Systems, program product and methods for performing a risk assessment workflow process for plant networks and systems

A computer-assisted method of performing a cyber security risk assessment on a plurality of process control networks and systems comprising a plurality of primary network assets at an industrial process facility, the method comprising the steps of:

• identifying, with assistance of a computer, each of the plurality of primary networked assets within the plurality of process control networks and systems to thereby identify associated networks and systems topology, network systems and asset security, and asset utilization;
• analyzing network asset integrity, with assistance of the computer, responsive to identifying networks and systems topology, network systems and asset security, and asset utilization to thereby determine susceptibility to each of a plurality of known threats;
• identifying, with assistance of the computer each of a plurality of network and asset vulnerabilities for the plurality of process control networks and systems when so existing responsive to determining network and asset susceptibility to each of the plurality of known threats;
• for each of the plurality of primary network assets of the plurality of process control networks and systems,
• determining a loss value associated with loss of control of the respective asset for each of a plurality of impact categories;
• for each of the plurality of known threats for each separate identified vulnerability exploitable by the respective threat,
• determining a risk level rating responsive to a categorical likelihood rating and a highest impact severity level rating across the plurality of impact categories for the respective threat with reference to each respective identified vulnerability exploitable by the respective threat;
• and
• for each identified network and asset vulnerability,
• determining a highest risk level rating from among one or more associated risk level ratings associated with a corresponding one or more impact categories affected by an associated threat capable of exploiting the respective vulnerability when so existing.

A non-transitory computer readable medium embodying cyber security risk assessment program product comprising a set of computer-executable instructions to perform a cyber security risk assessment on a plurality of process control networks and systems comprising a plurality of primary network assets at an industrial process facility, the program product comprising the following modules:

• an industrial and process control systems scanning module configured to identify networks and systems topology of the plurality of process control networks and systems for the industrial process facility through an automated process and to execute system and network security, vulnerability, virus, link congestion, node congestion analysis to thereby detect susceptibility to know threats to define potential vulnerabilities;
• a threats to vulnerabilities likelihood and consequences data repository module configured to determine a likelihood of each of a plurality of known threats exploiting identified vulnerabilities responsive to the identified networks and systems topology and configured to identify consequences of the exploitation to individual impacted systems and to overall plant operation responsive to a determined loss value associated with loss of control of each respective networks and systems asset for each of a plurality of impact categories;
• and
• a risk level evaluator module configured to determine a numerical risk level rating for any identified vulnerabilities responsive to a determination of a categorical impact severity level for the plurality of impact categories and likelihood of the respective vulnerability being exploited by a known threat associated therewith.

A cyber security risk assessment system to perform a cyber security risk assessment on a plurality of process control networks and systems comprising a plurality of primary network assets at an industrial process facility, the system comprising:

• a cyber security risk assessment computer having a processor and memory in communication with the processor to store software therein;
• a threats to vulnerabilities likelihood and consequences data repository stored in memory accessible to the cyber security risk assessment computer;
• a risk assessment report data repository stored in memory accessible to the cyber security risk assessment computer;
• and
• cyber security risk assessment program product stored in the memory of the cyber security risk assessment computer to perform the cyber security risk assessment on the plurality of process control networks and systems, the program product including instructions that when executed by the cyber security risk assessment computer cause the computer to perform various operations to include the operations of:
• identifying each of the plurality of primary networked assets within the plurality of process control networks and systems to thereby identify associated networks and systems topology, network systems and asset security, and asset utilization,
• analyzing network asset integrity responsive to identifying networks and systems topology, network systems and asset security, and asset utilization to thereby determine susceptibility to each of a plurality of known threats,
• identifying each of a plurality of network and asset vulnerabilities for the plurality of the process control networks and systems when so existing responsive to determining network and asset susceptibility to each of the plurality of known threats,
• for each of the plurality of primary network assets of the plurality of process control networks and systems,
• determining a loss value associated with loss of control of the respective asset for each of a plurality of impact categories,
• for each of the plurality of known threats for each separate identified vulnerability exploitable by the respective threat,
• determining a risk level rating responsive to a categorical likelihood rating and a highest impact severity level rating for the respective threat with reference to each respective identified vulnerability exploitable by the respective threat, and
• for each identified network and asset vulnerability,
• determining a highest risk level rating from among one or more associated risk level ratings associated with a corresponding one or more impact categories affected by an associated threat capable of exploiting the respective vulnerability when so existing.