+IND.2.7 Safety Instrumented Systems
---+IND.2.7.G1. Manipulation of the Logic System
---+IND.2.7.G2. Inadequate Monitoring and Detection Procedures
---+IND.2.7.A1 Recording and Documentation [Planner, Maintenance Personnel] (B)
---+IND.2.7.A2 Specified Use of Hardware and Software Components [Maintenance Personnel] (B)
---+IND.2.7.A3 Changing the Application Program on the Logic System [Maintenance Personnel] (B)
---+IND.2.7.A4 Making Information Security an Integral Part of Functional Safety Management [ICS Information Security Officer] (S)
---+IND.2.7.A5 SIS Business Continuity Management [ICS Information Security Officer] (S)
---+IND.2.7.A6 Secure Planning and Specification of SIS [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
---+IND.2.7.A7 Separation and Independence of the SIS from the Environment [Planner, Maintenance Personnel] (S)
---+IND.2.7.A8 Secure Transfer of Engineering Data to SIS [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
---+IND.2.7.A9 Protection of Data and Signal Connections [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
---+IND.2.7.A10 Displays and Alerts Pertaining to Simulated or Bridged Variables [Planner] (S)
---+IND.2.7.A11 Dealing with Integrated Systems [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
---+IND.2.7.A12 Ensuring the Integrity and Authenticity of Application Programs and Configuration Data [Planner] (H)

IND.2.7 Safety Instrumented Systems

Introduction

Safety instrumented systems (SIS) are a subgroup of industrial control systems (ICS). SIS are used to avert threats to technical installations, the environment, and people. There is very little difference between the basic structure of an SIS and a conventional automation system. The main difference relates to the increased reliability requirements that apply to how the security functions (SIF) to be executed by an SIS are performed. The degree of reliability is expressed by the safety integrity level (SIL), the four different levels of which are defined in IEC 61508. SIL1 is the lowest reliability requirement, and SIL4 is the highest. Depending on the SIL level, different requirements apply to the permissible failure rate of components, the hardware fault tolerance of the architecture, the independence of auditors, and other security-relevant aspects. In organisational terms, the entire lifecycle of an SIS is embedded in a functional safety management (FSM) system.

This module must be implemented regardless of the SIL level of a given SIS. Information security must be taken into account in every lifecycle phase, from the development of components to their application, operation, and decommissioning. Ensuring the integrity of the SIS in question has the highest priority in this regard.

Another essential feature of an SIS is its independence and separation from surrounding IT systems and operational technology (OT). This means that the availability and integrity of the SIS must not be influenced by such systems and technology.

Objective

The objective of this module is to formulate appropriate SIS requirements that are to be met when establishing an information security management system (ISMS).

For the purposes of this module, the term “SIS” includes sensors, actuators, safety-related programmable logic controllers (PLC, also known as the logic system), application programs, and, in particular, the associated programming devices (such as engineering stations or hand-held devices for sensor-actuator configuration) and visualisation devices.

Scoping and Modelling

Module IND.2.7 Safety Instrumented Systems must be applied once to every SIS component in use.

This module supplements the generic modules IND.1 Process Control and Automation Technology and IND.2.1 General ICS Components and requires their prior implementation.

Useful Resources

In the “ICS Security Compendium”, the Federal Office for Information Security (BSI) provides assistance for manufacturers and integrators of ICS in terms of testing components and providing IT security safeguards in ICS.

The International Organization for Standardization (ISO) provides specifications for securing energy utilities in the standard ISO/IEC 27019, “Information Technology – Security Techniques – Information Security Controls for the Energy Utility Industry”.

The German Association of Energy and Water Industries (BDEW) and Oesterreichs E-Wirtschaft offer assistance on the secure operation of control and telecommunication systems in the white paper “Requirements for Secure Control and Telecommunication Systems”.

The following international standards provide further tools for setting up IT security in safety instrumented systems:

  • IEC 61508-1:2010, "Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems – Part 1: General Requirements", International Electrotechnical Commission (IEC)
  • IEC 61511-1:2016, “Functional Safety – Safety Instrumented Systems for the Process Industry Sector – Part 1: Framework, Definitions, System, Hardware and Application Programming Requirements”, International Electrotechnical Commission (IEC)
  • IEC 62443-2-1:2010, “Industrial Communication Networks – Network and System Security
  • Part 2-1: Establishing an Industrial Automation and Control System Security Program”, International Electrotechnical Commission (IEC)
  • IEC 62443-2-4:2015, “Security for Industrial Automation and Control Systems – Part 2-4: Security Program Requirements for IACS Service providers”, International Electrotechnical Commission (IEC)
  • IEC 62443-4-1:DRAFT: “Security for industrial automation and control systems - Technical security requirements for IACS components: Part 4-1: Secure product development life-cycle requirements”, International Electrotechnical Commission (IEC)
  • IEC 62443-4-2, “Security for Industrial Automation and Control Systems – Part 4-2: Technical Security Requirements for IACS Components”, International Electrotechnical Commission (IEC)

The international User Association of Automation Technology in Process Industries (NAMUR) has published the worksheet "Security Risk Assessment of SIS”.

