JANUARY: KNOW YOUR COMPANY
Beginning in January we shift for the rest of this book from a focus on your career to a focus on your company’s OT security and cyber risk management program.
A common mistake is to begin by selecting and deploying security controls. You find a standard or guideline or guru who has created a list of security controls that are recommended for OT. Almost all these controls have a rational, a purpose. They are not “wrong”.
However, they might not be what your company should be spending time and money on. We are not in a competition to see who can deploy and maintain the most security controls. Our job is to reduce OT cyber risk to an acceptable level for the company.
In January you will begin by understanding how your company defines and measures success, how your company performs risk management, the financial impact of Operations and OT outages, and the high consequence events in Operations and OT that your company needs to avoid.
There is nothing “cyber” in these weekly tasks. It’s all about understanding what your company is trying to achieve and trying to avoid. Knowing this will help you develop an OT security program that addresses your company’s risk. It will also help you communicate better and more persuasively with executives, engineers, finance, and other departments.
Week 1: Understand What Success Means In Your Company
It’s critical to know what your organization is trying to achieve and how success is measured if you are going to meaningfully contribute to cyber risk management decisions. This week’s task is to identify your organization’s most important 3 to 5 key mission...
Week 2: Identify And Understand Your Company’s Risk Management Process
Your company has been managing risk since its inception. OT cyber risk is not special. It’s one more risk, albeit often ignored until recently. One clear path to failure is to try to invent your own method for managing OT cyber risk that differs from your company’s...
Week 3: Understand The Financial Impact Of An Outage
This week’s task requires a discussion with the Finance department. Cybersecurity people in OT and IT often overestimate the financial impact of an outage. In one way, this is a good thing. It means the individual and team will work hard to avoid an outage because...
Week 4: Identify “The Really Bad Things” That Could Happen In Operations?
Many industrial processes can go bad in ways that cause catastrophic events. Loss of life. Severe property damage. Environmental disasters. If something gets too hot, spins too fast, mixes with the wrong chemicals, vibrates too much … BOOM! Your task this week is to...