Industrial Internet Security Framework v 1.0 | Page 30

Security Framework 5: Managing Risk standards. IIoT risk assessments are unique in that they include physical consequences of errors and attacks as well as classic information systems risk. The most commonly discussed threats come from malicious attackers who wish to disrupt a system, steal information or cause harm or fear, but even an adequately secured system must account for failures in the operating environment, such as extreme environmental or weather conditions. The term threat, then, should be interpreted broadly to include any influence or incident that would interfere with the normal, intended use of the underlying system. While it is not practical to anticipate every possible threat, a strong security model that contemplates broad changes in the operating environment can mitigate the impact of many unplanned situations. Identifying threats and consequences requires an understanding of the overall system and its implementation. The elements of the IIoT system exposed to possible attacks are called its attack surface. Growth in the number of technologies and increased complexity both increase the attack surface and vulnerabilities of the system, increasing risk. Each of these elements may be vulnerable via an attack vector, a mechanism by which an attack can take place. Attack vectors include physical attacks, networks attacks, attacks against software, attacks on operators and attacks on the supply chains of the elements that comprise the system. Each industry has a specific set of attack vectors, as does each class of technology. The impact of each type of attack depends on the system’s industry, design and business priorities. Practitioners carrying out risk assessments should consider physical consequences of threats related to safety and the consequences of tampering with physical control equipment, as well as threats to analog and digital control systems. The existence of some physical components may increase the attack surface by being more susceptible to tampering. For example, equipment exposed to the public has a greater attack surface than equipment behind security perimeters at dedicated industrial sites. Moreover, digital systems designed to prevent equipment damage or injury to workers will warrant increased attention in the risk assessment process, especially when safety risks are not mitigated with additional physical protections. Physical safety systems may mitigate some attacks. Examples include over-pressure valves, flare stacks, berms and containment systems. Some of the work of assessing the effectiveness of these physical safety systems in light of attack scenarios may already have been carried out as part of the system’s safety engineering assessment. Modern attacks span a wide range of possible means and motives. Approaches to enumerate cyber threats and attack methods include lists of attack vectors such as OWASP, or the STRIDE threat identification approach and threat modeling. IIC:PUB:G4:V1.0:PB:20160926 - 30 -