The manipulation of the application program on the logic system, which can violate the integrity of an SIS, represents the greatest risk. Unlike with “simple” OT components, this can potentially have the most severe consequences for the security of people, the environment, and technical installations. On worksheet NA 163 from the international User Association of Automation Technology in Process Industries (NAMUR), the following three categories are defined in this respect:

• Category 1 includes manipulations that trigger a safety function (SIF) without a corresponding need. The consequences are not dangerous in terms of functional security because the SIS will enter its safe mode, but this will lead to an operational interruption. The causes can include malware or human error.
• Category 2 describes cases in which the security function is disabled, which means protection is no longer available. An unacceptable event then only occurs when the need for the security function arises. The consequences are classified as dangerous because the SIS cannot fulfil its primary task. The related attack scenarios are classified as complex because manipulation of the logic system alone is not sufficient to cause damage.
• The third category deals with the gravest scenario, where one or more security functions are disabled and a situation requiring action is caused intentionally. This is another case in which the effects are classified as dangerous and the attack scenarios as very complex. This is because in order to be able to cause a situation in which the security function(s) are needed, the attackers must have sound knowledge of both the physical processes at hand and ways to manipulate the SIS.

In December 2017, the first reports were published on malware that had deliberately manipulated SIS. The perpetrators had gained entry via an engineering station where special software for programming and parameterisation was located. From there, the malware installed searched specifically for connected logic systems from a certain manufacturer and loaded executable code onto them, which manipulated the application program (the logic). The validity check failed due to an error in this code. The security function was then triggered and the attacked system was put into safe mode. Although the attack was not successful, its impact and complexity could have been classified as Category 2 or 3.

• BSI -

  Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)