Impact Determination Exercise in Cyber Security Assessments of Industrial Automation and Control Systems

The demand for improving the cyber security of Industry Automation and Control Systems (IACS) is increasing significantly, and this increase causes a shortage of available security resources. In future more cyber security projects shall be made with less resources. For this reason, the efficiency of IACS cyber security projects is under constant pressure to be improved. One way of doing that is selecting the right target: paying more attention on the protection of impactful systems, where a lot can be protected with cyber security investments; and paying less attention on improving cyber security of systems with low impact. Priorities are not always obvious, and even at the first glance obvious priorities are sometimes misleading. The best way to have accurate and reliable information about the impact of a cyber security incident on a control system is having a certain level of understanding of the process and the role of the given system in that process. This research outlines an Impact Determination Exercise, which helps accurately estimate the possible impacts of an IACS cyber security incident by assessing the business process of a plant.