Safety
Safety Instrumented System (SIS)
An independent protection layer that takes the process to a safe state when defined conditions are exceeded.
What it does
Monitors safety-critical variables and executes trip logic independently of the basic process control system.
Typically locatedProcess plants with hazardous operations; separate cabinets and often separate networks.
At a glance
Why should I care?
Safety Instrumented System sits at Level 1 (safety). Compromise here is not just a data problem — it changes what the physical process does or what operators can see and control.
Common security problems
- Integration with the control system reducing true independence
- Programming keyswitches left in an unlocked position
- Safety engineering workstations sharing the general IT environment
If it is compromised
- Protection layer defeated while the process appears normal
- Potential for physical harm — highest-consequence scenario in OT
What to monitor
- Any safety logic change
- Keyswitch / mode position
- Communication between the BPCS and SIS
- Bypass and override records
How to defend it
- Maintain separation and independence per the safety design
- Alarm on every safety program change and mode change
- Dedicated, tightly controlled safety engineering tooling
- Formal management-of-change for any safety modification
Hunting
Hunt ideas for this component
Expert
Safety System Communication Anomalies
Detect any unexpected communication, configuration change or state change involving safety systems.
Intermediate
Unauthorized PLC Programming
Identify programming or configuration operations against controllers that were not performed by an authorised engineer in an approved change window.
Related