Skip to content
OT AssociatesPURE PLAY OT SECURITY
← The OT Field Guide
09

No cyber event may defeat a safety function

Secure safety instrumented systems as their own highest-consequence zone, converging IEC 61511 functional safety with IEC 62443 security.

5 min readInteractive figureIEC 61511-1ISA/IEC 62443-3-2
Interactive figure
Layers of protection, and the path a cyber event could take
PLANT & COMMUNITY EMERGENCY RESPONSERELIEF & PHYSICAL PROTECTIONSAFETY INSTRUMENTED SYSTEMALARMS & OPERATOR RESPONSEBASIC PROCESS CONTROLPROCESSCompromised EWS

The safety system shares the control network and the engineering workstation. A compromise of the control layer can reach the SIS, disable a trip or spoof a reading. The independent layer is no longer independent.

  • • IEC 61511 requires a security risk assessment of the SIS.
  • • IEC 62443 provides the zones, conduits and security levels to do it.
  • • Target: no cyber event can defeat a safety function.

Trace the layers of protection and see where a cyber path could reach the SIS.

Layers of protection

Process plants rely on independent layers of protection: the basic process control system, alarms and operator response, the safety instrumented system, then physical protections such as relief valves. The SIS must act independently when the process goes outside safe limits.

If a cyber event can disable or spoof the SIS, or use the same engineering workstation and network as the control system, that independence is gone.

Converging safety and security

IEC 61511 requires a security risk assessment for safety instrumented systems. We perform it with IEC 62443 methods: the SIS is placed in its own zone with the strictest conduits, engineering access is controlled and logged, and the safety function is designed so that no cyber event can defeat it.

Takeaways
  1. 01Keep the SIS independent in network, identity and engineering access.
  2. 02Perform the IEC 61511 security risk assessment with 62443 methods.
  3. 03Treat SIS engineering changes as the highest-consequence changes on site.