OT Risk Assessment

Now that the frequency of cyberattacks on Operational Technology (OT) is increasing, securing your organization's OT environment is more important than ever. Adversaries use various methods to infiltrate networks and cause all kinds of financial damages: either directly by halting or slowing down production or indirectly through stealing and selling your organization’s trade secrets. To reduce the chances of a cyberattack, possible countermeasures must be identified and implemented. Not, or incorrectly, implementing these countermeasures is a risk for your organization.

Discover more about OT Risk Assessment:

1. Why would you do a risk assessment?
2. Why is an OT-tailored risk assessment necessary?
3. What does an OT risk assessment involve?
4. The QAROT methodology
5. The results of an assessment

Why conduct a risk assessment?

A cyber risk assessment assists in structurally determining which cyber risks are present in your environment. It is possible to understand the effectiveness of (existing) countermeasures only after explicitly identifying these risks. This, in turn, makes it possible to reason about new countermeasures, if they are needed, and their potential effectiveness. Furthermore, assessing the severity of the identified risks enables deciding on and prioritizing countermeasures and making an informed decision if the costs of implementing them weigh up against the potential consequences. Moreover, performing a risk assessment will create a complete overview of the strengths and weaknesses of your organization. This overview can, in turn, be used to improve preparedness during a cyberattack or prevent one by addressing the identified weaknesses.

Why is an OT-tailored risk assessment necessary?

What does an OT risk assessment involve?

Secura uses its own proprietary asset-driven risk assessment methodology named “Quantitatively Assessing Risk in Operational Technology” (QAROT). This methodology complies with IEC 62443-3-2 and incorporates the strengths of MITRE’s ATT&CK for ICS and ISO 31010. Combining these standards enables us to do risk assessments beyond just compliance. Together with our clients, we define the IEC 62443-3-2-required target security levels, on which we systematically base the assessment objectives. QAROT incorporates other standards from the IEC 62443 family, such as -3-3 and -4-2, to give coherent and actionable advice based on the fundamental security requirements that these standards describe. Furthermore, QAROT uses Secura’s publicly available Operational Technology Cyber Attack Database (OTCAD) when establishing the severity of identified risks.

The QAROT methodology

QAROT uses a top-down approach to identifying and assessing risks: it derives applicable countermeasures by considering all assets within an OT environment. These countermeasures are based on ATT&CK for ICS and are combined with IEC 62443-3-3 and -4-2 to objectively assess their implementation and effectiveness within the system under consideration. This combination allows Secura to structurally identify potential shortcomings and the risks that they pose. The assessment starts by creating a zone & conduit diagram based on the organization’s network drawings and asset inventory. The diagram contents are discussed together with the client during a workshop to ensure that they correctly represent the assessed environment. In consecutive workshops, we determine together with our client the impact of possible adversary goals, and we establish the achieved security levels of an existing asset- and zone/conduit-based countermeasures.

The result of an OT Risk Assessment

For each of the shortcomings identified during these workshops, Secura will provide tailored and actionable advice on how to address them. Through QAROT’s proprietary calculations, the identified risks are quantitatively scored and ranked, which helps in the comparison and prioritization. Moreover, using IEC 62443’s fundamental requirements, the sufficiently implemented mitigations are categorized so the client can quickly see compliance within different cybersecurity areas. We deliver these overviews, the identified risks, including our recommendations, and a follow-up plan in a report which we will present in a close-out meeting.

Interested in an OT Risk Assessment at your company?

We are happy to discuss how we can help you the best. You can contact us via the contact form, by telephone at +31 (0) 88 888 31 00, or by email at info@secura.com.

IEC 62443 Series of Standards