Choices for SIS and BPCS architecture impact the life of the process and productivity of personnel
Editor’s Note: Faced with designing and implementing both a safety instrumented system (SIS) and a basic process control system (BPCS), project team leaders must assess their goals and choose how the two systems will form an architecture to securely deliver the process engineering, safety, and operation capabilities required.
Top of mind for these decision makers is how to create and maintain a defendable environment for each system that will also bring efficiencies to the overall project and allow the systems to operate effectively and sustain security for years to come.
This article series presents the three most common approaches to SIS and BPCS interaction for distributed control system applications. Also highlighted is one of the approaches, the integrated architecture, and how it enables benefits in safety, cybersecurity, process engineering and operations.
By Sergio Diaz and Alexandre Peixoto
Part 1
Implementing a well-designed architecture that includes a safety instrumented system (SIS) and a basic process control system (BPCS) sets the stage for a safe and secure automation process and environment. Industry cybersecurity standards weigh in with guidelines for the separation and connections between systems. Common for all the standards is that the systems must be logically independent no matter the degree to which they are physically linked.
International Society of Automation (ISA) guidelines require that, among other things, safety-critical assets be logically or physically zoned away from non-safety-critical assets. The guidelines from the User Association of Automation Technology in Process Industries (NAMUR) define three zones that likewise must be logically separated.
Working within these frameworks, teams can choose the appropriate architecture that meets their specific cybersecurity requirements to form a defendable safety system architecture. Because these decisions will affect the whole of the project engineering and facility lifecycle, teams should begin contemplating the architecture at the start of the project design phase and include their choice in the bid specification.
Keep in mind that although SIS/BPCS architecture selection impacts robustness of cybersecurity as well as the effort required to maintain it, the most important protections against cyber-threats are the inherent cybersecurity of the SIS itself and the practices surrounding system operation.
NAMUR defines three zones that must be logically separated.
Architectures to Suit Facility Requirements
Generally, the automation industry refers to three SIS/BPCS architectures: separate (or air-gapped), interfaced, and integrated but separate. Each has degrees of connection and security options.
Cybersecurity relies, in part, on multiple layers of protection surrounding each and both systems. In the following architecture diagrams, layers of protection are represented as colored circles around the systems. Layers of protection can include tactics such as user-account management, a comprehensive approach to prevent inadvertent malware infections, and embedded lock functionality in logic solvers among other tactics.
The separate (or air-gapped) architecture shows physical separation between the BPCS and the SIS. Colors indicate multiple independent protection layers (IPLs).
As the name indicates, a separate safety system is isolated from the BPCS and potentially from other systems. The SIS is not connected in any way — physically or over a wireless network — to the BPCS. This architecture offers no automated way for malware or data to move between systems. The SIS workstation is normally kept offline and/or disconnected from the network, often inside a locked cabinet. Some facilities use only an SIS without a BPCS.
This architecture is declining in use because it lacks efficient data exchange between the SIS and BPCS —which has become important to facilities that rely on continuous operations. Reliable facility operation and process performance also need updated equipment. In the separate architecture, however, those updates can be difficult because if the SIS equipment is kept offline, it must be updated or maintained each time it is connected, introducing delays, security risks, and inconvenience.
The Interfaced SIS architecture uses points of physical/network connections to share data with the BPCS.
In an interfaced architecture, information is transmitted between the SIS and the BPCS via standard industrial protocols, such as Modbus TCP, OPC Data Access (OPC DA), or OPC Unified Architecture (OPC UA). Communication between the systems should be restricted to operation only. This architecture is most often chosen when an SIS is added to a legacy BPCS.
Creating links between the systems is complicated because the designer must find security options that fit the engineered solution and tailor them to the organization’s requirements. Firewalls alone are not enough. Today’s cybersecurity standards typically demand weaving together additional options such as antivirus, whitelisting, user access control, and more. It must be realized that typically there are more than one connection. In addition to the BPCS, the SIS frequently connects to an Asset Management System to manage field devices, historians and event collectors. Connections between the SIS and the external systems must be secured and each one requires secured access that will require personnel to manage multiple sets of hardware and software.
