Apparatus and method for supporting use of dynamic rules in cyber-security risk management

An apparatus comprising:

• at least one memory configured to store information defining a custom rule from a user, the custom rule associated with a cyber-security risk, the custom rule identifying a type of cyber-security risk associated with the custom rule and information to be used to discover whether the cyber-security risk is present in one or more devices or systems of an industrial process control and automation system;
• and
• at least one processing device configured to:
• provide information associated with the custom rule for collection of information related to the custom rule from the one or more devices or systems;
• analyze the collected information related to the custom rule to identify at least one risk score associated with at least one of:
• the one or more devices or systems and the industrial process control and automation system;
• and
• present the at least one risk score or information based on the at least one risk score.

A non-transitory computer readable medium containing instructions that, when executed by at least one processing device, cause the at least one processing device to:

• obtain information defining a custom rule from a user, the custom rule associated with a cyber-security risk, the custom rule identifying a type of cyber-security risk associated with the custom rule and information to be used to discover whether the cyber-security risk is present in one or more devices or systems of an industrial process control and automation system;
• provide information associated with the custom rule for collection of information related to the custom rule from the one or more devices or systems;
• analyze the collected information related to the custom rule to identify at least one risk score associated with at least one of:
• the one or more devices or systems and the industrial process control and automation system;
• and
• present the at least one risk score or information based on the at least one risk score.