On 13 June 2018 the National Cyber Security Centre said it was working alongside Dixons Carphone to investigate one of the UK’s biggest data breaches at a single firm, which gave unauthorised access to 5.9 million customer’s cards.
Here, Nick Boughton, Digital Lead at cybersecurity specialist systems integrator, Boulting Technology explains how cybersecurity vulnerabilities can diminish physical safety.
Traditionally, physical safety in a plant was ensured manually, with redundancy systems in place in case of a fault. However, as entire systems have become electronic and software-based, safety and security must also be delivered digitally.
Machinery
Similarly, machine safety has historically been considered a standalone discipline, because it was entirely mechanical and hardwired. In the past 20 years, electronic control systems have overtaken mechanical methods because of ease of use, reduced maintenance and the abundance of data they can offer.
Despite the many benefits of electronic control systems, their use produces safety concerns. All systems are connected, and data collected from the machinery is transmitted via local networks over the Internet. If a flaw such as a bug is present in a single component, the entire plant can become vulnerable via the network.
The health and safety executive is now involved in the cybersecurity of Electrical, Control & Instrumentation (EC&I) systems. One form of system held by EC&I operators are Safety Instrumented Systems (SIS), which may range from simple logic systems to complex programmable safety programmable logic controller (PLC) type systems.
Cybersecurity is a vital part of a plant’s safety and total security is dependent on the protection of IACS.
Process safety
Many processes have dangerous steps. From working in hazardous environments to using potentially dangerous equipment such as pressure cookers or robots, safety procedures underpin each stage of every process.
Traditionally, safety features were physical, such as a stop button hardwired to cut power to machinery and requiring a manual reset. Many newer systems require software-based safety systems instead. The development of machine learning algorithms means software-based systems can employ machine learning and artificial intelligence to pre-empt potentially disastrous events.
The system can then automatically stop the dangerous process and notify an operator to take steps to limit the danger.
These systems have huge potential to reduce the risk of safety incidents in plants. However, it is important to remember they are only as safe as they are cybersecure — and any disruption to safety checks could lead to a serious incident.
Let’s take the simple example of cooking soup in a pressurised container. This could be remotely attacked in two ways.
The first type of attack is a reduction, removal or simplification of the safety processes before the lid is released. This could lead to the pressure not being released before the lid is removed, causing a violent steam explosion.
The second attack is on ingredient control. Recipes are usually stored electronically, and ingredients are automatically added at the right point. By adding too much of an ingredient such as salt, the entire batch would become unusable, or an attack could add unlabelled allergens.
Data safety
Many people still mistakenly believe that an attacker needs to gain physical access to an industrial control system to tamper with it. But as operational technology (OT) and information technology (IT) converge, vulnerability in an IT system could provide easy access to OT control systems, and vice versa.
Not only could an attack put workers in danger by tampering with machine safety or altering a process, it could leave the company open to attacks on data.
Protecting all computer, control and electronic systems is essential to ensuring overall plant safety and must be prioritised. Bringing in an expert service such as the alliance between Boulting Technology and IT consultancy NETbuilder can protect all systems across a plant, leaving no stone unturned.
Industrial control systems have traditionally been a separate entity from IT systems and were therefore outside the remit of IT cybersecurity teams. However, as the worlds of OT and IT converge, this is a dangerous mentality and securing ICS is essential to avoid attacks on personal data, as in the Dixons Carphone attack, or even process or physical safety.