The integrated SIS architecture nests the systems yet keeps them safely separate. The SIS and the BPCS share costs of protection layers and connection points.
In an integrated architecture, the SIS and BPCS might be referred to as an Integrated Control and Safety System (ICSS), such as an integrated SIS and a distributed control system (DCS). The SIS and the BPCS can share the same engineering tools and operator environment. However, the systems’ safety logic must run on dedicated hardware. To maintain independence, the systems must have defendable paths and offer the ability to lock configurations.
When applied to a DCS, the integrated architecture provides fewer data entry points and is strongly defendable thanks to the innate protections designed into each of the systems, the BPCS and the SIS. In fact, a coordinated cybersecurity approach in and around the ICSS makes the integrated SIS architecture as defendable as the interfaced SIS — and in most cases more so. And because the cybersecurity is embedded in the integrated approach, no extra outside implementation is required, and less time is required from staff or consultants.
Cybersecurity strategy should be well-thought out early in system planning since it can impact engineering and operation. For example, defining requirements and implementation for message validation between the BPCS and SIS should be considered early in the project. Security should be an inherent part of engineering and not at the end of the project.
Cybersecurity Considerations in Evaluating Architectures
Each architecture can be hardened. And each architecture to some degree can fit the unique organizational requirements based on cybersecurity policies, risk assessment, knowledge, as well as number and availability of personnel. No facility has unlimited resources, however, so teams need to choose an architecture keeping in mind how much work will be required in building and maintaining it.
Three areas — protecting system entry points, building mitigating layers of defense, and assuring continued security throughout the facility’s lifecycle — help determine the short- and long-term cybersecurity strategy for SIS.
Protecting System Entry Points
Separate. Access to the separate safety system is through a permanent and dedicated engineering station. Alternatively, the SIS can be configured and maintained using a portable computer, which should be restricted and well-maintained to prevent malware infections, remote access by malicious users, or misuse by trusted insiders. Although the separate architecture might seem to be the most isolated and perhaps the most defendable of the options, system entry points for malware still exist (e.g. USB ports). If the systems are too isolated, they might not be updated as easily to prevent cyber-threats or known security vulnerabilities. Physically isolated systems cannot be easily monitored, and any compromise in the isolated system could go unrecognized.
Interfaced. It is typically assumed that only one entry point is present to an interfaced system (the BPCS connection). However, entry points can include the interfaces to an asset management system or historian. In addition, any workstation on the safety network provides an entry point that needs to be protected. For example, some architectures use workstations to collect sequence of events data. An interfaced SIS architecture potentially offers several points of entry to core SIS functionality, all of which must be defended with cybersecurity countermeasures.
Integrated. The points of entry into the SIS are significantly reduced because the SIS is nested within the protective layer of the BPCS. No other entry points to the SIS exist except through the BPCS gateway or proxy. This architecture is potentially the strongest of the three for operational and engineering tasks because access is controlled from a single infrastructure and tasks such as maintaining updates to the SIS can be performed easily. And operational and engineering tasks are efficient because maintenance to the SIS can be performed through the BPCS interface.
Setting in Place the Mitigating Layers of Defense
Mitigating layers of defense around each system contain protection mechanisms to help diminish cyber-threats that could compromise a system. Multiple layers of protection bolster the strength against unauthorized access. Layers include enforcing individuals’ physical presence with the system interface to prevent remote cyber-attacks.
Architectures use layers of defense that best suit their needs and deter potential risks. And to varying degrees, layers for each architecture assist or detract from the daily task of process control.
