Process safety and cyber security are distinctly different disciplines, but there is growing realisation that they are related.
Specifically, today’s industrial organisations face the common imperative of determining the appropriate response for each combination of desired security and safety for various parts of their industrial control systems.
International standards committees such as ISA84 and ISA99 are collaborating to develop information in this area that will appear in their respective standards (ISA84 and ISA-62443). In the meantime, preliminary guidance is available, as well as opportunities for stakeholders to help shape this discussion.
Current situation
Safe and reliable operation is an imperative for industrial processes. Operations personnel often refer to safety as “priority one, two and three.” As a result, process safety has become an established discipline in industry. Standards and practices available as the ISA84 and IEC 61511 series’ provide requirements for specifying, designing, installing, operating, and maintaining a safety instrumented system (SIS). These provide a high degree of confidence that the SIS can maintain or place a process in a safe state. Certification is also available for safety-related systems.
Clearly, cyber security is also essential for safe industrial operations. Most industrial facilities employ a variety of IT-based products within systems designed to control and protect dangerous processes and equipment. It is essential to protect these systems from cyber security related threats that could potentially impact the operations and information security of an industrial facility. The ISA/IEC 62443 series of standards and practices defines requirements and procedures for implementing electronically secure manufacturing and control systems and security practices and assessing electronic security performance. Several cyber security-related compliance specifications are also available.
Inadequate security can compromise safety
As these standards are applied, there is a growing acceptance of the fact that a cyber security-related compromise in the operation of industrial control systems can undermine the basic assumptions used in the design of safety systems and procedures for operation and maintenance. This distinguishes industrial cyber security deliberations from those used for IT programs, which focus on confidentiality and privacy.
Complementary but distinct perspectives
The process safety and cyber security disciplines each have specific perspectives on the challenges associated with the design of industrial control and safety systems.
Industrial control systems are designed for safe operation. Designers perform extensive hazard analyses and safety systems are deployed to limit the impact of operator errors, device failures, and control malfunctions.
The cyber security perspective includes consideration and analysis of new, non-deterministic challenges associated with the information and communications technologies that are at the heart of modern control systems. Protecting IT-based control and safety equipment generally requires special products and compensatory controls. Training automation personnel to use and maintain this new technology is another hurdle that must be overcome.
While distinct, these perspectives are complementary in that they both focus on achieving safe and reliable operations. This 'shared vision' forms the basis for collaboration between these disciplines.
A coordinated response
The recognition and understanding of this shared vision has led to increased collaboration and coordination between these disciplines.
This collaboration takes many forms. Several companies that were previously focused on process safety related services have expanded their offerings to include a parallel set of cyber security services. The committees responsible for the ISA84 (process safety) and ISA/IEC-62443 (cyber security) standards have aligned working groups addressing the overlap between security and safety. In the International Electrotechnical Commission (IEC), an ad hoc group is currently investigating options for addressing this subject.
These and other efforts have identified specific areas where safety and security are related.
Risk assessment and response
Whether addressing safety or security, it is first necessary to identify the specific risks as well as the approaches for their mitigation.
Process safety experts have extensive experience using methods such as process hazard analysis (PHA) and layers of protection analysis (LOPA) when designing safety-related systems. Designing secure systems also requires an analysis of hazard, followed by the application of defence-in-depth and system segmentation, similar in concept to LOPA.
Each of the above processes is applied within the context of a relevant life cycle for the system under consideration. Recent work by the ISA84 and ISA99 committees has resulted in the development of a common version of this life cycle that can be used for both safety and security-related analysis. A technical report on this topic is currently available from the ISA84 committee, which will form part of the description of life cycle as a fundamental concept at the foundation of the ISA/IEC-62443 standards.
Safety integrity and security levels
Another area of similarity between the safety and cyber security-related disciplines is the use of levels to identify the degree of response required in a specific situation. The safety integrity level (SIL) concept is well established and described in the ISA84 and IEC 61511 standards.
The concept of security levels is fundamental to applying the ISA/IEC 62443 standards for cyber security. However, because of the lack of determinism in cyber security-related threats, these levels are more qualitative than those used for describing safety.
It is now possible to establish a formal relationship between safety and security levels and consider them together to determine the design and operations measures required. This is also an area of common focus between these two disciplines.
For more information contact Paul Miller, ARC Advisory Group, +1 781 471 1141, pmiller@arcweb.com, www.arcweb.com
© Technews Publishing (Pty) Ltd | All Rights Reserved
printer friendly version