Risk assessments
A complete map, the vulnerabilities, the attack scenarios, and a report the regulator can read.
What an assessment includes
The assessment maps every asset on the control network, identifies vulnerabilities and attack scenarios, and delivers an orderly report, usually for the regulator. I run it with tools I developed myself to query the controllers, stations and switches.
- Asset inventory: controllers (PLC and RTU), stations and servers, switches, firewalls and diodes
- Vulnerabilities, points of entry and attack scenarios
- Mitigation recommendations and a report for the regulator
- Work to NIST SP 800-82, NERC CIP and ISA99
Selected assessments
- ICL power stations, 2017 and 2018. A complete map of the control systems, assets, subsystems, switches, stations, servers, firewalls and diodes; the result was submitted to the regulator.
- EnerjiSA, Turkey, 2017: hydro-electric power stations. A wide risk assessment after cyber attacks on the plants, with a full map of the control network and its assets, the vulnerabilities, and where the attacks had come from.
- Delek, 2016. A risk assessment of the gas facility.