Security Feature Test for Ethernet Switches

Abstract: A new standard in network security for industrial control systems is about to be released by a number of working groups within the ISA99 organization. ABB has a certification program for network components that may be used together with the control system 800xA, which is named Industrial IT Certification. ABB now wants to introduce formal testing of network component’s security features according to this standard.The document IEC 62443-4-2 is the document within this standard that describes how the system requirements should be implemented on network components. This document is still a draft, so the document IEC 62443-3-3 which describes how the system requirements should be implemented on a whole industrial control system has been used to estimate the content of IEC 62443-4-2 when it is finished. Out of these two documents the requirements has been broken down into a test description which contains a number of tests to check which security features a switch has and that they work as described. Together with the test description, a test record template has been created to be used for documenting the result from the tests.Finally a comparison was made where the results from a number of different network equipment could be compared against each other regarding their security features. This comparison will in the future make it easier for ABB’s customers when they are in the process of buying new network equipment.In short the more expensive brands of switches have in general more security features implemented, and desktop switches has more security features implemented than industrial switches, with certain exceptions. The buyer needs to ask himself if he really needs all the security features. The choice of what switch to buy all depends on the placement of the switch and what purpose it should fulfill.