Interconnected Industrial Control System (ICS) networks based on routable protocols are susceptible to remote attacks similar to classical Information Technology (IT) networks. However, addressing ICS security in an isolated view is dangerous since ICSs have to ensure safety measures for people, processes, and the environment. Safety and security of ICSs are often addressed separately, without considering their important interrelation. Safety measures can violate security policies (e.g., an emergency stop function accessible by anyone); likewise, a security incident can violate safety policies (e.g., by increasing reaction time). In this paper we propose a Network-based Intrusion Detection System (NIDS) with the interrelation between safety and security in mind: It detects security incidents while evaluating possible safety-related consequences of both the detected attack and possible countermeasures.We evaluate our approach with a Proof of Concept (PoC). The alerts generated by the PoC prototype serve as the basis for a risk management strategy proposed in this paper. Our approach provides a basis for safety-aware intrusion detection in smart factories and other cyber-physical systems.

Industrial Control Systems (ICSs) play a crucial role in the smooth operation of critical infrastructures, and their increasing complexity and interconnectedness necessitate integrating safety and security measures. Thus, an integrated risk assessment approach is essential to identify and address potential hazards and vulnerabilities. However, conducting such risk assessments becomes complex and challenging due to the difficulty in data availability. Acquiring data from various sources poses a significant hurdle. To address these challenges, Automation Markup Language (AML) provides a standardized framework that facilitates the seamless exchange of engineering information. This paper uses AML libraries and connection setup techniques to generate a valuable model of a single source of data for an integrated safety and security risk assessment. The automated risk assessment employs the AML model as a data source and the Bayesian Belief Network (BBN) as the risk assessment method. The value of risk associated with the system is calculated using the BBN models as the product of the probability of occurrence and severity. An evaluation of the proposed risk assessment method is also provided based on ISO 31000. AML's effectiveness as a valuable information model in meeting the growing need for comprehensive safety and security risk assessment in ICSs is demonstrated.

Industrial Control Systems (ICSs) are critical in automating and controlling industrial processes. Human errors within ICSs can significantly impact the system’s underlying processes and users’ safety. Thus, it is essential to understand the factors contributing to human errors and implement targeted interventions. Various factors that influence and mitigate human errors must be explored, including organizational, supervisory, personal, and technical factors. In parallel, the impact of a security incident also needs consideration. The paper presents a Bayesian Belief Network (BBN) model developed to model these factors comprehensively and demonstrate their impact, especially in the context of security incidents. Probability distributions are employed with practical assumptions to overcome data limitations, emphasizing the model’s utility in risk assessment. The model’s complexity is addressed using multiple interconnected sub-models, enhancing accuracy and avoiding unnecessary intricacies. Despite challenges in identifying all relevant factors, a sincere effort is made to incorporate diverse research findings. This paper highlights the essential role of BBN models in understanding and mitigating human errors, contributing to the resilience of ICS processes. The use of BBN and probabilistic distributions enables quantitative and probabilistic analysis of the impact of human errors, aiding in developing more robust risk management strategies to improve system resilience in ICSs.