A chemical plant operates continuously, with reactions that cannot be stopped at the push of a button and substances that demand respect. The final barrier between a deviation and an accident is the safety instrumented system (SIS), so the question guiding all our work in this sector is not “can they steal our data?”, but “can anyone tamper with the control system or the SIS?”.
Triton malware, designed specifically to target safety controllers at a petrochemical plant, settled the debate over whether this was merely theoretical. Since then, corporate groups in the sector, insurers and NIS2—which includes the manufacture of chemical substances among its sectors—have all pushed in the same direction: demonstrating control over the industrial network.
We always start with the actual picture: an assessment using passive capture, because a chemical plant is no place for indiscriminate scanning. The same three workstreams usually emerge: segmenting the process network and isolating the SIS from everything else, bringing engineering firms' and manufacturers' remote access under control, and monitoring with use cases specific to continuous processes: logic changes, signal overrides and new connections.
When intrusive testing is required, it is performed on a test bench or during a scheduled shutdown, with operations and the process safety manager at the table. In this sector more than any other, physical safety and cybersecurity are the same conversation.
NIS2 (Annex I, manufacture of chemicals and chemical products) for risk management and reporting; IEC 62443 as the technical reference for zones, conduits and security levels; and the Seveso industrial safety framework, with which our work must integrate smoothly. We explain this in detail under NIS2 and IEC 62443.