Hazardex 2018 when safety met security

| Document Number | March 23, 2016 |
© Yokogawa Electric Corporation
HazardEx 2018
When Safety met Security -
Combining the best of both
worlds
1
Rob Turner
Advanced Solutions Consultant
Yokogawa UK Ltd

When safety met security
2
1. Why do we need a tie between
safety and security for industrial
control systems?
2. What are the areas of common
ground between IEC 61511 and
IEC 62443?
3. How could we combine the two?

Yokogawa Europe
(The Netherlands) Yokogawa Corporation of America
(USA)
Yokogawa
Middle East & Africa
(Bahrain)
Yokogawa Electric International
Yokogawa Engineering Asia
(Singapore)
Yokogawa Electric CIS
(Russia)
Yokogawa America
do Sul (Brazil)
Yokogawa Electric Korea
(Korea)
World Headquarters
Yokogawa Electric Corporation
(Japan)Yokogawa China
(China)
A quick bit about Yokogawa
3
4,000 project engineers 2,000 service engineers
solution consultants
& software engineers 44,000 projects worldwide
19,000
employees
101 affiliates in
59 countries
$3.45B in sales /
$252M net income
1,200
As of January 2017
KBC
Advanced Technologies
Limited

4
control systems?
IEC 62443?

Technology considerations
5
What is different about a control system? (compared with an IT system)
Kinetic
energy!
Age of the
hardware and
software
The network
protocols in
use, eg
Modbus,
Ethernet/IP,
OPC
Access for
patching, AV
updates, etc
The use of
wireless
communications
for command &
control
These systems
are often
responsible for
control of a
physical
process

6
And what is different about a safety instrumented system (SIS)?
Engineered to be as reliable as possible in terms of
integrity and availability
Or to put it another way, “How do I know this system
will work when I need it to?”
(The answer is addressed by IEC 61511)
This is how it is designed to work, but what if somebody
has other intentions?

7
Abstract:
This paper demonstrates attack induced common-mode failures
on an industrial-grade (Xxxx) Triple-Modular-Redundant PLC
(programmable logic controller) and its impact in a Nuclear Power
Plant settings. The attack exploits the fact that during the
configuration phase the same control logic is downloaded to all
three redundant modules. We describe how an attacker can
exploit this vulnerability to embed malicious control logic and how
to trigger the attack. The feasibility and the attack impact are
evaluated on a testbed, which includes the Xxxx PLC as part of a
safety protection system in a simulated nuclear power plant.
For example, a recently published exploit…

Regulatory drivers
 OG-0086 “Cyber Security for Industrial Automation and Control
Systems (IACS)”
 Aimed at MAH sites both onshore and offshore
 Cites IEC 61511 as “Recognised Good Practice”
 Cites IEC 62443 under Other Relevant Standards
 To be used by EC&I Specialist Inspectors during interventions at
major hazard workplaces from 2018 onwards
 Will also apply retrospectively to existing systems
 Available at http://www.hse.gov.uk/foi/internalops/og/og-0086.pdf.
8
UK HSE guidance on industrial cyber security

Regulatory drivers
9
The NIS Directive
requires that
Member States
ensure designated
Operators of
Essential
Services:
Take “appropriate and proportionate technical and organisational measures to manage the
risks posed to the security of network and information systems in the provision of their
service”.
Take “appropriate measures to prevent and minimise the impact of the incidents affecting
the security of the network and information systems used in the provision of their service”.
Notify their relevant competent authority or CSIRT of incidents having a significant impact on
the continuity of the essential services they provide.
The high level
principles will be
set by the National
Cyber Security
Centre
These principles describe the mandatory security outcomes that all operators will be
required to achieve.
“Member States are required to lay down the rules on penalties applicable to infringements of this
Directive and must take all measures necessary to ensure that they are implemented. Any penalties
provided for in national legislation should be effective, proportionate and dissuasive”.
The Network and Information Systems Directive (NIS Directive)

10
control systems?
IEC 62443?

