# Security and Independence of Process Safety and Control Systems in the Petroleum Industry
## 6 Possible Dependencies and Negative Influences
### New Dependencies and Links  
Even in layered solutions that follow the Purdue model, there is a challenge when it comes to reducing the potential negative impacts of having connections between the different systems. This can relate, for example, to the possibility to exploit the connections to send unauthorized signals or links via the operator interface. It is very challenging to show that any abnormal event occurring in one system cannot adversely affect another. Some operate with a dedicated safety network that separates SIS from the other systems; however, even with such a topology, there will be connection points, such as to a common operator interface. Having a separate safety network helps reducing the load of traffic between devices and systems within this network but is not able to ensure that all safety-related information is protected from other systems due to the need to also communicate over other shared networks. Zones and conduits according to 62443 can provide protection against undesirable external influences; however, this does not guarantee full independence. Within a zone one has the same challenges as for today's solutions, and through conduits one can, in principle, have a negative impact by transferring the wrong value. As long as the value is within legal limits, it may have a negative impact. This is comparable to the fact that 4-20 mA is within the legal limit, but in any case, 16 mA can lead to SIS not receiving 8 mA, which should have resulted in a safe action. The independence that is achieved with segmenting networks is to ensure some possibility of control over the series of links that are established between the zones. However, the definition/delineation of a system becomes unclear when different functions are placed in different zones. According to DNV's RP-G108, different systems should be segmented into different zones, as long as they do not have functional or operational dependencies that require them to be in the same zone. This approach is challenged by the new solutions that have been outlined with more/many links across zones. Examples of this are 5G base stations that will be used across all layers of the Purdue model and future flattening of the automation pyramid where everyone can communicate with everyone as defined by the OPC UA. In the case of remote connectivity (or other cross-zone links), there is no longer a clear connection between the system and zone. It can be argued that a system spans several zones, as its functions are located in several different zones; however, this is not in line with the recommendation to have different systems in different zones. Newer technologies, such as edge devices and IIoT devices, face challenges if information is to be retrieved from devices that are part of the safety systems as long as they use a lossless protocol that must send either requests or receipts to the device. Here, it is also important to note that NOA, which defines how to retrieve information from OT to IT using data diodes, does not include safety systems. If you look at the IT/OT systems as a unit, there may be a good deal of common components, although this can, of course, vary between installations. If these are not critical today, one must focus on whether they can be and especially whether they can be used as attack points. Some examples of such are:  
* Firewalls and other network components. * Human-machine interfaces. * Configuration Tools. * Clock systems. * Field Equipment Management Systems. * 5G. * Domain controllers. * Backup Systems. * Hardware and software (hypervisor) for virtualization. * Active directories. * Authentication Systems. * Key management (applicable for all authentication/encryption schemes and for Zero Trust). It is difficult to say anything generic about the extent to which these are used by the OT systems, but if one is to assess attack points and dependencies, these must be included. To remove these possibilities for dependent errors, one should consider whether IT and OT should have their own functions.