OT-Knight's Barreto Jijón urges integrating ISA/IEC 61511 safety and 62443 cybersecurity lifecycles for ICS, citing TRITON/TRISIS
A post on ISASecure by Rafael Barreto Jijón, managing director of OT-Knight, argues that asset owners should merge functional safety and OT cybersecurity into a single lifecycle. He notes that safety instrumented systems (SIS) protect against process hazards but are also targets for cyber-physical attacks, citing the 2017 TRITON/TRISIS incident as a case that was both a cybersecurity and a safety event. This is guidance and commentary, not a new incident or vulnerability disclosure. It carries no direct threat to defenders but is relevant to ICS governance and risk management.
Technical Details
- ISA/IEC 61511-1:2016 requires a security risk assessment of the SIS, SIS design with resilience against identified security risks, and access security for bypasses, the maintenance/engineering interface and I/O forcing.
- ISA/IEC 62443-2-1:2024 requires protecting the safety system from interference by non-safety networks, operating the IACS as designed when disconnected from external networks, and changing safety-system configuration only in configuration mode.
- ISA/IEC 62443-3-2:2020 requires safety-related assets to be grouped into separate zones and the worst-case impact on personnel safety to be documented.
- ISA/IEC 62443-3-3:2013 requires zone boundaries to fail closed at SL 3 and 4 without interfering with SIS operation.
- Classical LOPA assumes protection layers are independent. A cyberattack breaks that assumption where the BPCS and SIS share an unsegregated network, because one compromise can defeat two layers and also create the demand while disabling the responding SIF. ISA-TR84.00.09 notes that attacks can produce hazards in an orchestrated sequence.
- Recommended practice includes cross-staffed HAZOP/LOPA and cyber risk workshops, adding cyber causes to HAZOP nodes, and reconciling the Cybersecurity Requirements Specification (CRS) with the Safety Requirements Specification (SRS).
Remediation
- Run one governance policy, one Statement of Applicability covering IT, OT and safety, and one combined internal audit and management review.
- Use one competence framework for security and safety teams.
- Route patches, firewall rules and configuration changes through a single MOC register, and re-verify affected SIFs before returning to service.
- Require a plant-floor work permit for intrusive cyber work on live systems and maintain one emergency playbook.
- Use shared assessment schedules and continuous evidence collection.
Linha do tempo
-
OT-Knight's Barreto Jijón urges integrating ISA/IEC 61511 safety and 62443 cybersecurity lifecycles for ICS, citing TRITON/TRISIS
ler a análise desta fonte ocultar
A post on ISASecure by Rafael Barreto Jijón, managing director of OT-Knight, argues that asset owners should merge functional safety and OT cybersecurity into a single lifecycle. He notes that safety instrumented systems (SIS) protect against process hazards but are also targets for cyber-physical attacks, citing the 2017 TRITON/TRISIS incident as a case that was both a cybersecurity and a safety event. This is guidance and commentary, not a new incident or vulnerability disclosure. It carries no direct threat to defenders but is relevant to ICS governance and risk management.
Technical Details
- ISA/IEC 61511-1:2016 requires a security risk assessment of the SIS, SIS design with resilience against identified security risks, and access security for bypasses, the maintenance/engineering interface and I/O forcing.
- ISA/IEC 62443-2-1:2024 requires protecting the safety system from interference by non-safety networks, operating the IACS as designed when disconnected from external networks, and changing safety-system configuration only in configuration mode.
- ISA/IEC 62443-3-2:2020 requires safety-related assets to be grouped into separate zones and the worst-case impact on personnel safety to be documented.
- ISA/IEC 62443-3-3:2013 requires zone boundaries to fail closed at SL 3 and 4 without interfering with SIS operation.
- Classical LOPA assumes protection layers are independent. A cyberattack breaks that assumption where the BPCS and SIS share an unsegregated network, because one compromise can defeat two layers and also create the demand while disabling the responding SIF. ISA-TR84.00.09 notes that attacks can produce hazards in an orchestrated sequence.
- Recommended practice includes cross-staffed HAZOP/LOPA and cyber risk workshops, adding cyber causes to HAZOP nodes, and reconciling the Cybersecurity Requirements Specification (CRS) with the Safety Requirements Specification (SRS).
Remediation
- Run one governance policy, one Statement of Applicability covering IT, OT and safety, and one combined internal audit and management review.
- Use one competence framework for security and safety teams.
- Route patches, firewall rules and configuration changes through a single MOC register, and re-verify affected SIFs before returning to service.
- Require a plant-floor work permit for intrusive cyber work on live systems and maintain one emergency playbook.
- Use shared assessment schedules and continuous evidence collection.