3 Ways Cyber Threats Can Compromise Industrial Process Safety

Manipulating Process Measurements

Industrial control systems use sensor readings and control signals to monitor and regulate pressure, temperature, flow, and liquid levels. Cyber threats can compromise these functions by altering data transmitted between devices. Threats can also modify controller settings and issue unauthorized commands to connected equipment.  

For example, falsified pressure readings could cause a control system to respond to conditions that do not reflect the actual state of the process. If a controller uses this inaccurate input to adjust a valve or a pump, it could change the flow rate or pressure in a way that disrupts the process. This may cause operating parameters to move outside their acceptable ranges, making abnormal conditions harder to detect and manage.  

To address this risk, engineering professionals can implement anomaly detection that checks whether incoming data is consistent with expected process behavior. In a 2024 study entitled “Anomaly Detection Using Isomorphic Analysis for False Data Injection Attacks in Industrial Control Systems,” researchers investigated a method for detecting false data injection by comparing sensor readings, actuator and control signals against expected system behavior.  

This approach can also be achieved by identifying relationships between process variables and using them to flag readings that conflict with other measurements and expected equipment responses.

Engineering professionals can simulate false data injection during system testing to determine whether these inconsistencies are detected before they affect control decisions. If data integrity cannot be verified, the system should prevent suspect readings from driving critical operations and initiate a predefined protective response, such as switching to a validated backup measurement. Doing this can help limit the potential for manipulated data to propagate through the control loop and compromise process safety. 

Disabling Safety Protections

Industrial facilities often use safety instrumented systems (SIS) and emergency shutdown systems to prevent hazardous operating conditions from escalating. Cyber threats can compromise these safeguards by modifying safety logic or bypassing safety interlocks.  

For example, an attacker could alter a safety system’s pressure limit, preventing it from triggering a shutdown when pressure becomes dangerously high. This could allow an industrial process to continue operating under unsafe conditions. Similarly, bypassing a safety interlock could allow equipment to operate when it should remain shut down. This increases the risk of an industrial accident. 

To address this risk, engineering professionals should restrict access to safety controllers and require authorized, documented approval for changes to safety logic and trip settings. The National Institute of Standards and Technology (NIST’s) Guide to Operational Technology (OT) Security recommends documenting approved system configurations and requiring changes to be tested and approved before implementation.  

Engineering professionals can apply these principles by maintaining approved configuration records, logging changes, and comparing current settings against authorized versions to identify discrepancies.

The International Electrotechnical Commission 61511, the functional safety standard for the process industry, addresses the requirements for maintaining and testing safety instrumented systems throughout their lifecycle. Combining configuration controls with functional testing helps identify unauthorized changes and faults before they undermine the system’s ability to respond to hazardous conditions.

Disrupting Process Monitoring

Industrial operators rely on monitoring systems, human-machine interfaces (HMIs) and supervisory control and data acquisition (SCADA) systems to observe equipment status, track process variables, and identify abnormal operating conditions. Cyber threats such as denial-of-service attacks and interference with industrial communications can disrupt these functions. This can eventually leave operators with incomplete or outdated information about an industrial process. 

For example, if a cyberattack interrupts communication between field devices and a control room, operators may lose access to current pressure, temperature, and flow readings. Without reliable information, they may struggle to identify developing faults and determine whether corrective action is needed. Delayed responses can allow abnormal conditions to persist and increase the risk of equipment and operational damage. 

To address this risk, monitoring systems should be designed to maintain visibility of critical process conditions during communication failures and cyber incidents. The NIST, in its Guide to Operational Technology (OT) Security, identifies network segmentation, continuous monitoring and appropriate security controls as measures for protecting operational technology environments. 

Engineering professionals can apply these principles by separating critical control networks from less trusted networks. They can also monitor communications for unusual activity and configure alarms to identify lost data connections. Procedures should also be established for operators to follow when monitoring information becomes unreliable. These measures can help operators recognize monitoring failures and respond safely before a loss of visibility contributes to an industrial process incident. 

Strengthening Industrial Process Safety

The effectiveness of industrial cybersecurity depends not only on preventing attacks but also on how well a facility can manage their consequences. Even with preventive measures in place, cyber incidents remain possible. Incorporating these scenarios into routine safety assessments and operational planning can help facilities maintain safer operations when preventive controls are insufficient. 

References: 

Anomaly Detection Using Isomorphic Analysis for False Date Injection Attacks in Industrial Control Systems 
Primary Mitigations to Reduce Cyber Threats to Operational Technology 

Functional Safety for Process Industries 

Guide to Operational Technology Security