SCE Cyber Security

Cyber Security for OT systems

Earlier Industrial Automation Control Systems (IACS) used in process control were islanded from other systems and were inherently secure. Increased connectivity to business IT systems, commercial and enterprise networks that are in turn connected to internet, increased the visibility of IACS and hence the vulnerability for attacks. Exposure of new threats such as worms, viruses and hackers into the process control systems can lead to manipulation and malfunctioning of the control and safety systems which can result in asset damage, environmental consequences, financial losses, and even injury or loss of life. Connection of systems into the wider supply chain and also use of commercial off the shelf software and general purpose hardware which are recent developments in Operational technology systems, further increased connectivity which can expose vulnerable process control systems to external threats from the suppliers systems and introduce risks to other systems in the supply chain.

SCE’ cyber security and control system professionals are trained and experienced in assessing the cyber security protections levels for OT systems and can contribute in following activities in accordance with IEC 62443 standard:

Conduct Cyber-HAZOPs and security gap analysis for OT systems
Facilitate Cyber security risk assessments and assign Security Level targets as per IEC 62443
Assess security gaps in line with SL-A (Security level achieved) on the status of cyber security in accordance with Parts 3.2 and 3.3 of IEC 62443
Facilitate Cyber security vulnerability assessment (CSVA)

OT Control System HAZOP (C-HAZOP)

Control systems are likely to contain a number of “single points of failure” that can lead to multiple consequences, some of which may be severe. These can impose additional demand on safety systems such as SIS, and this source of demand may not have been taken into account when designing the safety systems. Control system faults may also cause the operator to receive incorrect information, affecting decision making, or even remove the operator's control over the plant entirely.

A Control Systems Hazard and Operability Study (CHAZOP) provides a means of systematically reviewing the design and operation of a control and safety system including the network, electrical supply, I/O, hardware, internal and external data and network connections, environmental factors and security to identify potential hazards and/or operability problems. It focuses on how a control or safety system may deviate from the design intent and draws on the expertise of the team members and their past experience with the design and/or operations of similar facilities.

SCE professionals are trained and experienced in the facilitation of CHAZOP and have executed CHAZOP studies for various process facilities in the petroleum and chemical sectors. Activities under control system studies include

Facilitation of CHAZOP

Electrical System HAZOP (E-HAZOP or SAFOP)

E-HAZOP targets studies on the electrical system aspects to assess potential hazards to personnel, malfunction of individual components and consequential effects. The E-HAZOP process is a systematic approach to review the safety and operability of the design of an electrical system. E-HAZOP study is composed of three main analyses as below:

SAFAN

Safety Analysis Assess, eliminate/ or minimise the potential hazards presented to personnel in the vicinity of Electrical Installations.

SYSOP

System Security and Operability Provide a critical review of both the Electrical System Design and the Plant to be installed. Assess any limitations and their effects on both Operability & Security of the overall system

OPTAN

Operator Task Analysis. Analyze tasks set for Operators, assess the information, facilities and instructions provided to undertake these tasks and recommend measures to avoid Operator error

SCE professionals are trained and experienced in the facilitation of E-HAZOP (SAFOP) studies for electrical systems