Featured Image

Building an Advanced Cybersecurity Plan: Risk Assessment and Vulnerabilities Testing

Any cybersecurity implementation involves a trade-off between a company’s tolerance for risk and the effort and costs associated with protecting the company’s resources and customers. Learn how to assess risk and test for vulnerabilities in your network.
Jan 26, 2023

Any cybersecurity implementation involves a trade-off between a company’s tolerance for risk represented by a security attack and the effort and costs associated with protecting the company’s resources, reputation, customers, and personnel.

One of the most valuable network design concepts implemented as part of an advanced cybersecurity plan is segmenting the network into discrete functional areas or processes. This typically goes beyond separating the IT portions of the network (office) and the OT portions of the network (manufacturing operations) – portions of either network environment may be more risk tolerant than others. When this architecture is implemented, security tools can then be effectively implemented to control access and the flow of information across the boundaries between segments. Separate unique risk assessments can then be defined for each network segment – applying the appropriate level of effort and cost for each network segment.

A company’s cybersecurity plan should include a variety of approaches for testing network security vulnerabilities. Software tools for testing vulnerabilities should include:

  • Tests for the effectiveness of access control to the network (internal and external) and across network boundaries

  • Identification of equipment added/removed from the network

  • Identification of software added to the network or equipment attached to the network

  • Tests that evaluate the effectiveness of tools used to detect infected software

  • Tests to evaluate personnel response to suspicious emails and internet sites

  • Tests to assess personnel response to various types of network security breaches

Other tests may also be appropriate depending on the requirements of individual companies. Additionally, vulnerability testing should include manual actions intended to stress other functions associated with network security – detection of unauthorized access to network equipment, detection to determine when unauthorized equipment is connected to the network, test system response when key pieces of equipment are removed from the network, etc.

Any vulnerabilities detected should be identified as an incident and addressed as part of the network maintenance and incident response procedures defined in the company’s cybersecurity plan.

Vulnerabilities testing is typically reviewed and assessed for effectiveness when first implemented. However, it is important to periodically re-assess the vulnerabilities testing portion of an advanced cybersecurity plan and the tools implemented to ensure all practices, procedures, and tools effectively address all current types of security threats. Any process, procedure, or software/hardware found insufficient should be upgraded/replaced as soon as possible.

Periodic reviews should also evaluate whether the original risk assessment applicable to each network segment is still valid, or if the implementation needs to be upgraded for specific portions of the network architecture.

Each assessment and each periodic review should be fully documented and reviewed by management with oversight responsibility to ensure that the security plan is implemented and functioning as intended.

For more details on addressing maintenance and incident response relative to cybersecurity, you may want to reference Section 3.11 Risk Assessment and Section 3.12 Security Assessment of NIST standard SP 800-171.


For more on this topic, we invite you to explore the Building an Advanced Cybersecurity Plan article series.

Part 1: Engagement and Reinforcement

Part 2: Interaction Mapping

Part 3: Access Control

Part 4: Electronic Media Protection

Part 5: Identification and Authentication

Part 6: Activity Logging, Auditing, and Traceability

Part 7: Network Resource Configuration Management

Part 8: Communications, Network, and Database Security 

Part 9: Personnel and Infrastructure Security

Part 10: Maintenance and Incident Response

Part 11: Risk Assessment and Vulnerabilities Testing

PicturePicture
Author
John Turner
Director of Technology for FA Consulting & Technology (FAC&T) and member of the MTConnect Institute.
Recent technology News
The internet opens a whole new way to think about data sources, raising concerns about network security and data validity. Learn about the two major ways to access such data: accessed and transferred in bulk for storage; and accessed on demand.
Remember the old adage: "Garbage in" equals "garbage out." But is the data you collect good? Learn more about measured and processed manufacturing data, how they form the foundation of all digital manufacturing systems, and strategies to ensure quality.
Many companies collect data from their manufacturing operations to increase productivity and improve shop operations. Others do so as part of a contractual obligation to their customers.
While it might seem that pursuing ER&D during a downturn would be unsustainable, it is actually a sensible approach. Let’s face it: When you’re busy, you’re not likely to have your people do anything other than focus on their main tasks.
Data collection and storage is the process of gathering, arranging, and making data available for analytics. Since data quality is vital, companies must decide what should be collected and stored using newer tech like data lakes and cloud storage.
Similar News
undefined
Technology
By John Turner | Sep 22, 2023

The internet opens a whole new way to think about data sources, raising concerns about network security and data validity. Learn about the two major ways to access such data: accessed and transferred in bulk for storage; and accessed on demand.

4 min
undefined
Technology
By Benjamin Moses | Aug 29, 2023

Episode 101: Ben and Steve discuss the precision and accuracy of “just eyeballin’ it” and torque wrench etiquette. Benjamin gets in-depth on cold spray additive manufacturing.

20 min
undefined
Technology
By Bonnie Gurney | Sep 12, 2023

Registration has opened for IMTS 2024 – The International Manufacturing Technology Show, taking place Sept. 9-14 at McCormick Place in Chicago.

5 min