Emergent Risks

The ever-greater integration of new technologies in work equipment is regarded by some as the fourth industrial revolution and referred to as ‘smart industry’. The Internet of things (IoT) movement is gaining momentum, a development that still can be influenced. The Internet of Things is creating complex connectivity between systems and processes.

Emergent risks to workplace safety as a result of IT connections of and between work equipment

Industrial Control Systems (ICS) are increasingly deployed in crucial business processes. ICS are also being connected more and more to internal business networks and directly or indirectly to public networks such as the internet. As a result, ICT and ICS have an ever-more important role in monitoring and controlling processes and work equipment in companies and organizations, and even in the living environment. This means that cyber security has a direct impact on workplace safety. It cannot be denied that the introduction of new ICT and the connections between work equipment through the internet or telecommunications has enabled industry to make great strides in terms of efficiency.

A few examples are:

In 2017, Honda Motor Co. had to shut down its Sayama plant for one day after finding the WannaCry ransomware in its computer network. The WannaCry ransomware got everyone's attention in May 2017 when UK NHS hospitals fell victim to it. It then quickly spread around the world, affecting over 150 countries and hitting companies like French car manufacturer Renault and FedEx.
In 2014, a cyber attack led to major physical damage to an iron-producing factory in Germany. The safety-related risk is evident.
In 2010, Royal Friesland Campina was the victim of a modified Conficker virus that disrupted their ICS resulting in loss of production of milk products that lasted nine hours. It is not clear how, if at all, this has put the quality of their products at risk.
In Lodz, Poland, a teenager succeeded in causing two trams to collide by manipulating the track points, with several people injured as a result.
In 2005, the ICS of a number of North Sea oil and gas platforms were affected by the Zotob.E worm. The only way to remove the work was by flying extra staff to the platforms. The level of risk to safety is not known.

The effect of failing cybersecurity of the ICS of high-risk business processes on workplace safety is still largely unexplored.

Operating work equipment remotely

With increasing frequency, employees are able to operate work equipment remotely in situations where hazardous work is involved or at hazardous locations. At the same time, this brings new vulnerabilities regarding workplace safety. Wireless signals can fail or be disrupted, which can lead to a vehicle of machinery operating out of control. The employee may also find himself in the path of the vehicle in question or an area in which the machinery poses a danger. Moreover, it is not inconceivable that control over a particular item of work equipment is lost to a hacker, or that it is adversely affected by malware or an unauthorized individual who is ‘playing’ with the technology.

the new risks resulting from connections between work equipment through the internet or other forms of telecommunications, such as telemetry and radiographic control.

What is the possibility that one or more individuals may gain unauthorized access to systems monitoring and controlling workplace equipment of companies and disrupting them to the extent that a situation could arise that poses a danger to workplace safety?

it can refer to access for malicious hackers or malware, as well as unintended acts on the part of a maintenance engineer.

An important underlying factor that strengthens this risk is the ever-greater complexity resulting from the IoT - that is, that everything is connected to everything else via networks.

Below, we present the most significant risks, vulnerabilities, and control measures that have emerged from the project, the most important actors and sources of information for businesses seeking to work on prevention, and several concrete steps for tackling the risk from a company perspective.

Risks

Disruptions to processes threaten the business continuity and the quality of the production.
Employees injured or killed as a result of an unsafe work situation caused by an unintended cyber disruption or hacking, malware, or signal interruption, and the concomitant financial damage (absenteeism and sickness costs, for example).
Access can be gained to processes and machines via blackmail (such as physical threats to employees or the creation of an access path through ‘phishing’).
Harm to image resulting from incidents visible to the public (such as in cases where there are victims).

The complexity of the increasing connectivity of systems, processes, and the internet for example, also makes it more difficult for employees who have to work with them to retain any kind of overall view. Resulting unconsciously unskilled acts can create various unsafe situations. Examples include opening back doors for hackers via malware, or directly, by unintentionally disrupting a system in cases where not every consequence of a particular action is obvious across the whole network.

Recommendations for businesses and organizations

Ensure that integral safety and cyber security are coordinated at board room level, in one portfolio, to be held, for example, by a Chief Information Officer or the CEO.

Ensure that there is a multidisciplinary team that makes an integral evaluation of the cyber security related risk to workplace safety, with specific inclusion of the human factors, observes incidents, and which is able to take emergency measures if necessary.
Analyse where in the here and now network connections between work equipment and ‘risky’ internal environments and outside worlds exist.
Make sure that knowledge is shared, good practices are exchanged, and warn each other about incidents and threats.36
Anticipate changes to work equipment and to connections between work equipment and ICS and public and other networks through integral security analyses and product requirements.
Include safety and cyber security in designs, system integration, and supply, and when putting out orders such as for the carrying out of maintenance. In doing so, take consideration of how things are interrelated (such as system architecture and relevant actors).
Make sure that all parties possess the necessary awareness of the importance of integral actions in relation to workplace safety and cyber security. If necessary, give people extra training (management, other employees, those carrying out the work).