Leveraging Existing PHA Studies to Assess Cybersecurity Risk

Cybersecurity is a significant and growing concern for the chemical process facilities. Many facilities are undergoing multiple studies of cybersecurity to define their required cyber defenses and risk mitigation techniques that are related to cyber-attacks. Many of the studies that are being undertaken for cybersecurity begin with a risk analysis component that is essentially a failure modes and effects analysis of the control system hardware that has little synergy with existing risk analysis studies and often results in over specification of the degree of cybersecurity guarding that is required because of a lack of understanding of the actual hazard scenarios that are actually possible as a result of cyber-attack. The SPR (pronounced ‘spur’) methodology (i.e., Security PHA Review), is a proven approach to address this problem. Instead of starting over and performing a new risk assessment from a blank sheet of paper, SPR starts with existing PHA studies, like HAZOPS, and reviews the scenarios that those studies contain with the specific purpose of identifying scenarios that can be generated through a cyberattack, while filtering out scenarios that cannot. This streamlined and efficient approach allows PSM professionals to assist in cybersecurity analysis by focusing the effort on those hazard scenarios that are relevant to cybersecurity. This paper will discuss the SPR approach to leverage existing PHA studies for the purpose of cybersecurity assessment, providing examples of application of the technique in chemical process facilities.