Qualitative Analysis for Validating IEC 62443-4-2 Requirements in DevSecOps
Open accessAbstract
Validation of conformance to cybersecurity standards for industrial automation and control systems is an expensive and time consuming process which can delay the time to market. It is therefore crucial to introduce conformance validation stages into the continuous integration/continuous delivery pipeline of products. However, designing such conformance validation in an automated fashion is a highly non-trivial task that requires expert knowledge and depends upon available security tools, ease of integration into the DevOps pipeline, as well as support for IT and OT interfaces and protocols.This paper addresses the aforementioned problem focusing on the automated validation of ISA/IEC 62443-4-2 standard component requirements. We present an extensive qualitative analysis of the standard requirements and the current tooling landscape to perform validation. Our analysis demonstrates the coverage established by the currently available tools and sheds light on current gaps to achieve full automation and coverage. Furthermore, we showcase for every component requirement where in the CI/CD pipeline stage it is recommended to test it and the tools to do so.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The Development + Operations (DevOps) framework has become widely adopted for enabling rapid software delivery and fostering improved collaboration between development and operations teams.
“The Development + Operations (DevOps) framework has become widely adopted for enabling rapid software delivery and fostering improved collaboration between development and operations teams [10].”
From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [10]
The Introduction (page unavailable) says DevOps integrates development and operations teams, uses CI/CD to automate build and delivery, and is seeing more frequent use in IACS product development. This supports the collaboration and delivery aspects, but the paper does not establish that DevOps is widely adopted across software development generally. (LLM, conf=0.82)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
de Moura, L., & Bjørner, N. (2008) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-78800-3_24 · Cited by 6,595 · see citing works
AFLNET: A Greybox Fuzzer for Network Protocols
Pham, V.-T., Böhme, M., & Roychoudhury, A. (2020) · doi:10.1109/icst46399.2020.00062 · Cited by 346 · see citing works
AFL++ : Combining Incremental Steps of Fuzzing Research.
Fioraldi, A., Maier, D., Eißfeldt, H., & Heuse, M. (2020) · USENIX Security Symposium · Cited by 308 · see citing works
CUTE: A Concolic Unit Testing Engine for C
Sen, K., Marinov, D., & Agha, G. (2005) · doi:10.21236/ada482657 · Cited by 300 · see citing works
Superion: Grammar-Aware Greybox Fuzzing
Wang, J., Chen, B., Wei, L., & Liu, Y. (2019) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse.2019.00081 · Cited by 281 · see citing works
FIRM-AFL: High-Throughput Greybox Fuzzing of IoT Firmware via Augmented Process Emulation
Zheng, Y., Davanian, A., Yin, H., Song, C., Zhu, H., & Sun, L. (2019) · USENIX Security Symposium · Cited by 168 · see citing works
Applicability of the IEC 62443 standard in Industry 4.0 / IIoT
Leander, B., Čaušević, A., & Hansson, H. (2019) · Proceedings of the 14th International Conference on Availability, Reliability and Security · doi:10.1145/3339252.3341481 · Cited by 82 · see citing works
Faster Fuzzing: Reinitialization with Deep Neural ModelsPreprint
Nichols, N., Raugas, M., Jasper, R. J., et al. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.02807 · Cited by 46 · see citing works
How to Integrate Security Compliance Requirements with Agile Software Engineering at Scale?
