On-Demand Webinar
OT Risks in Manufacturing: A conversation with Aberdeen Strategy & Research
Play Now
This webinar explores how to effectively communicate and quantify operational technology (OT) risk to senior leadership, moving beyond intuition and traditional "red/yellow/green" reporting.
The Importance of Quantifying OT Risk
- Context: Manufacturing environments are increasingly risky due to three converging trends: the disappearance of the air gap as OT/IT converge, the rapid advancement of AI used by attackers to chain vulnerabilities, and rising geopolitical threats leading to sabotage and supply chain disruption.
- Methodology: To provide concrete data for budget justification, speakers recommend using Monte Carlo modeling. This technique uses three primary factors—frequency of incidents, duration of downtime, and financial impact per unit of time—to generate a range of potential outcomes.
- Decision Making: While the entire range is valuable, senior leaders should focus on the "long tail" of the risk curve, specifically the 5% likelihood to exceed a certain value, as this represents the serious incidents that require business decisions.
Practical Strategies for Risk Reduction
When stakeholders ask how to mitigate identified risks, practitioners should frame solutions around the levers of frequency, duration, and implication:
- Reduce Frequency: Utilize a zero-trust architecture to hide the attack surface, eliminating VPNs and firewalls that attackers exploit to pivot into OT environments.
- Reduce Duration: Deploy decoys (honeypots) that mimic real OT systems. Because attackers cannot distinguish between real and decoy systems, tripping these "tripwires" significantly reduces dwell time by alerting the security operations center (SOC) to an intruder’s presence.
- Limit Implication: Implement granular network segmentation and monitoring to reduce the "blast radius" of an incident, allowing for the isolation of specific devices or production lines rather than shutting down an entire plant.
Expert Advice for Practitioners
- Keep Models Simple: Avoid the trap of excessive detail; focus on the most impactful factors according to the 80/20 rule.
- Embrace Numeracy: Technical professionals should cultivate their ability to work with numbers to communicate effectively in the language of business.
- Leverage Existing Resources: Professionals are encouraged to explore established frameworks like FAIR (Factor Analysis of Information Risk) and study resources from experts such as Jack Jones and Douglas Hubbard.
Speaker
 |
|
Umang Barman,
Senior Director, Product Marketing
Zscaler
|