APPARATUS AND METHOD FOR ASSIGNING CYBER-SECURITY RISK CONSEQUENCES IN INDUSTRIAL PROCESS CONTROL ENVIRONMENTS

摘要

A method includes identifying multiple devices or groups of devices in an industrial process control and automation system. The method also includes, for each device or group of devices, (i) obtaining impact values identifying potential effects of a failure or compromise of the device or group of devices due to one or more cyber-security risks and (ii) identifying a consequence value using the impact values. Multiple impact values associated with different categories of potential effects are obtained, and the consequence value identifies an overall effect of the failure or compromise of the device or group of devices.

主权项

1. A method comprising:
identifying multiple devices or groups of devices in an industrial process control and automation system; and for each device or group of devices:
obtaining impact values identifying potential effects of a failure or compromise of the device or group of devices due to one or more cyber-security risks, wherein multiple impact values associated with different categories of potential effects are obtained; andidentifying a consequence value using the impact values, the consequence value identifying an overall effect of the failure or compromise of the device or group of devices.