Continuous Monitoring of OT Key Risk Indicators (KRIs)

Applying a Data-Driven approach

In this article I propose that in order to answer the above questions, we need to use a data-driven approach which combines OT breach attack simulation (OT-BAS) with statistical simulation techniques.

By using virtual OT-BAS we are able to obtain data points on system vulnerability, i.e., Threat Capability and Resistance Strength on a specific production system under consideration (SUC), not just generic information. And combining breach attack and statistical simulations de-facto applies a data-driven approach of entering values into statistical simulation tools instead of “guesstimating”.

Using the above approach, we can reduce our input variance on threat actor capabilities and resistance strength and thus narrow down the value range of risk we get as an output.

For example, I’ll use the FAIR-U tool on a Phishing database breach scenario supplied with the tool.

For the purpose of this post, I won’t change the Loss Magnitude (ML) side, and only concentrate on the left side, Loss Event Frequency (LEF).

Our starting-point: Using common sense (I hope my sense is common), with no “prior” information on what values to enter i.e., the “guesstimate” methodology.

The initial values I entered are: 50/50 on threat capability, 50/50 on probability of action, 40-60-80% on resistance strength, and [1-2-4] on Contact frequency.

As you can see in the chart below, the starting-point LEF looks good, with values in the tolerable risk area.

I’ll run the same statistical simulations with values from an OT-BAS simulation.
After entering the resistance strength and threat capability (TI), taking into account the security level achieved (SLA) at the site, the digital image, and the relevant threat intelligence, the resulting risk values now look very different, and not for the better.

Continuous Risk Monitoring

In today’s everchanging environment, an annual risk assessment is no longer sufficient. To continually monitor LEF as threat landscape and vulnerabilities change, we need to continuously monitor key risk indicators (KRIs) to alert us of changes.

The IOR institute defines KRIs (Key Risk Indicators) as metrics that provide information on the level of exposure to a given operational risk which the organization has at a particular point in time.

KRIs are an early warning system of changes in our threat landscape and system vulnerabilities, which provide the needed time to proactively address changes in our risk posture.

Using the changes in these KRIs, we re-run our OT-BAS and enter the new values from the OT-BAS in our risk registrar using a statistical simulation tool for the probability ranges.

In order to continuously track changes in LEF, we recommend assigning KRIs (key risk indicators) to TEF and vulnerabilities, in particular probability of action, threat capability and resistance strength.

Example KRIs for LEF:

TEF KRIs: “How many times will the asset face a threat action?”

• Geolocation
• Industrial sector
• Active adversaries
• Adversary capability and ATT

Vulnerability KRIs: “What percentage of threat events are likely to result in loss events”

• Production functionality and topology
• Distribution of security controls
• Possible threat scenarios causing a loss
• Connectivity, interdependencies
• Escalation and propagation of a loss scenario
• Vulnerabilities in system and procedures

Use the OT-BAS to determine and prioritize “Key” Indicators

It’s important to note that KRIs scores are dynamic. They may not be as frequent as EPS to a SIEM, but KRIs alerts need to be timely to identify the shift in risk posture and give us the needed time to adjust our defenses.

Changes to a KRI signal a change in the level of risk exposure associated with specific processes and activities. Thus, KRIs are pro-active metrics used by organizations to provide an early signal of increasing risk exposures in various areas of the enterprise.

We recommend the following work flow:

1. Understand TEF
2. Understand Vulnerability
3. Understand if a threat event scenario’s is a loss scenario
4. Address only scenarios that cause loss
5. Use KRIs for each loss threat category – no more than 5 KRIs.
6. Monitor changes in the KRIs and re-evaluate risk for each such change

Example of Risk registrar with KRIs

KRIs are added to the risk registrar to pro-actively recommend mitigation controllers that would reduce the risk before a loss event happens.

Below is an example of the extended risk registrar with quantitate values to address LEF.

So next time when we are challenged by the “head-scratcher” Loss Event Frequency, we recommend a data driven approach using statistical tools such a FAIR-U and to add data points that are derived from simulated breach attack simulation on your specific production environment, thus reducing the ranges of inputs for the statistical calculation.