ๐ฐ๐ฒ๐ โ 62443-2-1:2024 SPE 2 (configuration management) and SPE 4 (component hardening). For OEMs and integrators, see 62443-2-4 (security program requirements for IACS service providers).
ย ย โข ๐ฆ๐ฒ๐ ๐๐ฎ๐ณ๐ฒ (๐ผ๐ฝ๐ฒ๐ฟ๐ฎ๐๐ถ๐ป๐ด) ๐๐ฒ๐บ๐ฝ๐ฒ๐ฟ๐ฎ๐๐๐ฟ๐ฒ ๐น๐ถ๐บ๐ถ๐๐ โ Protect critical setpoints through 62443-3-3 FR 3 (System Integrity), FR 2 (Use Control), and the 3-2 risk assessment that accounts for physical consequences.
ย ย โข ๐๐ป๐๐๐ฟ๐ฒ ๐ฎ๐น๐ฒ๐ฟ๐๐ ๐ฟ๐ฒ๐ฎ๐ฐ๐ต ๐๐ต๐ฒ ๐ฟ๐ถ๐ด๐ต๐ ๐ฐ๐ผ๐ป๐๐ฎ๐ฐ๐๐ โ 62443-2-1:2024 SPE 7 (event and incident management) + 62443-3-3 FR 6 (Timely Response to Events).
These are practical implementations of the standardsโ requirements for secure, reliable operation of systems with physical consequences. lnkd.in/p/gUht6sBd
#isa62443 #iec62443 #iacs #icscyber
The @FBI and our partners are seeing malicious cyber activity targeting industrial refrigeration and cold-chain monitoring systems around the world. These systems help keep food, medicine, and other products at safe temperatures and are widely used across critical infrastructure sectors.View quoted post on X
Attackers are targeting electronic temperature and refrigeration controllers, particularly in grocery stores and cold storage facilities. In at least one recent incident, attackers targeted refrigeration components at three foreign blood service facilities.
While this attack was unsuccessful due to the proper alert mechanisms in place, security weaknesses in unpatched or internet-accessible controllers can allow attackers to change system settings, potentially causing inventory loss and equipment damage.
The FBI urges organizations using these systems to take the following steps:
โก๏ธ Take controllers off the public internet
โก๏ธ Put access behind a firewall
โก๏ธ Change default passwords
โก๏ธ Learn how vendors configure devices
โก๏ธ Set safe temperature limits
โก๏ธ Ensure alerts reach the right contacts
For technical details and more information on how to protect these systems, read our advisory: ic3.gov/CSA/2026/26110โฆ
Kim is awesome and if you can make her keynote - do it!
I'll be in London in December to do a keynote at Black Hat Europe with @nixonnixoff (pictured below) about her work tracking and unmasking members of The Com. Hope to see some of you at our fireside chat. Here's a profile I wrote about her recently: technologyreview.com/2026/02/16/113โฆView quoted post on X