What's left after the controls

The organization

Organization: Ironbend Fabrication (fictional)
Industry: Manufacturing: a single plant producing machined metal parts
Size: About 650 employees; a seven-person IT team with two in security, and a separate plant-engineering team that runs the factory-floor (OT) systems
Risk appetite: Low tolerance for safety incidents or unplanned production downtime; moderate tolerance for internal IT risk.

Constraints

Changes to OT systems can only be made during the planned maintenance shutdown in six weeks.
A vendor is offering an OT anomaly-detection platform at a quarter-end discount, and leadership has asked whether it would cover these findings.
Plant engineering has two people available for security work before the shutdown.

Remediation capacity: 2 findings. You can choose "Mitigate: remediate ("fix")" for at most 2.

You have 2 remediation slots.

F1 Production-line operator workstations run an unsupported operating system

The operator workstations (HMIs) on the production lines run an operating system that no longer receives security updates. They sit on an isolated OT network segment with no internet access, their USB ports are locked, and application allowlisting has been enforced for two years. Upgrading them requires the line vendor to re-certify its software, which it quotes at four months.

Asset: Production-line HMI workstations
Exposure: Segmented network
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Production line control screens; no personal data
Compensating controls available: Monitor HMI network traffic with the proposed anomaly-detection platform
Remediation effort: High
Business owner: Plant Manager

Your response to F1

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F2 Press vendor has always-on remote access into the OT network

The stamping-press vendor connects to the OT network for support through a remote-desktop connection that stays open around the clock. Its technicians share one account, and the connection doesn't require multi-factor authentication. IT already runs a jump host with named accounts, MFA and session approval for other vendors; moving this vendor onto it is a configuration task of about two days.

Asset: Vendor remote-access connection to the press line
Exposure: Third party
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Direct access to press-line controllers
Compensating controls available: Monitor vendor sessions with the proposed anomaly-detection platform
Remediation effort: Low
Business owner: Plant Engineering Manager

Your response to F2

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F3 Abandoned cloud monitoring gateway still connects OT to the internet

Facilities trialed a cloud service that monitors the plant's air compressors. The trial ended five months ago and no one uses the dashboard, but the gateway device is still installed on the OT network and still sends data out to the internet. Facilities says the compressors run normally without it.

Asset: Compressor monitoring gateway
Exposure: Internet-facing
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Compressor telemetry; a network path from the internet into OT
Compensating controls available: Firewall rule limiting the gateway to the monitoring service's address
Monitor the gateway with the proposed anomaly-detection platform
Remediation effort: Low
Business owner: Facilities Manager

Your response to F3

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F4 PLCs are programmed from engineers' everyday laptops

Plant engineers program the line controllers (PLCs) from the same laptops they use for email and web browsing, then plug them into the OT network. The laptops run endpoint protection. Two dedicated engineering workstations that stay inside the OT network would cost about the same as one year of the anomaly-detection platform, and can be installed during the shutdown.

Asset: Engineering laptops used to program PLCs
Exposure: Internal network
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: PLC programs that control production equipment
Compensating controls available: Detect unexpected PLC changes with the proposed anomaly-detection platform
Remediation effort: Medium
Business owner: Plant Engineering Manager

Your response to F4

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F5 PLC program backups have no tested restore

A nightly job backs up every PLC program to a file server on the corporate network, which the same administrator accounts can reach. The plant's business continuity plan lists the backups as the recovery control for ransomware. No one has tested a restore. Copying the backups to offline storage takes an hour a month, and a restore test fits into the shutdown schedule.

Asset: PLC program backups
Exposure: Internal network
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: PLC programs needed to restart production
Compensating controls available: Monthly offline copy of the backups
Restore test during the shutdown
Remediation effort: Low
Business owner: Plant Engineering Manager

Your response to F5

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

Overall note (optional, up to 1200 characters; shown back to you, never stored)

Your rationale and note are shown back to you once and never stored. Privacy