The exposure of industrial facilities to cybersecurity threats has never been higher. An analysis performed by IBM security found that the number of attacks on SCADA systems increased 636% from 2012 to 2014, with 675,816 cybersecurity incidents in January 2014 [1]. Finding an effective method for evaluating the current…
exida explains Blog
- by Patrick O'Brien
- Thursday, December 06, 2018
- Industrial Cybersecurity
Cyber Risk Assessments and Security Level Verification: Security Level Verification (Part 3 of 3)
- by John Yozallinas, CFSE
- Tuesday, December 04, 2018
- Software
Who needs sliced bread? We’ve got ARCHx!
I’ve heard this phrase so many times in my life… “<Something> is the best thing since sliced bread.” I personally can’t remember a time when sliced bread was not available, but I certainly remember going to the deli and having them use the slicing machine before handing me a bag…
- by Dave Butler, CFSE
- Thursday, November 29, 2018
- Certification
Comparing the IEC 62443 Software Engineering Process to IEC 61508: Where Do They Overlap?
With the appearance of malware and nation state attacks on Industrial Control Systems (ICS), such as the Stuxnet (2010), Industroyer (2016) and TRITON (2017) attacks, the IEC 62433 standards are gaining wider attention.
While the potential targets to attack in an ICS system are many-fold, one plant asset that…
- by Dr. William Goble, CFSE
- Tuesday, November 27, 2018
- Certification
Functional Safety Certification Started with Logic Solvers
IEC 61508 functional safety certification began in the 1990s. As I recall, the only organizations doing this work in those days were TÜV Rheinland and TÜV Product Services (now TÜV Sud). These two companies remain competitors.
Functional safety certification started with logic solvers. Some engineers and regulators at the…
- by Patrick O'Brien
- Tuesday, November 20, 2018
- Industrial Cybersecurity
Cyber Risk Assessments and Security Level Verification: Detailed Risk Assessments (Part 2 of 3)
The exposure of industrial facilities to cybersecurity threats has never been higher. An analysis performed by IBM security found that the number of attacks on SCADA systems increased 636% from 2012 to 2014, with 675,816 cybersecurity incidents in January 20141. Finding an effective method for evaluating the current level…
- by Steve Gandy, CFSP
- Thursday, November 15, 2018
- Functional Safety
Are You Undertaking Periodic Personnel Performance Assessments?
One of the changes that was made in 2016 to the IEC 61511 standard was the inclusion of periodic personnel assessments (clause 5.2.2.3), whereby a procedure is required to manage the competence of all those involved in the SIS lifecycle; “periodic” assessments are to be carried out to document…
- by Dave Johnson, CFSE
- Tuesday, November 13, 2018
- Industrial Cybersecurity
Preventing Cyberattacks by Following Practical Guidance in IEC 62443
Isn’t it frustrating when you experience an event that disrupts operations and then discover it could have been prevented? Very often a detailed analysis will reveal that a combination of (preventable) mistakes and unknown factors caused the incident. Training can help the mistakes, but dealing with the unknowns is a little…
- by Jeff Davis
- Thursday, November 08, 2018
- Industrial Cybersecurity
IACS Cybersecurity IEC 62443: Agile Lifecycle and Documentation
Industrial Automation Control Systems (IACS) Cybersecurity based on IEC 62443 was created to be compatible with agile development methodology. The standard deliberately talks about processes and not phases, such as those in the waterfall model. The processes defined can be met simultaneously and are, most likely, already being followed…
- by Dr. William Goble, CFSE
- Monday, October 29, 2018
- Certification
Using SILSafeData to Check Your Failure Data Source
www.SILSafeData.com is a complimentary resource that contains the upper and lower bounds failure rates for many categories of automation equipment, as well as the methodology used by exida to derive the numbers.
Many of you have asked how to…
- by Todd Stauffer
- Thursday, October 25, 2018
- Alarm Management
Bad Actor Knockdown: The “Whac-A-Mole” of Alarm Management?
As discussed in What do Nuisance Alarms, the 80-20 Rule, and Mental Models Have in Common?, there are typically a handful of alarm points (10 to 20) that create the majority of notifications (50-80%) to the operator (referencing the 80-20 rule). These nuisance alarms are affectionately called “bad…
- by Jim Jenkins
- Wednesday, October 17, 2018
- Functional Safety
Does Your Burner Management System Meet Your Tolerable Risk?
My previous blog mentioned the fact that a Burner Management System (BMS) is unique, in that this instrumented layer is the last line of defense and may be the only protection layer in the case of a BPCS failure.
Have you ever performed an analysis to determine…
- by Dave Gunter
- Thursday, October 11, 2018
- Industrial Cybersecurity
Managing Unconfirmed Cybersecurity Vulnerabilities like Supermicro
Unconfirmed vulnerabilities are not usually a big issue, but when one occurs like Supermicro, plant management will ask a simple question: “Do we have an issue or not?”
Having been on the receiving end of this blunt exchange, I realize it can be painful and embarrassing to communicate,…
- by Brad Hitchcock, CFSP
- Monday, October 01, 2018
- Functional Safety
Hazard Analysis and Risk Assessment of Collaborative Robotic Systems
The world of collaborative robots, or cobots, is making headway. According to a recent report by the International Federation of Robots (IFR), along with Loup Ventures, global robotics spending will reach $13 billion in 2025. Currently, collaborative robots only make up about 3% of all robot sales. This number…
- by Dr. William Goble, CFSE
- Thursday, September 27, 2018
- Certification
The New Technology in Logic Solvers
I heard about a “safety certified” PLC in the late 1980s at an ISA SP84 standard committee meeting. The “logic solver” (as they later called it) was the focus of attention in the field of functional safety back then. Many engineers even said, “My system is safe because I…
- by Patrick O'Brien
- Tuesday, September 18, 2018
- Industrial Cybersecurity
Cyber Risk Assessments and Security Level Verification: High-Level Risk Assessments (Part 1 of 3)
As the number, scale, and connectivity of industrial automation systems continues to grow, it becomes increasingly crucial to fundamentally understand, evaluate, and manage cybersecurity risks. The objective of an effective cybersecurity management program should be to maintain the industrial automation system consistent with corporate risk criteria.
Ownership for industrial…