Close the attack path
- Segmentation into zones and conduits
- MFA and individual identity
- Continuous OT monitoring
- Physical port and removable media control
- Elimination of wireless and 4G
- Secure protocol gateway
Case · Water and sanitation
Unacceptable risk reduced to zero without replacing the installed automation base
OT/ICS Risk Assessment at two water treatment plants and the operational control center of a water and sanitation company. Anonymized data.
Vulnerability is not risk
The central question of the Risk Assessment is not which vulnerabilities exist, but what physically happens to the process if an automation function is compromised. It is the adaptation of established process risk analysis techniques, such as HAZOP and LOPA, to the cyber domain: the Cyber-PHA of ISA/IEC 62443-3-2.
The vulnerability scan still exists, but it serves as evidence for likelihood, not as the final result. Priority is now defined by physical impact, in a language the board understands.
Scope
What was assessed
2 water treatment plants, plus the operational control center
26 automation functions, from the PLC to the MQTT broker
96 risk scenarios assessed
208 assets inventoried, 40 of them OT
Evidence
Three sources feed the likelihood of each function
- Asset inventory: 208 assets identified, 40 of them OT, including 29 PLCs and 3 HMIs, by Purdue level, firmware and rack/slot. Passive collection, without touching the process.
- Vulnerabilities: 20 assets with unpatched CVEs, 10 at end of life, 4 with multiple network interfaces and USB connected on 3.
- NIST SP 800-82 · CSET: 102 gaps ranked by SAL: 41% of the questions met and 24% not met.
Likelihood Vulnerabilities NIST · CSET Inventory
Methodology
Five steps, two workshops
- 01
Scope and stakeholders
System under consideration, zones, conduits, specialists and those responsible for acceptance.
- 02
Reference threat actor
Profile from TA1 to TA5, approved by consensus, without underestimating or inflating the risk.
- 03
Functions and consequences
Automation functions by Purdue level and consequences identified through guiding questions.
- 04
Severity and likelihood
Severity without defenses in four dimensions and likelihood by an objective rubric.
- 05
Risk, controls and residual risk
Risk register, controls linked to ISA/IEC 62443-3-3 and recalculation of the residual risk.
How risk is measured
Severity × likelihood, from 1 to 25
| Risk range | Classification | What to do |
|---|---|---|
| 17 to 25 | Unacceptable | Immediate action; cannot be accepted |
| 9 to 16 | Conditionally tolerable | Documented controls with a deadline |
| 1 to 8 | Acceptable | Monitor, no mandatory action |
Likelihood by equipment category: attractiveness 15%, capability 25%, exposure 35% and defense 25%. Severity is assessed as if no controls existed, and the criticality of each function comes from its worst scenario.
Result
Before and after the controls
The chosen reference actor was TA3: organized crime with knowledge of industrial systems, the most likely for the sector. Plant A had 8 unacceptable scenarios, with a risk of 20 out of 25.
20 highest risk at plant A before the controls; afterwards, 10
16 highest risk at plant B before the controls; afterwards, 4
0 unacceptable scenarios after the controls
15 controls prioritized by protection value
At plant A, 14 scenarios were awaiting data and were left out of the comparison.
Controls
15 controls by protection value
Each control was linked to the system requirements of ISA/IEC 62443-3-3 and to the target security level (SL-T), separating what is configuration from what is acquisition. The sequence matters: segmentation first.
Directly reduce the likelihood
- Jump server in an industrial DMZ
- Temporary credentials for third parties
- TLS and authentication on the MQTT broker
- Per-topic ACL on MQTT
- Vulnerability management
- Formal change control
- Least privilege in the supervisory system
- Assisted manual operation
Shorten the downtime
- Verified backup and recovery plan
Target architecture
From the current topology to the target architecture
Process data leaves IT
SCADA servers, SCADA Mobile and the MQTT broker leave the corporate data center and move to the industrial network.
A DMZ that terminates and reopens
The industrial DMZ now breaks every connection, with an MQTT relay, a SCADA Mobile proxy and patch/antivirus.
Remote access in two hops
Central access in the DMZ and local access in the industrial network; third parties no longer reach the OT network directly.
Detection with IDS and SPAN
Industrial IDS with traffic mirroring on the control switch, to see what cannot be seen today.
Deliverables
What the company received
Diagnosis
Plan
Architecture
Want to measure the cyber risk of your process?
The Risk Assessment starts with a scoping meeting with the automation coordination team.
- Free diagnostic
- Fast response
- Personalized service
Updated on