IEC 62443 Compliance
with BlastShield

Human User Identification & Authentication
Identify and authenticate all human users before access

All human users must be uniquely identified and authenticated prior to access. At SL2+, MFA is required.

BlastShield Authenticator provides phishing-resistant passwordless MFA — biometric + QR challenge-response + device keystore. Every human user is cryptographically identified before establishing any tunnel. No passwords exist to steal.

Software Process and Device Identification & Authentication
Identify and authenticate software processes and devices

Automated processes and devices must be authenticated before they can access IACS components.

BlastShield Agents install on servers and endpoints, requiring device-level authentication before any connection is permitted. Non-authenticated devices are invisible and unreachable — they cannot initiate or receive IACS communications.

Authorization Enforcement
Enforce authorization on all access to IACS components based on least-privilege principles

Grant each user or process only the minimum access necessary. Deny access to everything else. Role-based and/or attribute-based access control.

The BlastShield Orchestrator enforces least-privilege access at the application and device level. Each user or role is explicitly mapped to the specific PLCs, HMIs, SCADA systems, or other IACS components they require. Attempting to reach anything outside that scope returns no response — the target is invisible to unauthorized requestors.

Remote Session Termination
Terminate remote sessions after inactivity or upon demand

Automatic session termination after configurable inactivity period. Ability to manually terminate active sessions.

BlastShield sessions respect configurable timeout and termination policies. Administrators can terminate any active session from the Orchestrator console immediately. BlastAccess session recording captures all activity up to the moment of termination for forensic completeness.

Communication Integrity
Protect the integrity of transmitted information

Ensure that data in transit between IACS components or between users and IACS components is protected from unauthorized modification.

All BlastShield tunnels use strong authenticated encryption. Point-to-point tunnels guarantee that data in transit cannot be intercepted or modified — even on the same flat Layer 2 network segment. This is particularly critical for legacy OT protocols that offer no native encryption.

Security Functionality Verification
Verify that security functions perform as intended

Provide mechanisms to verify that security controls are operating correctly. Generate audit records sufficient to verify security function behavior.

The BlastShield Orchestrator provides real-time visibility into access policy state, active sessions, authentication events, and access denials. All events are logged. Periodic policy reviews and access reports are available for compliance verification without relying on network packet capture.

Network Segmentation
Segment the IACS network from other networks using boundary protection devices

Implement zones with controlled conduits. Deny all inter-zone traffic not explicitly authorized. Protect against unauthorized access originating from external networks or adjacent zones.

BlastShield's software-defined segmentation creates cryptographic zone boundaries without hardware changes. Layer 2 and Layer 3 segmentation prevents lateral movement within and between zones. A compromised device in Zone A cannot probe, reach, or affect Zone B — even on the same physical network segment.

Zone Boundary Protection
Monitor and control communications at zone boundaries

Implement controls that monitor traffic crossing zone boundaries. Block disallowed communications. Provide alerting on anomalous boundary activity.

The BlastShield Security Gateway is the enforcement point for every zone boundary. It permits only authenticated, authorized tunnel connections. All other inbound traffic — scans, probes, unauthenticated protocol requests — is silently dropped. Every crossing attempt (permitted or denied) is logged.

Application Partitioning
Partition applications and services to limit the scope of a security incident

Separate safety-critical functions from non-critical functions. Ensure that compromise of one application cannot directly affect another.

BlastShield's microsegmentation enables application-level isolation. Each IACS function — safety controllers, historian, SCADA, engineering workstation — can be assigned to its own logical zone with independent access policies. A compromise of the historian cannot be leveraged to access the safety controller, even if they share a physical network.

Information Confidentiality
Protect the confidentiality of information at rest and in transit

Prevent unauthorized disclosure of IACS-related information during transmission and storage.

All BlastShield communications are encrypted end-to-end. There are no plaintext credentials, no unencrypted control traffic between zones, and no exposed management interfaces. Network Cloaking ensures that even asset existence is not disclosed to unauthorized parties.