Apparatus and method for tying cyber-security risk analysis to common risk methodologies and risk levels

• US 10,298,608 B2
• Filed: 09/30/2015
• Issued: 05/21/2019
• Est. Priority Date: 02/11/2015
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Knapp, Eric D., Koelemij, Sinclair
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Chao, Michael W
• Application Number:
  US14/871,136
• Publication Number:
  US 20160234239A1
• Time in Patent Office: 1,329 Days
• Field of Search: None
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

This disclosure provides systems and methods for tying cyber-security risk analysis to common risk methodologies and risk levels. A method includes identifying a plurality of connected devices that are vulnerable to cyber-security risks and identifying cyber-security risks in the connected devices. The method includes assigning a risk level to each of the risks and comparing the risk levels to a first threshold and to a second threshold. The method includes assigning each identified cyber-security risk to a risk classification and displaying a user interface that includes a notification according to the identified cyber-security risks and the corresponding assigned risk classifications.

Claims

1. A method to provide an action based on cyber-security risk classifications in an industrial process control and automation system comprising:

identifying, by a risk manager system, a plurality of connected devices within the industrial process control and automation system that are vulnerable to cyber-security risks;

identifying, by the risk manager system, cyber-security risks in the connected devices;

assigning, by the risk manager system, a risk level to each of the identified cyber-security risks;

for each identified cyber-security risk, comparing by the risk manager system the assigned risk level to a first threshold and to a second threshold based on respective risk zones of the industrial process control and automation system, the first and second thresholds associated with the cyber-security risks in the connected devices, wherein the risks could result in unsafe conditions in the industrial process control and automation system;

based on the comparisons, assigning, by the risk manager system, each identified cyber-security risk to a risk classification;

displaying, by the risk manager system, a user interface that includes a plurality of notifications according to the identified cyber-security risks and the corresponding assigned risk classifications, the plurality of notifications comprising a general notification including a first shape displayed in a first color, a warning notification including a second shape displayed in a second color, and an alert notification including a third shape displayed in a third color, each of the plurality of notifications comprising a display of a number of the identified cyber-security risks for a corresponding one of the assigned risk classifications; and

providing, by the risk manager system, an action based on the displaying of the plurality of notifications to the user.

2. The method of claim 1, wherein the first threshold is a risk appetite and the second threshold is a risk tolerance.

3. The method of claim 1, further comprising receiving, by the risk manager system, the first and second thresholds from a user.

4. The method of claim 1, further comprising assigning, by the risk manager system, identified cyber-security risks with an assigned risk level that is less than both the first threshold and the second threshold to a low-priority classification or a notification classification.

5. The method of claim 1, further comprising assigning, by the risk manager system, identified cyber-security risks with an assigned risk level that is greater than or equal to the first threshold but that is less than the second threshold to a warning classification.

6. The method of claim 1, further comprising assigning, by the risk manager system, identified cyber-security risks with an assigned risk level that is greater than or equal to both the first threshold and the second threshold to an alert classification.

7. The method of claim 1, wherein the connected devices include at least one actuator or at least one sensor.

8. A risk manager system to provide an action based on cyber-security risk classifications in an industrial process control and automation system comprising:

a controller; and

a display;

wherein the controller is configured to;

identify a plurality of connected devices within the industrial process control and automation system that are vulnerable to cyber-security risks;

identify cyber-security risks in the connected devices;

assign a risk level to each of the identified cyber-security risks;

for each identified cyber-security risk, compare the assigned risk level to a first threshold and to a second threshold based on respective risk zones of the industrial process control and automation system, the first and second thresholds associated with the cyber-security risks in the connected devices, wherein the risks could result in unsafe conditions in the industrial process control and automation system;

based on the comparisons, assign each identified cyber-security risk to a risk classification;

present, on the display, a user interface that includes a plurality of notifications according to the identified cyber-security risks and the corresponding assigned risk classifications, the plurality of notifications comprising a general notification including a first shape displayed in a first color, a warning notification including a second shape displayed in a second color, and an alert notification including a third shape displayed in a third color, each of the plurality of notifications comprising a display of a number of the identified cyber-security risks for a corresponding one of the assigned risk classifications; and

provide an action based on the presenting of the plurality of notifications to the user.

9. The risk manager system of claim 8, wherein the first threshold is a risk appetite and the second threshold is a risk tolerance.

10. The risk manager system of claim 8, wherein the controller is further configured to receive the first and second thresholds from a user.

11. The risk manager system of claim 8, wherein the controller is further configured to assign identified cyber-security risks with an assigned risk level that is less than both the first threshold and the second threshold to a low-priority classification or a notification classification.

12. The risk manager system of claim 8, wherein the controller is further configured to assign identified cyber-security risks with an assigned risk level that is greater than or equal to the first threshold but that is less than the second threshold to a warning classification.

13. The risk manager system of claim 8, wherein the controller is further configured to assign identified cyber-security risks with an assigned risk level that is greater than or equal to both the first threshold and the second threshold to an alert classification.

14. A non-transitory machine-readable medium encoded with executable instructions to provide an action based on cyber-security risk classifications in an industrial process control and automation system that, when executed, cause one or more processors of a risk manager system to:

identify a plurality of connected devices within the industrial process control and automation system that are vulnerable to cyber-security risks;

identify cyber-security risks in the connected devices;

assign a risk level to each of the identified cyber-security risks;

for each identified cyber-security risk, compare the assigned risk level to a first threshold and to a second threshold based on respective risk zones of the industrial process control and automation system, the first and second thresholds associated with the cyber-security risks in the connected devices, wherein the risks could result in unsafe conditions in the industrial process control and automation system;

based on the comparisons, assign each identified cyber-security risk to a risk classification;

initiate presentation of a user interface that includes a plurality of notifications according to the identified cyber-security risks and the corresponding assigned risk classifications, the plurality of notifications comprising a general notification including a first shape displayed in a first color, a warning notification including a second shape displayed in a second color, and an alert notification including a third shape displayed in a third color, each of the plurality of notifications comprising a display of a number of the identified cyber-security risks for a corresponding one of the assigned risk classifications; and

provide an action based on the presentation of the plurality of notifications to the user.

15. The non-transitory machine-readable medium of claim 14, wherein

the first threshold is a risk appetite and the second threshold is a risk tolerance.

16. The non-transitory machine-readable medium of claim 14, wherein the executable instructions, when executed, further cause the one or more processors of the risk manager system to receive the first and second thresholds from a user.

17. The non-transitory machine-readable medium of claim 14, wherein the executable instructions, when executed, further cause the one or more processors of the risk manager system to assign identified cyber-security risks with an assigned risk level that is less than both the first threshold and the second threshold to a low-priority classification or a notification classification.

18. The non-transitory machine-readable medium of claim 14, wherein the executable instructions, when executed, further cause the one or more processors of the risk manager system to assign identified cyber-security risks with an assigned risk level that is greater than or equal to the first threshold but that is less than the second threshold to a warning classification.

19. The non-transitory machine-readable medium of claim 14, wherein the executable instructions, when executed, further cause the one or more processors of the risk manager system to assign identified cyber-security risks with an assigned risk level that is greater than or equal to both the first threshold and the second threshold to an alert classification.