Traditionally, process safety and cyber security have been treated as separate disciplines – one focused on physical risks, the other on digital threats. However, as IT systems and operational technology (OT) become more interconnected, cyber security failures can now lead to real-world safety incidents. The convergence of IT and OT has created new vulnerabilities that many organisations are still struggling to address.
The growing risk: cyber attacks with physical consequences
Imagine a worst-case scenario: a hacker gains access to a Safety Instrumented System (SIS) and disables it, preventing operators from receiving critical alarms about an over pressurising vessel. With no protective action in place, an explosion occurs, causing loss of life, environmental damage, and severe financial repercussions.
This is not a hypothetical risk. Cyberattacks on industrial facilities have increased dramatically in recent years, with attackers deliberately targeting safety-critical systems. The days when cyber threats were limited to data breaches are long gone; today, they can directly compromise human safety.
Key Cyber Security challenges in OT and Process Safety
1️ Legacy Systems: built for reliability, not security
Many OT systems such as DCS (Distributed Control Systems), SCADA (Supervisory Control and Data Acquisition), and PLCs (Programmable Logic Controllers), were designed decades ago with reliability in mind but no built-in cyber security protections. These legacy systems were originally isolated from external networks, but today they are often connected to corporate IT environments, exposing them to cyber threats.
2️ Third-party and remote access risks
Industrial sites often rely on external vendors for remote monitoring, system maintenance, and software updates. While this improves operational efficiency, it also introduces a major cyber security weak point; if a third-party supplier has weak security, attackers can use them as an entry point into your systems.
🔹 Example: Attackers have previously exploited weak vendor security credentials to gain access to OT networks, sometimes remaining undetected for months.
3️ USB devices and air-gapped system threats
Even isolated (air-gapped) systems are vulnerable. One of the most common attack vectors in industrial environments is infected USB devices, a simple flash drive plugged into an engineering workstation can introduce malware capable of spreading across critical systems.
🔹 Example: The Stuxnet worm (discovered in 2010) targeted industrial control systems via infected USB devices, showing that even air-gapped environments are not immune to cyber threats.
Ask yourself: Do you strictly control and monitor portable device usage? Are your employees and contractors trained on the risks?
Case Study: The 2017 Triton Malware Attack. One of the most alarming cyber incidents in industrial history occurred in 2017 when the Triton malware (also known as Trisis) specifically targeted Safety Instrumented Systems (SIS) at a petrochemical plant.
🔹 The attackers attempted to disable the emergency shutdown system, which could have led to a catastrophic safety failure. Fortunately, a coding error in the malware caused the SIS to enter a fail-safe mode instead of being disabled, preventing a major disaster by pure luck.
This attack fundamentally changed how process industries view cyber security, demonstrating that cyber threats can now directly target life-saving safety controls.
It also raised an urgent question: Are cyber security risks integrated into your overall process safety strategy?
Why Cyber security must be part of Process Safety Management
Cyber risks on OT can cause fire, explosion, and toxic release hazards. If a cyber-attack could disable a safety system, cause a loss of containment, or trigger an uncontrolled process reaction, then it is a process safety threat.
✔ Is cyber risk included in your:
🔹 HAZOPs (Hazard and Operability Studies)?
🔹 Risk assessments and Layers of Protection Analysis (LOPA)?
🔹 COMAH (Control of Major Accident Hazards) safety reports?
Final Thought
The divide between process safety and cyber security is disappearing. In today’s industrial landscape, a robust safety culture must include cyber security awareness and resilience. Without this, facilities remain vulnerable to cyber-induced process failures, which could be just as catastrophic as any mechanical or human failure.
What’s your biggest cyber security concern in OT? How are you integrating cyber security into process safety?
OpenPSM has created a new Cyber Security module, aimed at helping companies understand where the critical gaps exist in protection and how and where to focus efforts to start to take positive action and mitigate risk. For more information, please get in touch by email to contactus@openpsm.uk or complete the form linked here.