The Death of Castle-and-Moat Security: Why Zero Trust Is the New Currency of Cybersecurity
Your firewall is no longer enough. Learn why Zero Trust's "never trust, always verify" is becoming the legal and technical standard under NIS2 and DORA.
Cybersecurity
ISA/IEC 62443: 6 Surprising Truths About Industrial Cybersecurity You Need to Know
Industry 4.0 has ended the era of isolated factories. Learn how IEC 62443 upends traditional thinking about protecting critical infrastructure.
When we picture a factory, a power plant or a wastewater treatment facility, we often imagine an isolated physical fortress guarded by walls and security staff. For decades, that isolation, known as "security by obscurity," was the main way industrial control systems were defended. In that world, digital threats seemed remote and unimportant.
That picture is now a thing of the past. Industry 4.0 has brought operational technology (OT) and information technology (IT) together on a scale never seen before. The need for real-time data analytics has done away with the old isolation, and the attack surface of critical industrial processes has grown dramatically as a result. The traditional IT approach focuses on protecting data, and it falls short in a world where a digital error can cause a physical disaster.
The ISA/IEC 62443 standard was created to meet these challenges. It is the only global standard dedicated to the security of Industrial Automation and Control Systems (IACS). Here are six takeaways from the standard that change the rules of the game.
Priority #1: Not data, but the physical safety of people and the environment
In the OT world, the most valuable asset isn't a database. It's keeping physical processes under control. IEC 62443 forces a radical shift in perspective: the main goal is not to prevent email leaks but to avoid explosions, poisonings and downtime. The usual hierarchy is turned upside down. System availability and integrity matter most, and above all, safety.
The contrast with the corporate world is striking. In IT, a "leak" is a reputational and legal problem. In industry, an "incident" can mean a contaminated river or a real threat to human life. The standard is clear on this point: we use digital barriers to protect the physical world.
Security is a team sport, not one department's problem
One of the biggest mistakes is to assume that cybersecurity is solely "the IT guy's" job. IEC 62443 introduces the Shared Responsibility Model, which divides responsibilities among the Asset Owner, the Product Supplier and the System Integrator.
Why does this matter? Because security can't be "bought" and added at the end like the icing on the cake. It has to be built into every stage, from the design of a controller through its configuration to day-to-day operation. If any one of these links fails, the whole system is full of holes.
Instead of one wall, build a system of smart fences
In industry, traditional perimeter defense (a single strong firewall at the entrance) is asking for trouble. If an attacker gets past that wall, for example through an infected USB drive, they can move freely. The standard promotes a defense-in-depth architecture based on Zones and Conduits.
Think of it like the watertight compartments on a ship. Even if one compartment floods, the rest of the vessel stays dry. Dividing the network into zones keeps an attack from spreading across the entire plant, which drastically limits the potential damage.
Security levels are measured by the strength of your adversary, not your own
Instead of asking "Are we secure?", IEC 62443 asks "Who are we defending against?" It introduces Security Levels (SL), which are defined by the attacker's profile. They range from accidental employee error (SL 1) through professional cybercriminals (SL 3) to state-sponsored attacks (SL 4).
This approach is highly pragmatic because it lets companies optimize costs. Not every pumping station needs protection against military-grade hackers, but every one of them must be able to withstand an operator's mistake.
The best technology is useless without good habits
You can own the most expensive firewalls in the world, but if there are no processes for managing them, they're just costly decorations. Alongside the technical Security Levels (SL), the standard introduces Maturity Levels (ML).
"...the 62443 standard emphasizes system availability and integrity and, above all, the physical safety of people and the environment, recognizing that a cyber incident in the physical world can lead to catastrophic material consequences."
Cybersecurity isn't a product. It's a process. If you have great hardware but your update procedures are lacking (ML 1), your security will simply erode over time.
The clock is ticking: from best practice to legal obligation
This is no longer theory for enthusiasts. The standard is becoming a legal foundation in Poland and across the EU. Poland's National Cybersecurity System Act (KSC), the NIS2 Directive and the Cyber Resilience Act (CRA) all draw heavily on IEC 62443.
Ignoring these principles is no longer just an engineering risk. It has become a real business risk that can end in heavy fines or exclusion from the market.
Conclusion
ISA/IEC 62443 isn't a dull checklist. It's an integrated operating system for cyber resilience. Implementing it means moving from an illusion of security to deliberate risk management. In a world where code controls steel and fire, the key question isn't "Will hackers attack us?" but rather: Is your organization ready to make security part of its operational DNA?
Aleksander
Sources:
FAQ
How exactly does IEC 62443 differ from ISO 27001?
ISO 27001 is a general standard that focuses on information security (IT) and data protection. IEC 62443 is dedicated to industrial (OT) environments and puts the continuity of physical processes and the safety of people (safety) first.
Is implementing this standard mandatory for every company?
The legal obligation applies mainly to operators of essential services (the energy sector, water utilities, etc.) under Poland's National Cybersecurity System Act (KSC) and the NIS2 Directive. In practice, however, it is becoming a market standard, and business partners increasingly require IEC 62443 compliance from their suppliers.
What is a "zone" in an industrial network?
A zone is a logical group of devices with similar security requirements. When the network is divided into zones, an attack is "contained" in a small area and can't cripple the plant's entire infrastructure.
Is Security Level 4 (SL 4) always the best choice?
Not necessarily. SL 4 protects against the most advanced state-sponsored attacks, and that comes at a very high cost. The key is risk analysis: choose the SL that matches the real threats to each part of the system.
