Cyber Risk

Cyber risk is the possibility that an Industrial Automation and Control System (IACS) will be compromised through unauthorised access, use, modification, disruption or destruction, resulting in adverse consequences to operations, personnel safety, the environment or the organisation.

Unlike traditional IT systems, cyber incidents within industrial environments can have real-world physical consequences, including production outages, equipment damage, environmental harm and safety incidents. Understanding cyber risk enables organisations to implement appropriate security controls and make informed business decisions.

Cyber Risk Summary — Cyber Risk overview for Industrial Automation and Control Systems.

Understanding Cyber Risk

Cyber risk is determined by three primary factors:

Threat – Something capable of causing harm.
Vulnerability – A weakness that may be exploited.
Consequence – The impact if exploitation is successful.

Risk = Threat × Vulnerability × Consequence

Risk increases whenever any one of these three factors increases. Reducing threats, removing vulnerabilities, or limiting consequences all contribute to lowering overall cyber risk.

Threat

A threat is any person, event or circumstance capable of causing harm to an Industrial Automation and Control System.

Examples include:

Cyber criminals
Nation-state actors
Malicious insiders
Disgruntled employees
Malware and ransomware
Natural disasters

Vulnerability

A vulnerability is a weakness that could be exploited by a threat actor.

Examples include:

Unpatched PLC firmware
Default passwords
Flat network architectures
Legacy operating systems
Unused services
Poor remote access controls

Consequence

Consequences describe the impact if a vulnerability is successfully exploited.

Potential impacts include:

Loss of production
Equipment damage
Personnel injury
Environmental incidents
Regulatory penalties
Financial losses
Reputational damage

Reducing any one of the three components—Threat, Vulnerability or Consequence—reduces the overall level of cyber risk.

Risk Tolerance

Risk tolerance is the level of cyber risk that an organisation is willing to accept in pursuit of its business objectives.

It is established by management and balances:

Security objectives
Operational requirements
Safety obligations
Regulatory compliance
Cost of mitigation
Potential business impact

Risk tolerance determines which risks require treatment and which risks may be accepted and monitored.

Cyber Risk Assessment

A cyber risk assessment identifies, analyses and evaluates cyber risks to determine appropriate security controls.

Typical Process

Identify assets.
Identify threats.
Identify vulnerabilities.
Assess likelihood.
Assess consequences.
Determine the risk level.
Select appropriate risk treatment.
Review residual risk and monitor continuously.

Risk assessments should be repeated whenever significant changes occur within the IACS, including network modifications, software upgrades or new equipment installations.

Risk Treatment Strategies

Strategy	Purpose	Typical Application
Avoid	Eliminate the source of the risk.	High likelihood / High consequence risks.
Transfer	Transfer financial or operational responsibility.	Low likelihood / High consequence risks.
Reduce (Mitigate)	Lower the likelihood or consequences.	Most industrial cybersecurity risks.
Accept	Retain and monitor the risk.	Low likelihood / Low consequence risks.

1. Avoid

Avoidance removes the source of the risk entirely.

Redesign system architecture.
Remove vulnerable technologies.
Disable unnecessary services.
Change operational procedures.

2. Transfer

Transfer shifts responsibility for managing the consequences of a cyber incident to another party.

Cyber insurance.
Managed Security Service Providers (MSSPs).
Third-party support agreements.
Contractual risk allocation.

Risk transfer does not eliminate cyber risk; it simply reallocates responsibility.

3. Reduce (Mitigate)

Mitigation is the most common strategy in Industrial Automation and Control Systems.

Common controls include:

Security patch management.
Industrial firewalls.
Network segmentation.
Role-based access control.
Multi-Factor Authentication (MFA).
Continuous monitoring.
System hardening.
Application whitelisting.
Security awareness training.
Vulnerability management.

4. Accept

Risk acceptance is a conscious management decision that further mitigation is not currently justified.

Acceptance requires:

Management approval.
Documented justification.
Ongoing monitoring.
Contingency planning.

Accepted risks should be reviewed periodically as threats, vulnerabilities and business priorities change.

Engineering Perspective

Industrial organisations rarely eliminate every cyber risk. Instead, they aim to reduce risk to an acceptable level while maintaining operational availability, safety and business continuity.

Examples include:

A legacy PLC that cannot be patched is protected using industrial firewalls and network segmentation.
Engineering workstations have internet access removed to eliminate unnecessary attack vectors.
Remote access is secured using VPNs, Multi-Factor Authentication and approval workflows.
Cyber insurance reduces the financial consequences of major cyber incidents.

Effective cyber risk management balances security, operational availability, safety, regulatory compliance and implementation cost.

Key Takeaways

Risk = Threat × Vulnerability × Consequence.
Risk assessments identify threats, vulnerabilities and appropriate security controls.
Risk tolerance defines the level of cyber risk an organisation is willing to accept.
The four risk treatment strategies are:
- Avoid – Eliminate the risk.
- Transfer – Shift responsibility.
- Reduce – Implement controls to lower risk.
- Accept – Retain and monitor the risk.
Cyber risk can rarely be eliminated completely. The objective is to reduce it to an acceptable level while maintaining safe and reliable industrial operations.