CATCH hosted their Major Hazards Group on 17 July which focused on the topic of cyber security.  The group chair, Dan Rawdin from SSE, welcomed over 25 delegates who joined in person and via teams.

The first speaker was Paulo Oliveira, Director of Consulting – DEKRA Organisational & Process Safety, who gave a presentation on how safe and secure systems are at the centre of integrity in operations.  Paulo highlighted the importance of understanding the risks and how we can design systems that are safe and secure.  The challenges include how functional safety guidance and approach is different to how cyber security professionals look at the situation.  Paulo explored how we can establish a framework to look at the problem together, and avoid starting from different points, using different guidance.  It is important to open dialogue and keep sharing learning as the sector progresses and matures.  The group discussed how HAZOPs, for example, will one day include cyber security specialists, but this competency needs to develop and grow over time.

After a break, Andy Scott from SSE gave a site operators experience of maintaining industrial control systems against compromise from cyber-attack.  Andy highlighted the regulatory framework that SSE are operating in including HSE and DESNZ.  The sector has moved on from the domain of a C&I engineer into security and cyber security.  Andy shared some of the most recent cyber attacks and the impact they’d had and shared lessons learned from these, including Stuxnet virus, TRITON Malware, SolarWinds.

Andy described the common characteristics of an attack and how to manage an attack framework to include corporate infrastructure, Distributed Control System(s), SCADA, Protection System(s) & Intelligent end devices.  Andy went on to describe how to implement a defence in more depth to include multiple layers of protection, some procedural, some behavioural and some technological.  Working with suppliers is becoming increasingly important to avoid weaknesses and the supplier landscape is under more scrutiny from regulators.

Paulo and Andy took questions.

The next Major Hazards Group meeting will be held at CATCH on 14 November.  For more information about CATCH network groups please contact katie.hedges@catchuk.org