Governance & Risk Management
,
Risk Assessments
Why OT Security Comes Down to Risk Tolerance, Not Perfect Defense
Operational technology security often feels like an immovable object. We are told to “secure the plant,” but when faced with legacy controllers, proprietary protocols and 24/7 uptime requirements, the task feels less like a project and more like an impossible mountain to climb.
See Also: AI Impersonation Is the New Arms Race—Is Your Workforce Ready?
The secret to moving forward isn’t finding a silver bullet technology; it’s evolving your mindset. To simplify OT security, we must stop viewing it as a quest for “complete security” and start viewing it as the strategic management of risk.
The Myth of Zero Risk
The hard truth is you will never be free from cyber risk. In industrial environments, the only way to have zero risk is to have zero operations. If you have a wire, a wireless signal or a human with a USB drive, you have a threat vector. Once you accept that risk is a permanent resident in your facility, the goal moves from impossible – eliminating threats, to the practical – reducing risk to a level your business can live with.
To simplify our approach to security, we need to speak the language of risk. There are three pillars to this framework:
- Risk Assessment: What could go wrong, and how bad would it be?
- Risk Tolerance: How much “bad” can we handle before we fail?
- Risk Acceptance: Which risks are we choosing to live with right now?
Risk Assessment: It Starts With Visibility
“You cannot protect what you cannot see” is a phrase we are often met with in security. Where it comes from is our need to understand risk before we can go on the path to mitigate it. Risk assessment is the process of identifying the security posture of your assets and estimating the magnitude of harm to your operations, assets, reputation or people.
In OT, this requires granular, accurate visibility. You need to know more than just “there is a PLC on the floor.” You need the vendor and model numbers to determine what exploits an attacker could run against your operations. You need the firmware version, operating system and software revisions to determine if those vulnerabilities apply to you or if the devices are running the latest security patches. You need to understand the behavior of these assets, what relationships they have with each other and detection capabilities for behavioral change. Assessing risk is not a one-and-done checkbox. It is a continuous operation that should keep you informed if new and more pressing risks have been identified.
Defining Your Risk Tolerance
Risk tolerance is the amount of pain an organization is willing to endure to achieve its objectives. This is where OT security becomes a business decision rather than just a technical one.
Different processes have different “breaking points.” For example:
- Process A: A non-critical packaging line might have a recovery time objective of five hours.
- Process B: A high-pressure chemical reactor might have a tolerance of only five minutes before a safety incident occurs.
By determining tolerances around data loss, financial impact and recovery timeframes, you can clearly define what constitutes a “minor incident” versus a “major catastrophe.”
Cybersecurity is essentially about reducing risk until it fits inside your risk tolerance. If your assessment shows a risk that exceeds your tolerance, you mitigate. If the residual risk aligns with your tolerance, you’re done for now. The goal is to reach a state where, if an exploit occurs, your business is resilient enough to tolerate the outcome.
Making the Call: Risk Acceptance
Risk acceptance is the decision to knowingly retain a level of risk without immediate mitigation. We do this for two reasons:
- The risk is already within our tolerance. For instance, a minor data leak of non-sensitive info.
- The cost of mitigation far outweighs the likelihood of the attack.
What is important to understand for security architects – risk acceptance is not forever. The level of risk you accept today might be unacceptable 12 months from now. By using time-bound acceptance, you can build a multi-phase road map. You might accept the risk of an unpatched legacy human-machine interface that cannot be touched until the next maintenance window, while you focus on the more pressing threat of an unprotected remote access point giving unrestrained and undefined access to the entire production network. This prevents “security paralysis” by allowing you to prioritize the “big wins” first.
Putting it Into Practice: The Microsegmentation Journey
Segmentation is the perfect example of this phased approach. While microsegmentation is the gold standard, it is operationally complex and resource-heavy. In IT environments, segmentation is disruptive but recoverable. In OT, the stakes are fundamentally different.
Before you can segment anything, you need to understand what is communicating with what, and in operational networks that visibility is rarely there from the start. Add to that the sheer diversity of legacy devices that were never designed with security in mind and the ever-present constraint that you cannot afford to take a production line offline to find out whether your policy changes work. That combination – incomplete visibility, aging infrastructure and zero tolerance for disruption – is what stalls our segmentation projects in OT.
Instead of getting overwhelmed, use the visibility gained during your risk assessment to take a milestone-based approach:
- Phase 1: Strengthen your macro-boundaries. This could be building to building, or production line to production line. Find your easiest point of insertion.
- Phase 2: Accept the risk that each macro boundary will remain “flat” for the next sprint while you gather traffic patterns.
- Phase 3: Choose a single macro segment and divide it into further chunks. Let the risk assessment determine your riskiest zone and start there.
- Phase 4: Expand.
By breaking the problem down, you turn a daunting project into a manageable journey. You aren’t “ignoring” the rest of the network; you are accepting the risk of the remaining segments temporarily while you focus your limited resources where they matter most.
The challenges of microsegmentation in OT environments are real, but here is what experience shows: It can be done. Securing an OT network doesn’t require a total system overhaul overnight. It requires the discipline to assess your assets continuously, the honesty to define your tolerances and the strategic patience to mitigate risks in phases.
Security is a journey, not a destination. And that journey will be a little different for everyone, but the core principles remain consistent. By leveraging visibility and managing risk acceptance, you can stop reacting to every threat and start building a resilient, defensible operation.