Method for Risk Assesment of Industrial Networks' Information Security of Gas Producing Enterprise

The information security risk assessment methodology for an automated process control system of a gas producing enterprise is described and substantiated in this paper. This methodology considers epy specific features of typical gas producing enterprises that are hazardous producing facilities, which must be protected. The inadequate protection of an automated process control system can cause critical accidents. To avoid such accidents, the correctness of risk assessment is an urgent task. The specificity of vulnerability identifying and risk assessment of industrial systems of a gas producing enterprise is defined. The criteria for the selection open vulnerability bases were substantiated as well as software/hardware dictionaries and vulnerability metrics. The generic information security mathematical model of the automated process control system for a typical gas producing enterprise was extended by the authors. An application of this model for risk assessment was described. The developed methodology was based on the proposed criteria.