Security PHA Review for Consequence-Based Cybersecurity
In December 2017, news was released that a prominent safety instrumented system (SIS) logic controller was attacked in the Middle East. The attacker was able to make changes to the logic running in the SIS, a component responsible for the safe shutdown of the process if event control is lost or when containment is compromised. The continued interest by bad actors to cause harm to critical infrastructure and industrial control systems is concerning, and it is the reason for this book.
Industry takes specific steps to minimize the likelihood of occurrence and the consequences of loss of control or containment events. However, over the past few decades, we have shifted much of our control systems entirely to microprocessor-based systems. The new control systems allow significant leaps in function over their analog counterparts. Unfortunately, this has also created greater risk from cyber attack.
The problem is amplified because we are replacing more and more mechanical safeguards with microprocessor-based devices and networking them so that we can configure them from the comfort of our offices or even our vendor or integrator’s offices.
The Security PHA Review (SPR) described in our book is easy to understand and easy to implement, either during or after a hazard and operability study (HAZOP). Once properly implemented, the processes that make you nervous will be safe from cybersecurity attacks even if the information technology (IT) and cybersecurity people make a mistake.