SANS 5 ICS Critical Controls for Electric: Control 5 - Risk-Based ICS Vulnerability Management

The 5th and final Module of the cybersecurity series on ICS Critical Controls for the Electric Sector focuses on understanding and managing risk. A successful ICS cybersecurity strategy balances defense and offense.

A mature vulnerability management program must consider many factors. It should focus on strategically patching vulnerabilities, implementing safety-informed mitigations to mitigate potential impacts, and actively monitoring for signs of pre-attack positioning from within the control network. But that’s only part of a risk-based vulnerability management program for ICS.

This training module describes how organizations can identify vulnerabilities by understanding adversaries. This module will include safe and informed mitigation, workarounds, and monitoring for attack preposition and pre-exploitation attack attempts. It will be complete with a nuanced discussion of the probability of exploitation, where, and how an adversary gets into the system.

Watch All Parts in This Series:

Part 1

Part 2

Part 3

Part 4