Safety Independence Must Survive a Cyber Compromise

Cyber compromise exposes hidden common dependencies

CISA has documented threat actors modifying PLC ladder logic after gaining access to internet-exposed industrial controllers. The lesson is not that every plant faces the same actor, but that control logic and engineering access are realistic cyber targets with direct physical consequences.

A Safety Instrumented System can be designed as functionally independent and still share supporting dependencies with the Basic Process Control System: engineering workstations, directory services, switches, remote-access paths, backup repositories or maintenance laptops.

During normal operation those shared services may look efficient. During a compromise they can become a common-mode path that affects both the system creating the hazardous condition and the layer expected to arrest it.

Independence is an evidence claim

NIST SP 800-82 emphasises architecture, segmentation and the unique reliability and safety constraints of OT. For high-consequence processes, the practical question is not whether a diagram shows two zones. It is whether the safety function can operate, be maintained and be recovered without trusting a compromised control domain.

That requires examining shared identity, time sources, engineering tools, network equipment, update mechanisms and remote access. Some dependencies may be acceptable, but they should be explicit and tested against the consequence of simultaneous loss.

Exercises should therefore include the hostile-state assumption: BPCS is compromised, operator visibility is degraded, and the SIS must still reach and hold a safe state without relying on the compromised path.