Approach to Identify Consequences of Cyber Vulnerabilities

No ratings

Presented at ICScybersecCon 2014 by

Eric Cosman

Not all vulnerabilities are created equal. In planning the response to an announced vulnerability in ICS related products and technology it is first and perhaps most important to understand the full implications associated with having this vulnerability. This requires consideration of the other two major components of risk; threat and consequence. In most cases it is the Asset Owner who is in the best position to assess potential consequence, and it is this assessment that must be a leading factor in determining the timeliness and degree of response. This session will use a couple of simple examples to illustrate this approach.