Moyón, F., Méndez, D., Beckers, K., & Klepper, S. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-64148-1_5 · Cited by 28 · see citing works
A Comprehensive Framework for Security in Engineering Projects - Based on IEC 62443
Maidl, M., Kröselberg, D., Christ, J., et al. (2018) · IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) · doi:10.1109/issrew.2018.00-33 · Cited by 18 · see citing works
VeriDevOps: Automated Protection and Prevention to Meet Security Requirements in DevOps
Sadovykh, A., Widforss, G., Truşcan, D., Enoiu, E. P., Mallouli, W., Iglesias, R., Bagnato, A., & Hendel, O. (2021) · Design, Automation, and Test in Europe · doi:10.23919/date51398.2021.9474185 · Cited by 18 · see citing works
Integration of Security Standards in DevOps Pipelines: An Industry Case Study
Moyón, F., Soares, R., Pinto-Albuquerque, M., Mendez, D., & Beckers, K. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-64148-1_27 · Cited by 17 · see citing works
Advancing Protocol Fuzzing for Industrial Automation and Control Systems
Pfrang, S., Meier, D. L., Friedrich, M., et al. (2018) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0006755305700580 · Cited by 13 · see citing works
Towards a modular security testing framework for industrial automation and control systems: ISuTest
Pfrang, S., Meier, D. L., & Kautz, V. (2017) · IEEE International Conference on Emerging Technologies and Factory Automation (ETFA) · doi:10.1109/etfa.2017.8247727 · Cited by 9 · see citing works
Compliance verification of a cyber security standard for Cloud-connected SCADA
Kulik, T., Tran-Jørgensen, P. W. V., & Boudjadar, J. (2019) · doi:10.1109/giots.2019.8766363 · Cited by 8 · see citing works
Designing and Integrating IEC 62443 Compliant Threat Analysis
Fockel, M., Merschjohann, S., Fazal-Baqaie, M., et al. (2019) · Communications in computer and information science · doi:10.1007/978-3-030-28005-5_5 · Cited by 8 · see citing works
Secure and Flexible Deployment of Industrial Applications inside Cloud-Based Environments
Ehrlich, M., Trsek, H., Gergeleit, M., et al. (2019) · IEEE International Conference on Emerging Technologies and Factory Automation (ETFA) · doi:10.1109/etfa.2019.8868978 · Cited by 8 · see citing works
Strategy for Security Certification of High Assurance Industrial Automation and Control Systems
Schulz, T., Griest, C., Golatowski, F., et al. (2018) · IEEE International Symposium on Industrial Embedded Systems (SIES) · doi:10.1109/sies.2018.8442081 · Cited by 6 · see citing works
National Vulnerability Database
Byers, R., Turner, C., & Brewer, T. (2021) · National Institute of Standards and Technology (NIST) · doi:10.18434/m3436 · Cited by 5 · see citing works
Development and Evaluation of an Artefact Model to Support Security Compliance for DevSecOps
Bitra, P., & Achanta, C. S. (2021) · Diva portal (Dalarna University Library) · Cited by 2 · see citing works
Large scale agile software development compliant to IEC 62443-4-1: artefact design and tool support
Soares, R. M. (2019) · Repositório do ISCTE-IUL · Cited by 1 · see citing works
Flagged first, then by citations
Research works printed but not linked: 3
- --. (2021, Nov.) Tenable Makes the Power of Nessus v10.0 Portable with Raspberry Pi. https://www.tenable.com/press-releases/ tenable-makes-the-power-of-nessus-v10-0-portable-with-raspberry-pi. Accessed on 16.06.2023.
- PortSwigger Ltd. Download Burp Suite Community Edition. https: //portswigger.net/burp/communitydownload. Accessed on 16.06.2023.
- S. Poeplau and A. Francillon, "Symbolic execution with SymCC: Don't interpret, compile!" in 29th USENIX Security Symposium (USENIX Security 20). Boston, MA: USENIX Association, Aug. 2020, pp. 181-198. [Online]. Available: https://www.usenix.org/conference/ usenixsecurity20/presentation/poeplau
Cited by
Sorted by citations
Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review
Mohammed, K., Shanmugam, B., & El-Den, J. (2025) · Technologies · doi:10.3390/technologies13120548 · Cited by 8 · see citing works
- Authors
- Göttel, C., Kabir-Querrec, M., Kozhaya, D., Sivanthi, T., & Vuković, O.
- Affiliations
- ABB (Switzerland) (CH)
- Venue
- 2023 IEEE 28th International Conference on Emerging Technologies and Factory Automation (ETFA)
- Publisher
- IEEE
- Published
- 2023-09-12
- Pages
- 1-8
- OpenAlex
- W4387583648
- Cited by
- 7
- References
- 21
- Citations by year
- 2025: 4 · 2024: 3
- FWCI
- 1.80
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE International Conference on Emerging Technologies and Factory Automation (ETFA) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Engineering › Safety, Risk, Reliability and Quality › Safety Systems Engineering in Autonomy
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Keywords
- DevSecOps, industrial automation and control systems, cybersecurity standards, automated security testing, component requirements
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
