# Security and Independence of Process Safety and Control Systems in the Petroleum Industry
## 5 Measures to Resist Cyberattacks
### Communication for Functional Safety  
IEC 61508 states that when a safety function is dependent on communication, the communication system should be regarded as a component of the safety function. Functionally safe communication can then be achieved by one of two methods:  
* The entire communication channel (including the endpoints) is designed, developed, and validated according to the IEC 61508 and either IEC 61784-3 or EN 50159. * Parts of the communication channel are not designed, developed, or validated in accordance with IEC 61508, are endpoints only (transceiver). In this case, necessary measures for safe error handling of the communication system as a whole shall nevertheless be implemented in accordance with either IEC 61784-3 or EN 50159. Method I is called \"whitechanneling\" and requires the development of a dedicated communication system solely for secure communication. In most cases, this is very time-consuming and costly and is thus not widespread. Method II is called \"blackchanneling\" and involves adding safety features to the endpoints of the communication in order to avoid certification of the entire communication system. IEC 61784-3 for industrial communication networks defines principles for the transmission of safety-related messages between participants in a distributed fieldbus network in accordance with requirements for black channel in IEC 61508. IEC 61784-3 also describes one set of profiles for safe communication for a selection of fieldbus standards:  
* Profile 1: Functional safety with FOUNDATION Fieldbus. * Profile 2: Functional safety with Common Industrial Protocol (CIP). * Profile 3: Functional safety with PROFIBUS and PROFINET. * Profile 6: Functional safety with INTERBUS. * Profile 8: Functional safety with CC-Link. * Profile 12: Functional safety with EtherCAT. * Profile 13: Functional safety with Ethernet POWERLINK. * Profile 14: Functional safety with Enhanced Performance Architecture (EPA). Each of these profiles is specified under IEC 61784-3-x, e.g., IEC 61784-3-3 addresses functional safety for PROFIBUS and PROFINET--a profile called PROFISafe. The secure communications profiles are based on the underlying protocols and are transmitted on the same network/cable as other messages. However, the utility message is extended with the following information:  
* A safety code that should be able to detect accidental errors of a random and systematic nature in messages. * Unique sender and recipient identification for the message. * Sequence number of the message. * When the next message should arrive at the recipient. Although the profiles in IEC 61784-3 address various communication channel error modes, the standard is somewhat inadequate when it comes to information security coverage. Reference is made to IEC 61784-4 for fieldbus-related security and to IEC 62443 for general security, but without any further explanation or requirements regarding how it should be implemented. Unfortunately, it is not difficult for unauthorized persons to manipulate messages without it being detected by the mechanisms of these profiles; this can affect safety. Neither is there any protection against other traffic being adversely affected. The only thing these profiles ensure is that the recipient goes to a predefined safe state if any error is detected on the transfer. In the context of closer integration between process control and safety systems and the fact that several different industrial ICT systems and IIoT solutions are connected to technical networks, existing security systems should be required to be certified in accordance with the regulations. IEC 61784-3 has sufficient mechanisms for information security. Protection against unauthorized access can then be done in two ways:  
* Encryption of the contents of messages sent to and from components being part of the same safety function. * Location of the entire SIS within a separate zone as defined in IEC 62443.