Security PHA Review for Consequence-Based Cybersecurity

Foreword ix
Preface xi
About the Authors xiii

Chapter 1 Introduction 1
Brief History of Cyberattacks on ICSs 3
Security Level 5
Zones and Conduits 6
Risk Analysis Methods for Cybersecurity 7
The Security PHA Review Study 9
Benefits of the SPR Study 11
Objectives of this Book 12
Summary 14
Exercises 15
Bibliography 16

Chapter 2 Overview of the ISA/IEC 62443 Series 19
Structure of the ISA/IEC 62443 Series 19
The ISA/IEC 62443 Series Life Cycle and Requirements 21
Requirements for Risk Analysis 23
Summary 23
Exercises 24
Bibliography 24

Chapter 3 Limitations of Cybersecurity Risk Analysis Methods 25
The ISA/IEC 62443 Series Requirements for Risk Assessment 26
Risk Assessment Methods Promulgated by the Cybersecurity Community 28
Cyber PHA/Cyber HAZOP 29
CHAZOP 31
Inherent Problems with Existing Cyber Risk Analysis 31
Lack of Initiating Event 32
Infinite Potential Outcomes 33
Inherent Safety Against Cyberattack Is Not Considered 33
Frequency of Deliberate Attack 34
Summary 34
Exercises 35
Bibliography 37

Chapter 4 Process Hazard Analysis Overview 39
Common PHA Methods 41
Hazards and Operability Studies 43
Process Safety Information 45
Node Definition 45
HAZOP Team 46
Deviation Development 47
Building the Scenario 48
Summary 52
Exercises 53
Bibliography 55

Chapter 5 The SPR Study Process 57
Documenting a SPR 59
The Highlighter Method 59
The SPR Report Document 65
Leveraging PHA Documentation Software 65
Advanced Methods 66
Summary 67
Exercises 67
Bibliography 69

Chapter 6 Non-Hackable Safeguards 71
Pressure Relief Devices 71
Direct-Operated Relief Valve 72
Rupture Discs 72
Buckling Pins 73
Mechanical Overspeed Trips 74Check Valves 74
Non-Return Check Valves 75
Excess Flow Check Valves 76
Motor-Monitoring Devices 76
Motor Overload Relays 77Motor-Current Monitor Relay 77
Instrument-Loop Current Monitor Relay 77Summary 79
Exercises 79
Bibliography 81

Chapter 7 Security PHA Review Examples 83
Vessel Overpressure 84
Thermal Runaway Reaction 86
Pump-Blocked Discharge 92
Tank Reactor Runaway Reaction 94
Summary 98
Exercises 98
Bibliography 99

Chapter 8 Conclusions 101

Appendix A: Acronyms 105
Appendix B: Definitions 109
Appendix C: Sample Risk Tolerance Criteria 111
Appendix D: ISA/IEC 62443 Security Levels 117
Appendix E: Exercise Solutions 139

Index 147