<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-safety-instrumented-systems
description: >-
  Audit Safety Instrumented Systems (SIS) and Emergency Shutdown Systems (ESD) for
  cybersecurity vulnerabilities, verify logical and physical isolation from control
  networks, and detect TRITON-style attacks targeting safety controllers.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - sis
  - esd
  - safety-systems
  - triton
  - ics
  - triconex
  - iec-61511
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0800", "T0857", "T0855"]
  nist-csf: ["PR.AC-5", "DE.CM-7", "PR.IP-1"]
  iec-62443: ["SR 5.1", "SR 7.7"]
  uuid: a1b2c3d4-1012-4000-a012-000000000012
---

# Auditing Safety Instrumented Systems

## Overview

Safety Instrumented Systems (SIS) are the last line of defense preventing catastrophic
events — explosions, chemical releases, equipment destruction. SIS controllers (e.g.,
Schneider Triconex, HIMA, Yokogawa ProSafe) must operate independently from the basic
process control system (BPCS). TRITON/TRISIS (2017) demonstrated that SIS controllers
can be directly targeted to disable safety functions while attackers manipulate the process.
A compromised SIS with a simultaneously manipulated process = potential loss of life.

Mode: `[MODE: ARCHITECT]` for security design review; `[MODE: BLUE]` for monitoring.

## Prerequisites

| Requirement | Details |
|---|---|
| SIS architecture documentation (SIL ratings, SIF definitions) | Required |
| Network diagrams showing SIS network isolation | Required |
| Access to SIS engineering workstation (authorized personnel only) | Required |
| Knowledge of IEC 61511 (Safety Lifecycle) and IEC 61508 | Required |
| Understanding of TRITON attack chain | Required |

## Key Concepts

### SIS Isolation Verification

```bash
# SIS must be on a physically separate network from BPCS
# Verify no IP connectivity between SIS and BPCS networks

# From BPCS network — attempt to reach SIS controller (should FAIL)
ping -c 3 10.3.0.1        # SIS controller IP — should timeout
nmap -Pn -p 1502 10.3.0.1 # TriStation port — should show filtered

# From SIS engineering workstation — verify isolation
traceroute 10.1.0.1        # BPCS network — should fail
traceroute 10.5.0.1        # IT network — MUST fail

# Verify SIS engineering workstation is dedicated (not shared with BPCS)
# Check for BPCS software installed on SIS workstation (violation)
find / -name "*.s7p" -o -name "*.ACD" -o -name "RSLogix*" 2>/dev/null
# Output should be empty — BPCS tools on SIS workstation is a finding

# Verify physical key switch position
# SIS controller should be in RUN mode with physical key locked
# Program mode requires physical key turn (cannot be remote-triggered)
```

### TRITON Attack Detection

```bash
# TRITON targets Schneider Triconex via TriStation protocol (UDP/1502)

# Monitor for TriStation protocol traffic
tshark -i eth1 -f "udp port 1502" -w tristation_capture.pcap

# Any TriStation traffic outside maintenance windows is suspicious
tshark -r tristation_capture.pcap -T fields \
  -e frame.time -e ip.src -e ip.dst

# Suricata rule for TriStation detection
cat << 'EOF'
alert udp any any -> $SIS_NET 1502 ( \
  msg:"SIS ALERT - TriStation Protocol Communication"; \
  sid:4008001; rev:1; \
  metadata:mitre_attack_technique T0857;)
EOF

# Alert on TriStation from non-SIS engineering workstation
cat << 'EOF'
alert udp !$SIS_ENG_WS any -> $SIS_NET 1502 ( \
  msg:"SIS CRITICAL - TriStation from Unauthorized Source"; \
  sid:4008002; rev:1; \
  metadata:mitre_attack_technique T0857;)
EOF

# Host-based TRITON artifact detection
# Check SIS engineering workstation for TRITON indicators
find / \( -name "trilog*" -o -name "inject.bin" -o -name "imain.bin" \) 2>/dev/null
# Check for Python-compiled executables (TRITON delivery mechanism)
find / -name "*.pyc" -newer /etc/hostname 2>/dev/null
```

