Identifying and Managing Cybersecurity Risk As a Component of Process Safety Risk Management

A cybersecurity incident can dramatically impact the integrity of automated safeguards (e.g. alarms, SIFs, etc.) as modern control systems and safety instrumented systems are vulnerable to cyber threats. Frighteningly, it is feasible that a single cyber incident could simultaneously trigger an initiating event and disable safeguards. Yet traditionally process safety assessments (e.g. PHA, LOPA) do not factor cybersecurity into their calculations.

Regulators and standards bodies have recognized that this risk is not being adequately addressed and have added requirements mandating cyber risk assessments of control and safety systems. Examples include: CFATS, ISA 84 / IEC 61511, NIST Cybersecurity Framework, and API 1164.

The primary reason process safety assessments have not incorporated cybersecurity is because cybersecurity and process safety are distinctly different disciplines that are managed by different entities in the corporation. Cybersecurity is usually the domain of the IT organization while process safety is typically the domain of the Health, Safety and Environmental organization. While these disciplines will likely always remain separate, a practical solution is to align and integrate cybersecurity processes with existing process safety processes. Integration is important not only to avoid duplication of effort, but also to provide management with a holistic view of their operational risk that includes both cyber and traditional initiating events.

This presentation will discuss the process safety lifecycle and the cybersecurity lifecycle and the key touch points where these lifecycles must synchronize in order for the responsible teams to exchange data and provide a common and holistic view of risk to executive management. We will demonstrate how to use the results of a standard LOPA to quickly identify the scenarios that carry the highest cybersecurity risk. We will also present the ICS cybersecurity risk assessment process defined in ISA 62443, which many refer to as a cyber PHA or cyber HAZOP, and discuss how this process establishes a key linkage between process safety and cybersecurity.