OT Cybersecurity in the Chemical Industry: Where Cyber Security and Physical Safety Meet

When cyber risk becomes physical

In classic manufacturing, a cyberattack on OT can cause production downtime, machine damage and financial losses. In the chemical industry the potential consequences are of a different order: the release of toxic substances into the environment, explosions, fires, and harm to the people working in the plant and to the surrounding communities.

This difference radically changes the risk profile and the approach to security. It is not about protecting production, but about protecting the physical safety of people and the environment. In this context, cyber risk becomes a safety risk in every sense.

The concept of safety/security convergence in the chemical industry is not abstract: industrial control systems regulate pressures, temperatures, flow rates and levels, parameters that, if deliberately altered by an attacker, can lead to dangerous conditions that no manual operating procedure can handle quickly enough. The speed at which a control system can push a process beyond its safety limits is often greater than the speed of human reaction.

Safety Instrumented Systems: the last line of defense and the Triton case

Safety Instrumented Systems (SIS) are designed as the last layer of protection against dangerous operating conditions. When a process approaches critical parameters (excessive pressure, temperature beyond limits, the level of a flammable liquid too high), it is the SIS that activates the emergency measures: closing valves, activating vent systems, starting safe shutdown procedures.

SIS design follows specific standards (IEC 61511 for the process industry) and provides for physical and logical separation from the normal control systems (DCS, PLC). The principle is that even in the event of a fault or compromise of the main control system, the SIS remains functional and independent.

The year 2017 proved that this separation can be breached. The attack documented as Triton (or TRISIS) targeted the Triconex Safety Instrumented Systems made by Schneider Electric and installed in a petrochemical plant in Saudi Arabia. After gaining access to the OT network through IT, the attacker developed malware specifically designed to reprogram the Safety PLCs, with the goal of disabling the emergency protections and causing a physical incident.

The attack failed because of a bug in the malware code that triggered a safety shutdown of the SIS before the reprogramming was complete, thereby revealing the attacker's presence. Without that error, the consequences could have been catastrophic. The organizations that analyzed Triton concluded that the attacker was willing to accept human casualties as a consequence of the attack.

Triton's message for the chemical industry is unambiguous: Safety Instrumented Systems are not immune to cyberattacks. Their physical separation is necessary but not sufficient.

IEC 61511 and the cyber dimension of safety

IEC 61511, the standard that governs Safety Instrumented Systems in the process industry, incorporated explicit cybersecurity requirements in its 2016 revision (Edition 2). Clause 8.2.4 requires a cyber risk assessment to be carried out as part of the process hazard analysis, and the SIS to be included within the scope of that assessment.

In practice, this means that the safety analysis of the SIS can no longer stop at physical failure causes (failure modes, common cause failures, diagnostic coverage): it must also include the possibility of deliberate attacks that compromise the safety function. The Security Assessment of the SIS is now an integral part of the SIS lifecycle.

The operational implications are significant. The SIS configuration must be managed as a critical configuration, with physical and logical access controls, logging of every change, and verification procedures ensuring that no change alters the safety function. The communication networks toward the SIS must be treated as high-criticality networks, with strict segmentation and traffic monitoring.

A specific and often underestimated requirement: modern SIS, unlike their analog predecessors, are often based on programmable hardware with communication interfaces. These interfaces, necessary for monitoring and configuration, are also potential attack vectors. Managing this trade-off between functionality and security is one of the most delicate technical challenges in the sector.

Zones and conduits: applying IEC 62443 in the chemical plant

The security architecture recommended for chemical plants is based on the zones and conduits concepts defined by IEC 62443. A zone is a logical grouping of assets with similar security requirements, separated from other zones through appropriate controls. A conduit is the controlled communication channel between zones.

In the chemical plant, the typical zoning provides for distinct zones for: the Safety Instrumented Systems (the zone with the highest security requirements), the distributed control system (DCS), the supervision and historian systems, and the IT management network. Between each zone there are conduits with controls proportional to the security differential.

The practical challenge is that many Italian chemical plants, especially those with decades of operating history, were not designed with this architecture. They have flat OT networks, undocumented interconnections, and legacy systems that cannot be updated without halting production. Retroactively applying zoning principles requires a process of gradual analysis and restructuring.

The starting point, in any case, is visibility: knowing what is on the network, how the systems communicate with each other, and where the actual boundaries (not the documented ones) lie between the different functional zones. Without this visibility, any architectural restructuring project works on assumptions that may be wrong.

Passive monitoring: visibility without interfering with the processes

Security monitoring of OT in a chemical plant must respect a fundamental constraint: it cannot interfere with the control processes. In a plant where the safety loops have response times in the order of milliseconds, any tool that generates active traffic on the control network is unacceptable.

Passive monitoring, based on network taps and traffic analysis without packet injection, is the only approach compatible with the requirements of a chemical plant. A sensor placed on a SPAN port of the OT network switch can capture all the traffic, analyze it and detect anomalies without ever transmitting a single byte onto the production network.

This approach makes it possible to: identify all the active devices on the network (including undocumented ones), monitor the SIS communication patterns to detect anomalous access, detect changes to the configuration of the control systems, and correlate events across the different zones of the plant.

A specific aspect of monitoring in the chemical sector: the correlation between OT events and process parameters. A set point change on a PLC becomes more significant if it is correlated with the readings from the pressure and temperature sensors in the following hours. This correlation makes it possible to distinguish normal operational changes from those that drive the process toward anomalous conditions.

Incident response: when you cannot shut down

Incident response in a chemical plant must take into account a constraint that does not exist in IT: you cannot simply "switch off" a chemical system in production. A chemical reaction in progress cannot be stopped instantly without risk: there is a safe shutdown procedure that takes time, the correct sequence and active supervision.

This means that responding to a cyber incident in a chemical plant must take place in close coordination with the operations team, and must prioritize the safety of the physical process over the cyber response. If a control system is compromised but the process is stable, the correct sequence may be: stabilize the process, prepare a planned shutdown, then investigate and restore the systems.

Incident response playbooks for the chemical sector must be developed with the contribution of the process safety team, not just the cybersecurity team. They must define the decision thresholds: when an emergency shutdown is necessary despite the risks, when it is possible to continue monitoring while preparing a controlled shutdown, and how to maintain the safety functions during an incident response that involves the control systems.

Preparation is everything: a chemical plant that has never run an OT incident response exercise will not be able to coordinate the response effectively when the moment comes.

The MON5 angle

As the article notes, in a chemical plant passive monitoring is not a preference but a constraint: no tool can inject traffic onto networks where the safety loops respond in milliseconds. MON5 is designed around this principle: passive, out-of-band NDR that observes traffic toward DCS and Safety Instrumented Systems from a SPAN port or tap, without transmitting a single byte onto the control network.

The platform also supports IEC 62443 zoning: it maps the actual boundaries between zones, surfaces undocumented conduits and flags any anomalous communication toward the SIS controllers. For those starting from a flat network layered over decades, the journey begins with an OT assessment carried out without interrupting the process.

Analysis and commentary by MON5 based on public-domain research and data from the OT/ICS sector.