Overview
Via a technical vulnerability and risk assessment of OT infrastructure, SIS successfully assisted a gas operator to understand their current-state risk posture, in order to determine what an appropriate risk appetite (level) was for the organisation, and the prioritisation of mitigation actions, in order to reduce the level of risk exposure to cyber threats.
Challenge
In light of the emerging threat landscape, with increasing cyber security attacks targeting the oil and gas sector, the need to safeguard OT systems is paramount to operational continuity. A gas pipeline operator in the Middle East wanted to understand their exposure to potential attack, and how to improve the resilience of their critical infrastructure. The first step towards improving the security posture of their OT environment was to gain a thorough understanding of the organisation’s risk, in the context of cyber security.
Risk is a function of threats, impacts and vulnerabilities. Only with a good knowledge of the cyber security risk can the organisation make informed decisions on what should be the appropriate level of security protection. An understanding of cyber security risk is therefore a key driver towards determining where efforts should be focused to protect gas pipeline operations.
Solution
Via execution of a technical vulnerability and risk assessment of OT infrastructure, SIS successfully assisted the gas pipeline operator to understand their current-state risk posture in order to determine what an appropriate risk appetite (risk level) is, and the prioritisation of mitigation actions in order to reduce the level of risk exposure to cyber threats.
Vulnerability identification was determined by both automated and manual techniques.
SIS assessed the potential impacts and consequences to OT assets, should a vulnerability be exploited. From this, SIS developed a comprehensive industrial cyber security program for risk mitigation, and to ensure compliance to applicable industry regulations.
If you’d like to know more about our many years of experience in providing industrial cyber security solutions,