Using Fmeda to Evaluate Cybersecurity Capability

Increasingly, companies are becoming aware of the need to address their cybersecurity capability, especially now that it is recognized it can be a significant contribution to process safety risk. Unfortunately, although there is plenty of recognized and generally accepted engineering practices (RAGAGEP) that address the topic, there is precious little in the way of practical guidance as to how much risk reduction is afforded given an understanding of the industrial automation and control system (IACS) design and existing countermeasures as well as the robustness of individual devices to withstand various cybersecurity threats. This paper presents a method that is well known to the evaluation of equipment due to random hardware failures and adapts the procedure to the evaluation of both the overall system as well as to specific devices. Examples are provided to help better understand the work process.