Critical Infrastructure Security
,
Governance & Risk Management
,
Operational Technology (OT)
System Meant to Dispel FUD Faces Uphill Climb to Widespread Adoption
Hurricanes, tornados, earthquakes – and now operational technology cyber incidents – all can receive a numerical score based on their severity, although a new effort promoting an “OT Incident Impact Score” across critical infrastructure sectors faces an uphill climb to get the traction it needs to succeed.
See Also: From Ancient Myths to Modern Threats: Securing the Transition from Legacy to Leading Edge
Score backers say the system is meant to dispel the fear, uncertainty, doubt and threat inflation that surrounds cyberattacks impacting OT systems, which are often poorly understood and mischaracterized.
“We desperately need better ways to communicate [OT] cyber incident severity to non-technical audiences,” said Munish Walther-Puri, head of critical infrastructure at TPO Group and a member of the faculty at IANS Research. He came up with the idea of an impact score based on the model of the earthquake Richter scale, but employing peer review and drawing from the systems used to measure the severity of wildfires and hurricanes.
Poor understanding of the severity of OT attacks has real consequences, consultant and OT security community leader Dale Peterson told Information Security Media Group. “You’re talking about the misallocation of resources and attention,” when attacks of little consequence get disproportionate headlines, he said.
Peterson helped bring Walter-Puri’s idea a step closer to life last week, rolling out a proof of concept website where OT security professionals could score three historic OT attacks, rating each of them from one to 10 on three axes: severity, reach and duration. All the participants’ scores, with outliers stripped away, are averaged to provide an overall impact score for the incident.
“We wanted to make it simple to use, for the professionals doing the scoring, and simple to interpret,” for journalists, policymakers and the general public, explained Peterson. As a result, the scoring methodology eschews the logarithmic progression of the Richter scale in favor of a more linear scale. “This is for your mother, your neighbor, your elected official, the media, so that they can quickly understand the impact of an attack,” he said.
Some OT and ICS security experts agreed there exists an urgent need for a way to provide a credible, transparent and immediate assessment of the severity of OT incidents.
“This is a great first step. I would call it a leap,” Kam Chumley-Soltani, the managing director for OT security at cyber exposure management and security company Armis. He said the community would need to work to improve the initial version, “Like everything, it’s going to be dynamic … and as the community starts to digest the information and understand it, the impact scoring [methodology] will develop, but overall, awesome.”
Others are more cautious, welcoming the initiative, but highlighting the challenges. “In the early hours and days after an incident, when this scoring is really needed, reliable information may be hard to come by,” even for experts, said Kyle Miller, vice president of infrastructure cybersecurity in the commercial business division of technology provider Booz Allen Hamilton.
“Oftentimes when an organization is impacted by an OT event, they aren’t quick to publicize the full extent of the impact,” Miller added. Even if details are known, that severity and reach can be measured; by definition, duration won’t be clear except in retrospect, he pointed out.
The use of crowdsourcing means the impact scoring initiative “will require the right level of adoption from the community before it can be relied upon,” which could be a potential stumbling block, he added.
“That all being said,” Miller concluded, “the scoring methodology seems to be a step in the right direction by focusing on the true impact of OT incidents.”
Peterson said a scoring system website will soon go live for the public. He said he wanted the first scores to be available within 12 hours of an incident, and hoped that contributors will revise their initial scores as more information emerges.
There were “a couple of hundred” OT cyber incidents last year, he said, and will probably be a similar number this year. It is important to score minor events to ensure they didn’t get disproportionate attention, he said. “A lot of them are very simple non-events, but those are almost the more important ones to score, because those are the ones that get mischaracterized,” he explained.
For the purposes of the Impact Score, an OT security incident is “one where OT is impacted,” Peterson said, even if indirectly. An incident at a factory that must shut down because the company’s IT system is paralyzed by ransomware would count. “We would consider that an incident, at least for now,” he said, adding the incident scoring system was a work in progress.
“I expect there will be some changes over time,” he said, adding “Typically when these things work, these projects that we’ve helped put out, a couple of people step in and take leadership roles, and I expect we’ll get some people to do that.”
Peterson hopes to establish a small group of 10 or so super-users – individuals with a depth of expertise, length of experience or level of commitment that distinguishes them – who can nominate incidents for inclusion on the site.
Those super-users, and others who rate incidents regularly and in line with community consensus scores, might also eventually have their scores weighted to give them more influence over the final number, Dan Ricci told ISMG.
Ricci is founder of the ICS Advisory Project, which provides vulnerability management tools for small and medium-sized OT asset owners. It is hosting the Impact Score website and scoring system for the time being.
Some OT security experts said the impact score needed to be more ambitious.
Sean Tufts, field CTO for cyber-physical security vendor Claroty, told ISMG he hoped the impact scoring system will evolve so it can assess “near misses,” as well. He gave as an example the Volt Typhoon campaign revealed by U.S. and allied agencies in 2024 – a Chinese threat actor prepositioning in the IT networks of U.S. critical infrastructure providers, according to U.S. intelligence, “to enable lateral movement to OT assets to disrupt functions.”
“The severity and duration of Volt Typhoon would both score zero,” Tufts said, yet North American energy companies spent months remediating the penetration. Volt Typhoon was an example of an OT-related or adjacent cyber incident which got much less attention than it deserved, he said. “The attack was, in many ways, more impactful than other, smaller, successful attacks. The most dangerous incidents in OT security are the near misses, and right now, we have no way to rank those at all.”