Safety and Security: A Field of Tension in Industrial Practice

Abstract

The convergence of Information Technology (IT) and Operational Technology (OT) leads to an increasing interdependence between the protection goals of security and safety. A cyber-attack targeting safety functions may in turn lead to hazards endangering people and the environment. Furthermore, misusing safety functions may impact availability by causing a machine or production line to stop working. This work analyzes how Austrian stakeholders of industrial automation enterprises address security and safety risks to mitigate undesired situations. The stakeholder analysis performed considers vendors of products or components, integrators, and asset owners of industrial systems. Secure infrastructures, system architectures, and risk management are subject areas of this analysis. The analysis was conducted in two phases. First, an online survey was created where the involved stakeholder offered their answer simultaneously. Considering the results of the survey, individual stakeholder workshops were carried out to obtain additional, more specific perceptions about the stakeholder’s OT system and components with respect to security and safety considerations. The obtained results provide insights into the current practices in the industry regarding safety and security.