The standard for functional safety has changed
11
New section 8.2.4:
“A security risk assessment shall be carried out to identify the
security vulnerabilities of the SIS.”
New section 11.2.12:
“The design of the SIS shall be such that it provides the
necessary resilience against the identified security risks (see
8.2.4)”.
IEC 61511 “Functional safety - Safety instrumented systems for the
process industry sector” Edition 2, 2016

So there are two applicable standards?
12
IEC 61511-1:2016
“Safety Instrumented Systems for
the Process Industry Sector”
IEC 62443-1-1:2009
“Industrial Communication Networks –
Network and System Security”
Why IEC 61511? At first sight this might appear to be an additional burden
for the process industries and an intrusion into the jurisdiction of IEC 62443
which already covers the security of these systems.

Layers of Protection and IEC 61511
13

Cyber “Layers of Defence” and IEC 62443
14
Defence in Depth
• End point measures
• Physical measures
• Network measures
Detection in Depth
• Technology measures
• Organisational measures
“Response in Depth”
• Security policy
• Procedures (eg for backup / recovery)
• Disaster recovery planning
• Business continuity planning
• Etc.

Protective measures
15
Functional Safety Industrial Cyber Security
“Layers of protection” “Layers of defence”

Risk assessment
16
IEC 61511
SIL
Target SIL Achieved SIL
IEC 62443
SAL
Target SAL Achieved SAL
IEC 61511: SIL = Safety Integrity Level (0 – 4) Refers to the safety
function that includes the SIS
IEC 62443: SAL or SL = Security Assurance Level (0 – 4) Usually
refers to the zone under consideration (ZuC)
Both employ the concept of a risk matrix.
Functional Safety Industrial Cyber Security

Tolerable risk
17
Safety Security
Determined by society and /
or Regulators
(ALARP)
Determined by the business
(Regulators in the near future?)

18
control systems?
IEC 62443?

How could we combine the two?
19
It probably depends on where you start from –
functional safety or industrial cyber security?
Consider security aspects in safety risk assessments? This is
the IEC 61511 approach, and the approach taken by the UK’s
HSE.
Consider safety aspects in security risk assessments? This is
certainly applicable to security in the OT domain!
Is there value in carrying out a combined safety and security
improvement program?

20
Safety Security
1) Break the elephant up into bite-size chunks
2) Carry out a risk assessment on each chunk
3) Close the gap between achieved risk and
target risk for each chunk.

21
Safety Security
Object Under
Consideration
“Safety function”
“Zone under Consideration”

22
Safety Security
Qualitative Risk
Assessment
Risk matrix Risk matrix
Target
Achieved
SIL, EIL, CIL
Target – SLT or SALT
Achieved – SLA or SALA
Also covers the equivalent
of EIL, CIL
gap

23
Safety Security
Closing the gap
Risk Reduction Factors
Independent Protection
Layers (IPL)
Risk Reduction Factors
Independent Defence
Layers (IDL)

Summary
24
OT security and IT security are not the same
In the Process Control Domain there is a significant overlap between cyber
security and functional safety. They are two sides of the same coin
The regulatory framework in the UK and Europe is starting to catch up
• UK HSE’s Operational Guidance note
• European Union’s NIS Directive
There are similarities in the management frameworks for industrial cyber security
(IEC 62443) and functional safety in the process industries (IEC 61511)
Is there a case for combining the two when assessing and mitigating risk?

Some remaining questions
25
1) We have LOPA for functional safety, what does LODA (Layer of Defense
Analysis) look like?
2) How do we know when we have reached ALARP for security measures?
3) And will we see TÜV Certified Functional Security Engineers in the future?

Thank you!
26
Rob Turner BSc (Hons) CEng MIET GICSP
Advanced Solutions Consultant
Yokogawa UK Ltd
33 Abercrombie Court
Arnhall Business Park
Westhill, Aberdeen
AB32 6FE
t: +44 (0)7810 518224
e: rob.turner@uk.yokogawa.com
w: www.yokogawa.com/uk
Global Industrial Cyber
Security Professional
Analyst #1160
With thanks to the owners of all images used – all rights acknowledged

27

Hazardex 2018 when safety met security

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to Hazardex 2018 when safety met security

Similar to Hazardex 2018 when safety met security (20)

Recently uploaded

Recently uploaded (20)

Hazardex 2018 when safety met security