SecureSafety; state-of-the-art and remaining challenges

The term SecureSafety (SeSa) was launched in a project that was completed in 2006, which left behind a (at the time) new method for securing Safety Instrumented Systems (SIS), which pioneered modern approaches to industrial control and automation systems (ICAS) security in the oil and gas industry. The basic conceptual advance of the SeSa approach, combining security and safety in the manufacturing of ICAS systems, is today prolonged by an ongoing attempt to integrate functional safety standards with emerging security standards aimed at ICAS and SIS, founded on advancing the barrier model that originates from the safety domain. However, arguing that there is a need for additional measures for countering unexpected and surprising events from the complex security threat landscapes, this paper explores how the increasingly popular resilience concept can be the foundation for additional SeSa approaches and measures. The exploration takes into consideration some recent critique towards the resilience concept as it is applied in the discourse on safety management in the Norwegian oil and gas sector, the difficulty of adopting key premises aspects of resilience to an increasingly software-intensive SIS domain, and the potential disruptive impact of new technologies such as 5G, with a sensitivity to technocultural aspects. Arguing that the adaptation of the resilience concept into the SeSa domain should be based on a pronounced sociotechnical perspective and a deliberate contextualization of resilience into a procedural, compliance-oriented scheme that facilitates managerial accountability also when attempts of resilient performance fails, the paper concludes by sketching out a road map for further work on SecureSafety.