A risk assessment example

We are going to take the assessment approach, explained in the previous section and explore some details by applying it step by step to a fictive system under consideration. Let's imagine that the Slumbertown Mill from the previous chapter decided to hire a security consultant to help them assess and address risk to their ICS network. After outlining contractual details such as scope, timelines and deliverables, a security consultant will typically plan a site visit to start gathering information needed to complete the assessment.

Step 1 - Asset identification and system characterization

The onsite security consultant will normally start with consulting existing documentation such as...