{"id":1337,"date":"2022-06-20T09:45:11","date_gmt":"2022-06-20T02:45:11","guid":{"rendered":"https:\/\/dt-corp.com.vn\/?p=1337"},"modified":"2022-06-20T09:45:11","modified_gmt":"2022-06-20T02:45:11","slug":"what-is-the-value-of-ot-cyber-risk-assessment","status":"publish","type":"post","link":"https:\/\/dt-corp.com.vn\/?p=1337","title":{"rendered":"What is the Value of OT Cyber-Risk Assessment?"},"content":{"rendered":"
\n
\n
\n
\n

The viability of any project or task is directly linked to the value it produces, i.e. if value exceeds costs, the project is worthwhile; otherwise, it\u2019s a losing proposition.<\/p>\n

Applying this simple model to cyber-security, and namely to OT-security, presents the problem: how do you determine the value of an OT-security system that successfully protects the industrial network? The costs of securing the OT network are known, but what are they measured against?<\/p>\n

One solution is to rely on industry and regional benchmarks: find out what equivalent companies (by industry, size, locale, etc.) had invested in, and replicate their system. While this crude method of planning (and obviously I\u2019m over-simplifying) leaves out many of the network and the company\u2019s unique characteristics \u2013 no two industrial networks face the same threats or employ the same devices \u2013 it allows you, with just the right amount of customization, to bring your OT security \u201cwithin the (very large) ballpark\u201d of your reference group\u2019s OT systems\u2019 value. Plus, in lieu of a better option, it\u2019s the best you got.<\/p>\n

\n
\n
\n
\n

 <\/p>\n<\/div>\n

\n
\n

\"\"<\/p>\n

Radiflow\u2019s CIARA industrial risk assessment and management platform enables OT organizations to maximize the value of their OT security by matching expenditure with the highest-value risk mitigation controls. The result is more and better OT security per dollar spent.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n

In time, and as the field of OT security matured, better ways to calculate the value of OT security were developed. The\u00a0ARC Advisory Group\u2019s<\/a>\u00a0formulation of the\u00a0different stages of cyber-security maturity<\/a>\u00a0describes this evolution as transitioning from\u00a0Vulnerability Management<\/em>\u00a0\u2013 installing passive defence systems that identify vulnerabilities in the OT network along with effective matching protections, to\u00a0Threat Management<\/em>\u00a0\u2013 installing active defence mechanisms that react to the entire security environment, including threat agent capabilities, the user organization\u2019s security needs, per-business unit security, and more. (Much of the principles of Active Defence and its implementation as Risk Management are embedded into the\u00a0IEC 62443 standard<\/a>, which in many ways represents the maturing of OT security).<\/p>\n

\"\"<\/p>\n

The ARC Advisory Group\u2019s model for OT security maturityThe introduction of\u00a0Risk Management<\/a>\u00a0as an overarching method of benchmarking, planning and monitoring the effectiveness (read: value) of the OT security system allows for a much higher level of optimization, meaning that you get the most security for every dollar spent.<\/p>\n

This is done by re-defining the role of the OT security system: from merely identifying vulnerabilities and installing protections that prevent them from materializing as cyber-attacks, to minimizing the impact \u2013 the damages to the organization and its people \u2013 of a successful cyber-attack.<\/p>\n

This is based on a number of underlying assumptions and guidelines:<\/p>\n

    \n
  1. You can\u2019t and shouldn\u2019t try to protect your network against all known vulnerabilities. You need a method of prioritizing threats and prioritizing their (often costly) corresponding mitigation measures.<\/li>\n
  2. There\u2019s no need to protect against an identified vulnerability if it had been deemed irrelevant to your industry and locale.<\/li>\n
  3. If a successful (debilitating) cyber-attack on a specific business unit (or Zone, as defined in IEC 62443) is expected to cause little or no damage, there\u2019s no point of mitigating its underlying threat.<\/li>\n
  4. How and what to protect depends in part on the user organization\u2019s preferences, including risk aversion, compliance status with various security standards, budget, etc.<\/li>\n
  5. Due to the sheer volume of variables involved (see next section) it is impossible and counter-productive to \u201ceyeball\u201d OT risk. There\u2019s an absolute need for an objective, dedicated risk assessment platform.<\/li>\n<\/ol>\n

    Model and inputs<\/strong><\/h2>\n

    Given the above, a network\u2019s total risk can be formulated as the aggregate of the impact of a successful attack on each business unit, weighted by probability of each such attack materializing.<\/p>\n

    \"\"<\/p>\n

    This equation relies on multiple inputs, both intrinsic and extrinsic to the OT network:<\/p>\n

    Intrinsic values:<\/h3>\n