Operation technology (OT) cyber incidents from the past have demonstrated that attacks on industrial automation control systems (IACS) are no longer limited to data loss or operational downtime. These cyber incidents can have direct and consequential impacts on process safety. Events such as TRITON/TRISIS, the Colonial Pipeline ransomware incident, and disruptions to critical infrastructure worldwide highlight how cyber threats can propagate into unsafe process conditions, challenge operator decision-making, and degrade or disable critical protection layers.
This presentation examines several historical industrial cyber incidents through a process safety lens, focusing on how each event impacted core safety functions: loss of control, loss of view, and loss of protection. Some common patterns emerge of these historical industrial cyber event, including breakdowns in system segmentation, nonverified digital information, and the erosion of independence between protection layers.
Attendees will gain:
• A clear understanding of how cyber incidents translate into process safety risks
• Practical lessons learned from real-world events and their implications for safety-critical systems
• Insight into how traditional safety assumptions (e.g., independence of protection layers) can be invalidated by cyber compromise
• Ideas on how to use cybersecurity risk assessment information for safety risk assessments
Putting cyber risk processes to work for safety risk analysis, through all levels of the OT network and not just below Level 3.5, can ultimately benefit both areas of domain knowledge and create synergistic practices.