Efficient Risk Reduction: Asset Inventory Often Not In My Top Ten

I'm fairly 'hard-over' about ruthless OT Cybersecurity prioritisation. Let's start with what happens if there is a successful cyber attack TODAY....So, Prevention has failed (we can come back to that later)....And so has Detection (all those blinking black boxes that you sold to your Exec as the 'silver bullet' have turned into more of a lead bucket)...What are you actually left with: the need to Respond and Recover (Contain, Disconnect, Revert to Manual, Eradicate, Recover, Switch to Backup, Hot-start, Warm-start, Cold-start, Rebuild etc etc)... Misguided advice that advocates anything (eg Risk Assessment, Detection tooling etc etc) before off-line backups of code and data plus a properly developed BCP / CIRP / DRP, and a team at Gold+Silver+Bronze levels that is properly trained, practised and tested in actually doing this response and recovery would be a derogation of duty for any competent CISO....period! If you haven't got a decent asset inventory then you are going to be floundering in the dark from the outset.

Dale Peterson, I agree with your statement that “you are not getting risk reduction by having an asset inventory. It is a foundation that allows other controls.” These controls, like better segmentation and ensuring EDR on all endpoints, are what drive risk down. Basic security hygiene, such as changing default passwords, requires visibility. Visibility also drives awareness. I’ve observed that customers often lack the “evidence” needed to support discussions and decisions until they see their assets and gaps clearly. One recent customer even used this data to negotiate better security with vendors and system integrators. So, while I agree with your analysis, I believe visibility is crucial. We can debate what level of visibility is sufficient, depending on the company’s key mission metrics.

Dale Peterson this is indeed an interesting perspective. To be fair it sounds more like systemic failures in the OT design and build phase since many of these systems would require certification (e.g. safety, functional), which would mandate an inventory list to begin with. Having said that, since the priority is indeed risk reduction, to what extent would you claim that a robust threat model, front-loaded, would be more effective in identifying key areas of risk to focus on, than conventional OT security dogma?

For protecting something, it makes sense to start with a risk assessment. A risk assessment helps identify potential threats, vulnerabilities, and the consequences of various risks. This process helps in prioritizing and implementing effective protective measures. By understanding the specific risks, you can allocate resources efficiently, develop targeted strategies, and mitigate potential harm more effectively. Without a risk assessment, protective efforts may be unfocused and less effective. Does a risk assessment require an inventory and at what level of granularity? I believe this depends on the type of assessment (quantitative/qualitative) and approach (top-down / bottom-up). Where many choose the topdown qualitative approach an accurate inventory is not required. The level of risk accuracy is not more than a subjective guess anyway. In more critical installations, requiring more accurate risk analysis, a good inventory is a must. Cutting corners is acceptable when consequence is low, because cyber risk translates into process safety risks. And history has learned that cutting corners in process safety is a bad practice. But ofcourse we can also skip risk assessment and base our protection on what we think is enough

I think it took off in popularity as a rhetorical question masquerading as a binary security indicator: “How can you secure your systems if you don’t even know what you have?!?!” People have probably heard that enough that it ends up seeming like the universal prerequisite for managing OT risk. Add in a sales pitch to meet that need, and it’s strong stuff.