Separate. Because the SIS and BPCS are separate, both systems require their own layers of defense. The facility must design and maintain two sets of defense-in-depth. Additionally, the team must discern how to communicate between those sets without sacrificing security. An air-gap is often a myth, as a well-meaning employee may need information from the SIS and unknowingly use an unsecured means to obtain it – such as a malware-infected USB device or a “temporary” network connection to a compromised laptop.
Interfaced. As with the separate architecture each system requires its own layers of defense, and again the facility must design and maintain layers for both systems. In addition, teams must recognize the complexity of engineering pathways between the two systems. These pathways are often engineered using open, unsecured protocols such as Modbus TCP which make them potentially more vulnerable to attack. Changes made to outer protective layers could impact the connectivity between the two systems — without the knowledge of the original architects could require a great deal of time to address for both systems.
Integrated. Because the SIS is embedded within the BPCS, facilities do not need to duplicate all cybersecurity protections for SIS and BPCS. An integrated but separate approach uses some common cyber-protection layers for both systems, in addition to separate and dedicated cyber-protection layers for the SIS. The SIS still has its own specific cybersecurity features such as logic solver lock functionality. Compromising the BPCS does not automatically compromise the SIS thanks to the defense-in-depth approach around the SIS. The defenses should include: secure, hardened communication protocols between the BPCS and SIS that are resistant to attack; network segmentation through a firewall to block unwanted communications; elements that require physical presence to change the SIS configuration to protect against credential compromise.
Lifecycle Maintenance
Cybersecurity must be addressed as part of the lifecycle maintenance costs. But maintenance can be more difficult depending on the chosen architecture and facility conditions.
In general, the more tasks required to maintain a defendable system, the larger the number of personnel who are needed and the more time demanded. The goal, therefore, is to have the strongest defendable architecture maintained in the most achievable and efficient methods by the organization.
Separate. With cybersecurity to be maintained on two separate systems, the management overhead increases with duplication of efforts to achieve one common goal: protect the separate BPCS and SIS. In addition, to keep the SIS evergreen as the BPCS changes, the team must administer the changes over the few and defendable openings in the system – or additional and possibly unsecure openings must be used to update the system. The maintenance of safety sensors and final elements must be done in a periodically scheduled manual method as there is no means for a smart device to self-diagnose and communicate an issue to maintenance personnel – because the system is air-gapped.
Interfaced. For this architecture, lifecycle maintenance is reduced as compared to separate architecture because communication occurs across connected paths via communication protocol(s). Compared to integrated architecture, however, maintenance for interfaced architectures is more involved because teams must deal with engineering links and changes to the cybersecurity architecture. Something as simple as updating virus definitions must be completed on multiple systems and might include different vendors. Here again, there are duplications of efforts to maintain the independence between the SIS and BPCS. Results include increased effort, multiple vendor systems to update, increased downtime, and more potential for error that leaves vulnerabilities in the security of the system.
Integrated. A fully integrated control and safety system can be easier to maintain over the lifecycle of the systems because the SIS is wrapped in layers of defense, many of which also defend the BPCS. Teams managing integrated architecture have layers that help protect both systems at the same time. For example, although the SIS has some additional built-in protections specifically for the SIS, anti-virus is provided for the ICSS as one system – which can automatically manage updates. In addition to the ease in layers of defense, integrated diagnostics provide lifecycle maintenance simplicity. For example, SIS-related alerts from smart devices can be sent easily via the BPCS to maintenance personnel to signal potential sensor or final element issues.
Choosing Future Security
The various strengths of each architecture hold potential for the wide variety of facility requirements that exist across the process industry. As teams consider current project and process needs, they should carefully consider their future requirements and choose accordingly for a defendable future. In addition to cybersecurity, teams must consider engineering, installation, commissioning, operations, and lifecycle maintenance as they choose the architecture approach that best works for their enterprise.
Click here for additional information.
Sergio Diaz is product manager for safety systems at Emerson and Alexandre Peixoto, is product marketing manager for cybersecurity at Emerson.
Trackbacks/Pingbacks