Gas Compressor Stations: Internet-Reachable SIS Modems
A gas transmission operator runs 12 compressor stations, each with a SIL 3 safety instrumented system (SIS) and a process control system. A central SCADA in Houston polls station RTUs. The SIS vendor left an always-on cellular modem in each station for diagnostics; the modems use a shared password and one station's SIS logic has remote write capability. Corporate security found the modem IPs are reachable from the internet. The operator's risk assessment says loss of pressure control could affect 400,000 customers. The OT team wants to disable all modems immediately, but maintenance depends on them for remote diagnostics after unplanned trips; response time would rise from 30 minutes to 4 hours. There is no separate SIS network; process control and SIS share a flat station LAN. Budget exists for a data diode but not for SIS replacement.
1. Should the operator disable all cellular modems immediately? Justify your answer using ISA/IEC 62443 risk and safety concepts, and propose an interim remote-access architecture.
Read the worked answer
Do not simply disable all modems in a maintenance window without a safety review. The internet-reachable write path is unacceptable, but removing diagnostics can increase risk after a trip if the response time goes from 30 minutes to 4 hours. Use a staged decision: immediately block inbound internet access at the carrier or SIM level, disable remote write, and keep read-only diagnostics if possible. Replace the shared password with individual credentials and MFA. Move access to a private APN with SIM allowlisting and a VPN to a jump host; require on-demand modem power control and session logging. If a modem must stay for diagnostics, put it behind a gateway that allows only the vendor jump host and only the diagnostic protocol. In parallel, separate the SIS from the process control LAN. This follows 62443-3-2 risk-based design and respects the safety lifecycle: security controls must not create a new safety hazard.
2. Design zones and conduits for the station. Explain where the data diode belongs and what traffic it should allow.
Read the worked answer
Create a SIS zone and a separate process control zone, each with its own conduit to the plant DMZ. The SIS zone should have the highest SL-T because a malicious write can defeat a SIL 3 safeguard. The data diode belongs on the outbound path from the SIS to the historian or remote monitoring: it should pass only one-way diagnostic and status data, never commands or firmware. It does not replace a firewall on the engineering access path; maintenance access should be local, physical and controlled, or through a temporary gateway with MFA and a one-time enable. The process control zone connects to the SCADA WAN through a firewall, and the SIS has no route to that WAN. Vendor remote access terminates in a DMZ and cannot route to either zone except to a specific jump host. This gives defense in depth and keeps the safety function independent.
3. The operator wants to claim the station meets SL 3 because the SIS is SIL 3. Explain why this is invalid and what evidence is needed for an SL claim.
Read the worked answer
SIL 3 is a safety integrity claim about risk reduction from dangerous failures; it says nothing about resistance to deliberate cyber attack. 62443 SL is a cyber security claim with target, capability and achieved levels. A SIL 3 SIS may have weak authentication, no logging and an internet-reachable modem, so its SL-C could be 1. The operator must define SL-T from the cyber risk assessment, assess SL-C against 62443-3-3 requirements and component capabilities from 62443-4-2, and document the gap. If the SIS cannot meet SL-T, compensating controls and a risk acceptance are needed, plus a migration plan. Claiming SL 3 because of SIL 3 would mislead the regulator and hide the real exposure. Evidence would include the zone/conduit model, SL vector, requirement-by-requirement assessment, test results and CSMS records.