Toward Applying the IEC 62443 in the UAS for Secure Civil Applications

Abstract

The growing demand for drones in civil applications is usually satisfied with commercial off-the-shelf devices. These can always be adapted to meet the final user’s needs, but they could not satisfy critical aspects such as performance, efficiency, or security. Cybersecurity is one of the critical issues in Unmanned Aircraft Systems (UAS), where cyberattacks on this system could lead to multiple negative consequences. We address the cybersecurity issue in this work by introducing a set of strategic actions to define a complete development process of building secure Unmanned Aerial Vehicle (UAV) applications. We introduce the first steps toward implementing IEC 62443 security standard in UAS. We create comprehensive threats, components and critical assets catalogues for UAVs. Then, we employ the ThreatGet tool to automatically identify and determine relevant threats and estimate risk severities associated with a UAS case study. ThreatGet’s findings are then used to outline a mapping procedure between threats and security requirements. This strategy aims to identify a set of security requirements to address potential threats and protect critical assets in UAS.