### SIS Configuration Audit Checklist

```yaml
Physical Security:
  - SIS controller in locked cabinet: [YES/NO]
  - Physical key switch in RUN position and key removed: [YES/NO]
  - Dedicated SIS engineering workstation (not shared): [YES/NO]
  - USB ports disabled on SIS engineering workstation: [YES/NO]

Network Isolation:
  - SIS on physically separate network from BPCS: [YES/NO]
  - No IP routing between SIS and BPCS networks: [YES/NO]
  - No direct connection to IT network: [YES/NO]
  - No internet connectivity from SIS network: [YES/NO]
  - Data diode for SIS status to historian (if connected): [YES/NO]

Access Control:
  - SIS programming requires physical presence: [YES/NO]
  - Change management process for SIS modifications: [YES/NO]
  - SIS access limited to certified safety engineers: [YES/NO]
  - Audit logging on SIS engineering workstation: [YES/NO]

Firmware Integrity:
  - SIS controller firmware version documented: [YES/NO]
  - Firmware hash matches vendor golden image: [YES/NO]
  - SIS application logic backed up and verified: [YES/NO]
  - Periodic integrity check scheduled: [YES/NO]
```

### SIS Network Monitoring

```bash
# Deploy monitoring on SIS network (read-only TAP)
# Use data diode to forward SIS monitoring data to SOC
# NEVER deploy active monitoring that could impact SIS operation

# Passive monitoring with Zeek on SIS network TAP
zeek -i tap0 local

# Profile all SIS network traffic (should be minimal)
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p proto | sort -u

# ANY unexpected traffic on SIS network is a critical alert
# Normal: SIS controller ↔ field sensors/actuators only
# Abnormal: Any IP-based traffic to/from SIS controller
```

## Workflow

### Step 1: Document SIS Architecture

```
Map all SIS controllers, their SIL ratings, protected processes
Document SIS network topology (should be isolated)
Identify SIS engineering workstations and authorized personnel
```

### Step 2: Verify Isolation

```bash
# Test network isolation from BPCS and IT networks
# Verify physical security controls
# Check key switch positions on all SIS controllers
```

### Step 3: Deploy Monitoring

```bash
# Read-only TAP on SIS network
# Data diode for SIS alerts to SOC
# TriStation protocol detection rules
```

### Step 4: Audit and Report

```yaml
finding: SIS-001
severity: Critical
description: SIS network reachable from BPCS via misconfigured VLAN trunk
remediation: Remove SIS VLAN from trunk, implement air gap or data diode
timeline: Immediate — safety-critical finding
```

## Verification

- [ ] SIS physically isolated from BPCS and IT networks
- [ ] No IP routing path from BPCS to SIS controllers
- [ ] SIS engineering workstation dedicated and hardened
- [ ] Physical key switches verified on all SIS controllers
- [ ] TriStation/SIS protocol monitoring deployed
- [ ] TRITON artifact scanning completed on SIS workstations
- [ ] SIS firmware integrity verified against vendor golden images
- [ ] Change management process enforced for SIS modifications

## Detection Opportunities

- Any TriStation traffic outside scheduled maintenance → potential TRITON-style attack
- TriStation from non-SIS engineering workstation → unauthorized access
- SIS controller mode change (RUN→PROGRAM) → unauthorized modification attempt
- New IP addresses on SIS network segment → rogue device introduction
- SIS firmware hash mismatch → unauthorized firmware modification

```yaml
title: Auditing Safety Instrumented Systems Detection
id: 5bfa294b-c268-4813-bdbc-b6ed9eb94a32
status: experimental
description: Detects suspicious activity related to auditing safety instrumented systems techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*auditing*safety*"
  condition: selection
level: medium
tags:
  - attack.t0800
  - attack.t0857
  - attack.t0855
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- IEC 61511: Safety Instrumented Systems for the Process Industry
- IEC 62443-3-3 SR 5.1: Network Segmentation (SIS isolation)
- FireEye/Mandiant: TRITON Attack Analysis
- CISA: Safety System Cybersecurity Best Practices
- ISA TR84.00.09: Cybersecurity Related to the SIS
