Practical 62443 Based Risk Assessment Exercise- OT Security

Explore a thermal power plant's critical infrastructure and assess its cyber security posture, from access control and HMI to SCADA and DCS, highlighting risks like open cabinets and exposed credentials.

Learn to apply UTL, MTL, and ETL in risk assessment by identifying threats, vulnerabilities, and impacts, applying countermeasures to reduce likelihood, and evaluating residual risk against tolerable risk.

Explore tolerable risk, CRF, and SLT concepts in risk assessment. Calculate CRF as current risk divided by tolerable risk and set the SLT target security level.

Explore the risk matrix, also called ram, a five by five tool that maps likelihood and impact for risk assessment, covering health, environment, financial, and reputation.

Learn to perform a practical, template-driven risk assessment from level zero architecture, mapping devices, threats, vulnerabilities, impacts, and mitigations with physical security controls and countermeasures.

Assess level one PLC risk by examining PLCs, RTUs, and UPS, identifying vulnerable Modbus communication, outdated firmware, and weak passwords, and evaluating high impact threats to process disruption and safety.

Leverage domain expertise and cross-functional input to assess an unmanaged level 1 network switch, identifying vulnerabilities and mitigations such as upgrading to a managed switch and enabling access control.

Assess level 1 NTP server risk by evaluating time server vulnerabilities, including outdated OS and unpatched software, remote code execution via RDP, and implementing firmware upgrades and network segmentation.

Explore level 2 HMI risk assessment, analyzing logging and monitoring vulnerabilities, audit trail gaps, and external disgruntled employee threats to inform mitigation with Purdue level vectors and risk guidance.

Assess level two historian risk by analyzing data integrity vulnerabilities, data tampering threats, and employing encryption, access controls, and integrity checks to protect historian data.

Apply level 3 EWS1&2 risk assessment to domain controller and engineering workstations, identify vulnerabilities like outdated OS and weak passwords, and implement patching and defensive mitigations.

Evaluate firewall two in level 3.5 architecture, noting high criticality and outdated IDS/IPS signatures, and mitigate by updating signatures, implementing a DMZ with multiple firewalls, and enforcing deny-by-default network configurations.

Form a clear risk assessment report using pivot tables to map unmitigated risk, MDL and SLT, identify top risks like firewall, and outline mitigation, residual risk, and action items.

Prioritize risks, assign action items, and implement mitigation strategies after the risk assessment, then maintain continuous monitoring, threat intelligence, and regular risk communication.