System-specific risk rating of software vulnerabilities in industrial automation & control systems

Abstract

Security vulnerabilities are constantly detected in software, and with CVE a world wide infrastructure exists to inform about such vulnerabilities. Typically, the software vendor issues a patch for the vulnerability. The system owners have to install patches timely in order protect against attacks that exploit vulnerabilities. In industrial automation & control systems, there is often a lot of overhead for installing patches, as availability must be ensured. Hence it makes sense to patch immediately only if the vulnerability poses a high risk to the operation of the plant. We propose an algorithm for calculating the system-specific risk of a vulnerability, based on a system model and a system risk image for system-specific exposure and impact. The system-specific exposure depends on the deployment, while the level of impact depends on the purpose of the system, e.g. in critical infrastructure.