Chem teams mix potent antidote

InTech, Feb 2008 by Policastro, Ellen Fussell

One example of risk assessment is looking at the nature of the chemical process. How risky is the process? What could be the consequences in the case of a cyber security event? "Some processes that use dangerous chemicals at high pressures that could cause release of dangerous chemicals would get more attention than a process that puts product in a plastic bag," Cosman said. The nature of the process is an important factor. To some degree, the location of a facility is important-how tightly it is connected to other facilities. There is a tie to the physical obviously because physical and cyber are related.

"We also look at the nature of the automation system, how open or not open it is," he said. "If it's an older proprietary system and not connected to the network, it's much less likely to be vulnerable to a cyber attack. We have a fairly large installed base of proprietary process control technology that is more resistant because it's custom built. Open systems of course bring risk, and productivity brings risk. If you're using open technology-based control systems, you should understand the risk that entails and make sure you've mitigated that risk appropriately."

The biggest vulnerability in industry is "people are connecting these systems without fully understanding the risk," Cosman said. That's part of what ISA99 and people working in this space are trying to address. Whether it is ISA99 or chemical security in general, "we're trying to get the word out that these risks do exist. But it's not hopeless," he said There are things you can do about it. One of those things includes looking at material produced by guidance programs from the chemical security program and ISA99. "Both of those efforts have produced educational material to help people improve their systems. All that information is readily available."

ABOUT THE AUTHOR

Ellen Fussell Policastro is the associate editor of InTech. Her e-mail is efussell policastro@isa.org.

View the online version atwww.isa.org/intech/ 20080202.