[BOOK] Industrial Control System Security(1/2) - Fundamental Understanding from an IACS UR E26 and E27 Certification Perspective

📚 Book Review IACS UR E26 / E27 ICS / OT Security Maritime OT

[BOOK] Industrial Control System Security (1/2)

Fundamental Understanding from an IACS UR E26 and E27 Certification Perspective

Lew
Maritime and Cyber Security Consultant / ISP Consultant
📅March 1, 2026
ook Information
Industrial Control System Security
Author: Pascal Ackerman · Published: 2019 · Korean Edition: Acon
Principal Industrial Cybersecurity Consultant @ Rockwell Automation (since 2015) · 15+ years in large-scale industrial systems & network security

From the perspective of a maritime cyber security practitioner engaged in the complex task of achieving IACS UR E26 and E27 certification, this book provides valuable foundational knowledge of industrial OT security and practical exposure to applicable tools and methodologies. This summary aims to extract and reinterpret the core contents of the book in a way that directly supports the understanding and execution of UR E26 and E27 certification tasks.

Chapter 1
The Nature of Industrial Control Systems (ICS/OT) and the Security Paradigm

1.1 Fundamental Characteristics of ICS/OT Environments

ICS/OT security fundamentally differs from traditional IT security because it involves direct physical consequences. Through multiple real-world examples, the book emphasizes that cyber incidents in ICS environments do not merely result in data breaches; they can directly cause process shutdowns, equipment damage, and safety hazards.

Availability as the Highest Priority

The book highlights that "even minor delays or jitter can result in irreversible process failures." ICS environments tolerate extremely low levels of latency and communication interruption.

Directly impacts UR E26 test items such as Deterministic Output and Communication Integrity.
All security controls — including firewalls, IDS, and proxies — must be designed within a latency-minimized architecture.
Real-Time Operation

PLCs and DCS controllers operate with scan cycles measured in milliseconds. If security appliances interfere with this cycle, control errors and process instability may occur. The book explains that when network or security devices are introduced, the added latency can directly affect the operational process.

Underscores the importance of validating that cyber security controls do not compromise deterministic system behavior under UR E26/E27.
The Tension Between Safety and Security

The book presents an HMI authentication example: if an operator must enter a complex 16-character password during an Emergency Stop (E-Stop) scenario, the authentication mechanism itself may become a safety risk. Therefore, OT authentication policies must follow a different hierarchy of priorities:

Safety > Operational Continuity > Security
In UR E26/E27 certification, human user authentication mechanisms must be implemented in a way that does not introduce operational delay or safety degradation.
Long-Life Operation

While typical IT systems operate on 3–5 year lifecycles, ICS systems often remain in service for 10–20 years, with a high proportion of legacy components. The book describes environments where outdated Windows systems and legacy services remain operational due to process constraints.

Directly explains the importance of the Secure Development Lifecycle Maintenance & Verification Plan required under UR E26 documentation. Long-term sustainability, not just initial compliance, is critical.

1.2 Core Components of ICS

OT network architectures consist of diverse and highly interdependent components. Understanding the functional role of each component is essential when defining the Cybersecurity Boundary and preparing UR E27 documentation.

Controllers (PLC, DCS)
Execute control logic; often the ultimate target of OT-focused attacks
HMI
The operational interface through which processes are monitored and controlled
Engineering Workstation (EWS)
Used for logic download, SCADA configuration, and system modification
Historian / ICS Server
Data aggregation and ETL functions; frequently located in the IDMZ boundary zone
ICS Network Infrastructure
L2/L3 switching, VLAN, IDMZ segmentation

1.3 Fundamental OT Security Principles

The following principles permeate all UR E26/E27 testing and documentation activities.

Minimum Change Principle

Due to the risk of process interruption, changes to ICS environments must be minimized. This principle directly influences patch management, configuration updates, and system modification planning within certification preparation.

Allow-List Security Model

Application control mechanisms are aligned with the allow-list model — execution must be explicitly permitted rather than implicitly trusted. This model directly supports UR E26 malicious code protection verification.

Linux AppArmor / SELinux Windows WDAC ICS Endpoint Application Control
Segment & Isolate

The IT – IDMZ – OT three-tier architecture remains the foundational security model for ICS environments. Network segmentation and isolation are not optional design features; they are structural requirements for ensuring Communication Integrity and boundary control in UR E26/E27.

IT Network
Corporate / Business
IDMZ
Boundary Zone
OT Network
Control / Safety
Deferred Patching with Risk-Based Application

Unlike IT environments, patches in ICS cannot always be applied immediately. The book highlights the necessity of structured patch management:

Offline WSUS relay layers
Pre-deployment testing
Scheduled maintenance windows
These elements correspond directly to UR E26 security functionality verification and maintenance planning requirements.

1.4 Direct Linkage to UR E26 and E27

The content of Chapter 1 directly aligns with foundational elements required under UR E26 and UR E27 certification.

OT Security Fundamental UR E26 Related Test Item UR E27 Documentation Element
IDMZ / Segmentation Communication Integrity Topology Diagram
Host Hardening Malicious Code Protection Security Configuration Guideline
Authentication Human User ID & Authentication Account / Identifier / Authenticator Management
Patch Relay Architecture Security Functionality Verification Maintenance & Verification Plan
Logging / SIEM Auditable Events Incident Response Support Information
📌
Coming Next
[BOOK] Industrial Control System Security (2/2)
Chapters 2–5: Network Architecture, Threat Modeling, Tools & Methodologies for UR E26/E27 Certification
#ICSsecurity #OTsecurity #CyberResilience #IACS #URE26 #URE27 #MaritimeCyberSecurity #IDMZ #Maritime40
Captain Ethan
Maritime 4.0 · AI, Data & Cyber Security

Maritime professional focused on the intersection of vessel operations, classification society regulations, and OT/IT cybersecurity. Writing for engineers, consultants, and operators navigating Maritime 4.0 together.

🌐 More Articles ↗

Comments