IChemE - When the Signal Isn't the State: Responding to Cyber-Physical Incidents from the Engineering Side

Industrial cyber security is usually framed as an IT problem with an OT annex. For the engineers who run process plants, that framing is backwards. A cyber compromise of a control system is, first and foremost, a process integrity problem, and the earliest signals of one are the same signals engineers already watch every day.

This webinar takes an engineering-led view of cyber-physical incident response. Drawing on well-documented public incidents, including the TRITON attack on a safety-instrumented system, the Stuxnet manipulation of centrifuges behind a normal-looking HMI, the Ukraine power grid attacks, and the Oldsmar water treatment setpoint change, it examines what these events looked like at the plant level and what the engineering response required.

The session focuses on three questions every process and control engineer should be able to answer. How do I recognise a process anomaly that might be a cyber event rather than an equipment fault? How do I know whether I can still trust my instrumentation? And where is the boundary between the security team’s responsibility and mine, particularly when the decision is whether to bring the process to a safe state?

The webinar is entirely vendor-neutral and draws on generalised industry patterns rather than any specific organisation. It is aimed at process, control, and operations engineers, and at anyone working at the increasingly blurred line between engineering and cyber security.