Process safety and cybersecurity are distinctly different disciplines, but there is growing realisation that they are related.
Specifically, today’s industrial organisations face the common imperative of determining the appropriate response for each combination of desired security and safety for various parts of their industrial control systems.
International standards committees such as ISA84 and ISA99 are collaborating to develop information in this area that will appear in their respective standards (ISA84 and ISA-62443). In the meantime, preliminary guidance is available, as well as opportunities for stakeholders to help shape this discussion.
Current situation
Safe and reliable operation is an imperative for industrial processes. Operations personnel often refer to safety as “priority one, two and three.” As a result, process safety has become an established discipline in industry. Standards and practices available as the ISA84 and IEC 61511 series’ provide requirements for specifying, designing, installing, operating, and maintaining a safety instrumented system (SIS). These provide a high degree of confidence that the SIS can maintain or place a process in a safe state. Certification is also available for safety-related systems.
Clearly, cybersecurity is also essential for safe industrial operations. Most industrial facilities employ a variety of IT-based products within systems designed to control and protect dangerous processes and equipment. It is essential to protect these systems from cybersecurity-related threats that could potentially impact the operations and information security of an industrial facility.
The ISA/IEC 62443 series of standards and practices defines requirements and procedures for implementing electronically secure manufacturing and control systems and security practices and assessing electronic security performance. Several cybersecurity-related compliance specifications are also available.
Inadequate security can compromise safety
As these standards are applied, there is a growing acceptance of the fact that a cybersecurity-related compromise in the operation of industrial control systems can undermine the basic assumptions used in the design of safety systems and procedures for operation and maintenance. This distinguishes industrial cybersecurity deliberations from those used for IT cybersecurity programs, which focus on confidentiality and privacy.
Complementary but distinct perspectives
The process safety and cybersecurity disciplines each have specific perspectives on the challenges associated with the design of industrial control and safety systems.
Industrial control systems are designed for safe operation. Designers perform extensive hazard analyses and safety systems are deployed to limit the impact of operator errors, device failures, and control malfunctions.
The cybersecurity perspective includes consideration and analysis of new, non-deterministic challenges associated with the information and communications technologies that are at the heart of modern control systems. Protecting IT-based control and safety equipment generally requires special products and compensatory controls. Training automation personnel to use and maintain this new technology is another hurdle that must be overcome.
While distinct, these perspectives are complementary in that they both focus on achieving safe and reliable operations. This “shared vision” forms the basis for collaboration between these disciplines.
A coordinated response
The recognition and understanding of this shared vision has led to increased collaboration and coordination between these disciplines.
This collaboration takes several forms. Several companies that were previously focused on process safety related services have expanded their offerings to include a parallel set of cybersecurity services.
The committees responsible for the ISA84 (process safety) and ISA/IEC-62443 (cybersecurity) standards have aligned working groups addressing the overlap between security and safety. In the International Electrotechnical Commission (IEC), an ad-hoc group is currently investigating options for addressing this subject. These and other efforts have identified specific areas where safety and security are related.
Risk assessment and response
Whether addressing safety or security, it is first necessary to identify the specific risks as well as the approaches for their mitigation. Process safety experts have extensive experience using methods such as process hazard analysis (PHA) and layers of protection analysis (LOPA) when designing safety-related systems. Designing secure systems also re-quires an analysis of hazard, followed by the application of defense-in-depth and system segmentation, similar in concept to LOPA.
Each of the above processes are applied within the context of a relevant life cycle for the system under consideration. Recent work by the ISA84 and ISA99 committees has resulted in the development of a common version of this life cycle that can be used for both safety- and security-related analysis. A technical report on this topic is currently available from the ISA84 committee, which will form part of the description of life cycle as a fundamental concept at the foundation of the ISA/IEC-62443 standards.
Safety integrity and security levels
Another area of similarity between the safety- and cybersecurity-related disciplines is the use of levels to identify the degree of response required in a specific situation. The safety integrity level (SIL) concept is well established and described in the ISA84 and IEC 61511 standards.
The concept of security levels is fundamental to applying the ISA/IEC 62443 standards for cybersecurity. However, because of the lack of determinism in cybersecurity-related threats, these levels are more qualitative than those used for describing safety.
It is now possible to establish a formal relationship between safety and security levels and consider them together to determine the design and operations measures required. This is also an area of common focus between these two disciplines.
About the author
Eric Cosman, a senior consultant at ARC Advisory Group, has over 35 years of experience in developing, delivering, managing, and supporting operations-related information technology solutions in the process industries.