The NIST Special Publication 800-81, "Guide to Industrial Control Systems (ICS) Security", describes how IT security can be achieved in ICS environments.

The VDI/VDE 2180 standard covers the safeguarding of industrial process plants using process control technology (PCT).

The VDI/VDE 2182 standard provides a general model and examples for information security in industrial control systems in the following sections:

  • Part 2.3, “IT Security for Industrial Automation – Example of Use of the General Model for Plant Managers in Factory Automation – Stamping Plant”
  • Part 3.3, "IT Security for Industrial Automation – Example of Use of the General Model for Operators of Process Automation Systems – LDPE Machine”

1. Übersicht

IND.2.7.A1 Recording and Documentation [Planner, Maintenance Personnel] (B)

All the hardware and software components, relevant information, connections, roles, and responsibilities pertaining to a given SIS MUST be recorded and documented separately.
IND.2.7.A2 Specified Use of Hardware and Software Components [Maintenance Personnel] (B)

The hardware and software components belonging to or used in connection with an SIS MUST NOT be used for any other purpose.
IND.2.7.A3 Changing the Application Program on the Logic System [Maintenance Personnel] (B)

Existing protection mechanisms on the logic system in question MUST be activated. If this is not possible, alternative measures MUST be taken. User programs on logic systems MUST ONLY be changed or released for transmission by authorised persons.
IND.2.7.A4 Making Information Security an Integral Part of Functional Safety Management [ICS Information Security Officer] (S)

All processes and responsibilities pertaining to the information security of SIS SHOULD be clearly defined. These should be described and named in the corresponding functional safety management system.
IND.2.7.A5 SIS Business Continuity Management [ICS Information Security Officer] (S)

The manner in which security incidents are to be handled SHOULD be defined in an incident response plan. This plan SHOULD define the roles and responsibilities and include the measures to be taken.
IND.2.7.A6 Secure Planning and Specification of SIS [Planner, Maintenance Personnel, ICS Information Security Officer] (S)

Accidental or unauthorised changes to specifications, implementations, and engineering data SHOULD be prevented.
IND.2.7.A7 Separation and Independence of the SIS from the Environment [Planner, Maintenance Personnel] (S)

The SIS in question SHOULD operate within its environment without adverse effects in order to guarantee its security functions. Processes that could impact the SIS SHOULD be subject to the change management process established for functional safety management.
IND.2.7.A8 Secure Transfer of Engineering Data to SIS [Planner, Maintenance Personnel, ICS Information Security Officer] (S)

The integrity of engineering data SHOULD be ensured during its transmission to SIS.
IND.2.7.A9 Protection of Data and Signal Connections [Planner, Maintenance Personnel, ICS Information Security Officer] (S)

If it cannot be proven that data and signal connections are not without adverse effects (unidirectionality), these connections SHOULD be suitably protected.
IND.2.7.A10 Displays and Alerts Pertaining to Simulated or Bridged Variables [Planner] (S)

SIS variables that are occupied (simulated) by substitute values or bridged externally SHOULD be monitored in an appropriate manner. The values SHOULD be displayed continuously to the user. Limit values SHOULD be defined. If these limit values are reached, a suitable alert SHOULD be sent to the persons in charge.
IND.2.7.A11 Dealing with Integrated Systems [Planner, Maintenance Personnel, ICS Information Security Officer] (S)

For integrated systems, a suitable strategy SHOULD be developed that regulates the handling of components that affect functional safety.
IND.2.7.A12 Ensuring the Integrity and Authenticity of Application Programs and Configuration Data [Planner] (H)

Care SHOULD be taken to ensure that manufacturers develop and integrate appropriate mechanisms to ensure the integrity and authenticity of configuration data and application programs on logic systems or associated sensors and actuators. Any software that is offered for download SHOULD be protected from manipulation. Integrity violations SHOULD be detected and reported automatically.

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
includes IND.2.7.G1. Manipulation of the Logic System
includes IND.2.7.G2. Inadequate Monitoring and Detection Procedures