Cyber Risk to Mission Case Study: Triton

In August of 2017, TRITON malware was used to target and disrupt Safety Instrumented System (SIS) controllers within a Saudi petrochemical refinery. A SIS controls critical processes that support safety and reliability within a control system. Fortunately, the targeted SIS initiated a safe shutdown when code validation failed, triggering an internal investigation that uncovered the malware. This is one of the few publicly reported incidents of control system malware designed to inflict physical damage and the first that targeted a SIS.