Cyber Security

With cyber risk growing in prevalence and sophistication, cyber security has become a necessity for commercial, industrial and even residential applications.  It has become necessary to protect our businesses, workplaces and our supply chains. While addressing the problem can seem daunting, many solutions are actually easy to deploy, have no negative impact on your operations and are inexpensive. Some simple measures can go along way toward managing your cyber risk exposure.

High profile cyber attacks are occurring with regularity in recent years with the Colonial Pipeline incident recently leading headlines. The majority of attacks are financially motivated. Less sophistication is required and there are many applications available on the dark web for purchase to disrupt the operations of industrial or commercial clients. An attacker does not need to know the inner workings of your business. All they know is that you would like to keep it running uninterrupted and you may pay a ransom to do so.

Cyber attacks are also conducted with the intention of causing societal disruptions. A water treatment facility in Florida was recently hacked with the intention of poisoning municipal drinking water. Nuclear facilities have been infiltrated and attacked with the intention of causing large scale destruction. While most of these headline grabbing attacks are either state actors or compromised employees with bad intention, many businesses handling dangerous materials or operating close to the public are at risk. 

Industries handling dangerous goods are often experienced with process risk management. Participants of process risk assessments may notice a significant portion of identified hazards originate from potential automated failures. Protection against automated failures are also likely automated since human intervention are often deemed less reliable or too slow. These common "hackable" points of failure require extra scrutiny to ensure automated systems are not compromised by hostile actors.

The first step on the road to a successful risk mitigation strategy is to document the current or future infrastructure design. When a philosophy is compared against the design, improvements can be quantified and digested at the management level for funding. Independent consultants can help provide insight on industry best practices and to help benchmark measures taken against industry peers.

Gap assessments can be applied to current infrastructure to plug any holes as a short term solution. Virus protection services are a useful part of a protection strategy as they can head off any vulnerability before the next assessment. 

Industry end-users are able to consolidate their well established process risk management activities with cyber risk management activities. By feeding this cyber risk data into internal work processes , synergies emerge. It is easier to manage change to automation infrastructure that has undergone a cyber risk assessment (i.e. CHAZOP). 

The need to manage cyber risk is getting the attention of industry risk management standards. IEC 61511-1 notes that cyber security measures are needed to ensure the communications of system instrumented systems are made secure.