Risky Business: Unfocused Cybersecurity Risk Management

Organizations must use a targeted cybersecurity risk management approach to safeguard assets and mitigate risks.

One of the many hallmarks of evolving industrial automation practices is increasing efficiency. In the earlier days of process automation, maintenance could be described as operating on a break/fix model. In other words, labor hours and funds for repairing field instrumentation and controls equipment would be loosely based on previous history and the current operational state of the equipment. A company might portion a certain amount of money for repairs based on the amount spent for the previous year, with or without an adjustment for inflation.

One of the lesser-known issues in the past with the break/fix model is the possibility of spending more on maintenance over time than the replacement cost of the part or system. Before long, companies began understanding how this break/fix model could possibly cause inadvertent expenditures and even loss of efficiency. A risk management model applied to maintenance can look at the total cost of ownership through the lifecycle of a system or field instrument.

Just as facilities in the chemical process industries (CPI) implement asset integrity management programs to improve maintenance planning and plant uptime, cybersecurity should be similarly prioritized. Facilities must strive to move from a reactive cybersecurity approach — in which patches and training are implemented only after a cyber incident — to a proactive risk reduction model. It is of paramount importance to protect sensitive information and reduce the risk of cyberattacks, thereby ensuring the safety, security, privacy, and trustworthiness of digital networks, information technology/operational technology (IT/OT) systems, and the individuals or organizations that rely on them.

This article reviews some of the issues associated with unfocused cybersecurity risk management, and discusses the value of cybersecurity risk management and its place as a leading enterprise solution. Finally, the article provides recommendations for focusing your company’s risk management strategy...