A Study on the Classification of OT Security Risk Mitigation Measures

It is an emergent issue that countermeasures against cyber-attacks on operational technology ( OT) systems such as critical infrastructures and control systems. The principal of the countermeasures is based on a risk analysis is performed for each asset to be protected in the OT system. And appropriate risk mitigation measures are prepared to reduce the risk to an acceptable level. The risk is determined by the damage caused by the attack and the probability of its occurrence. Thus, risk reduction measures include attack avoidance, probability reduction, damage control, and quick recovery, only IT security technology is often discussed today. We can get effective security measures by appropriately combining various risk reduction measures, not only IT security. This paper considers the classification and arrangement of security risk mitigation measures for effective OT security solution construction.