Cybersecurity risk assessment and mitigation for industrial control systems

A computer-implemented method, comprising:

• generating a knowledge graph that defines at least a portion of a network topology for an industrial control system, wherein the knowledge graph defines nodes associated with the set of industrial assets of the industrial control system and links associated with network connections of the industrial control system;
• monitoring network traffic broadcasted to a set of industrial assets of the industrial control system to generate industrial asset data associated with the set of industrial assets;
• in response to a detection of a change in the industrial control system based on the network traffic, scanning the knowledge graph to determine modeled network topology information for the industrial control system;
• determining a set of asset descriptors respectively describing an industrial asset from the set of industrial assets based on the modeled network topology information;
• correlating, based on the set of asset descriptors, respective industrial assets from the set of industrial assets to respective portions of the industrial asset data associated with the set of industrial assets;
• comparing a first industrial asset feature set from the industrial asset data to a cybersecurity rules set stored in an asset risk assessment signature repository to determine a cybersecurity threat level indicator for the respective industrial assets from the set of industrial assets;
• in response to a determination that that the cybersecurity threat level indicator for the respective industrial assets satisfies a defined criterion, determining one or more cybersecurity countermeasure actions for the respective industrial assets based on a comparison between a second industrial asset feature set from the industrial asset data and a predefined industrial asset feature set for a set of predefined industrial assets associated with one or more predefined cybersecurity countermeasures;
• and
• causing performance of the one or more cybersecurity countermeasure actions associated with the industrial control system.

A computer program product comprising at least one computer-readable storage medium having program instructions embodied thereon, the program instructions executable by a processor to cause the processor to:

• generate a knowledge graph that defines at least a portion of a network topology for an industrial control system, wherein the knowledge graph defines nodes associated with the set of industrial assets of the industrial control system and links associated with network connections of the industrial control system;
• monitor network traffic broadcasted to a set of industrial assets of the industrial control system to generate industrial asset data associated with the set of industrial assets;
• in response to a detection of a change in the industrial control system based on the network traffic, scan the knowledge graph to determine modeled network topology information for the industrial control system;
• determine a set of asset descriptors respectively describing an industrial asset from the set of industrial assets based on the modeled network topology information;
• correlate, based on the set of asset descriptors, respective industrial assets from the set of industrial assets to respective portions of the industrial asset data associated with the set of industrial assets;
• compare a first industrial asset feature set from the industrial asset data to a cybersecurity rules set stored in an asset risk assessment signature repository to determine a cybersecurity threat level indicator for the respective industrial assets from the set of industrial assets;
• in response to a determination that that the cybersecurity threat level indicator for the respective industrial assets satisfies a defined criterion, determine one or more cybersecurity countermeasure actions for the respective industrial assets based on a comparison between a second industrial asset feature set from the industrial asset data and a predefined industrial asset feature set for a set of predefined industrial assets associated with one or more predefined cybersecurity countermeasures;
• and
• cause performance of the one or more cybersecurity countermeasure actions associated with the industrial control system.