A novel dynamic risk assessment tool for evaluating cybersecurity risks in the digital industry

Area of Science:

• Cybersecurity
• Industrial Control Systems
• Risk Management

Background:

• Operational Technology (OT) and Information Technology (IT) integration presents cybersecurity challenges.
• Traditional risk assessments are inadequate for evolving threats and complex industrial systems.
• Need for adaptable and scalable OT cybersecurity risk evaluation methods.

Purpose of the Study:

• To present a semi-automated risk analysis tool for OT cybersecurity.
• To address limitations of traditional risk assessment approaches in industrial environments.
• To provide a structured and scalable framework for OT risk management.

Main Methods:

• Developed a multi-layered risk analysis tool integrating asset inventories, governance questionnaires, and threat intelligence (MITRE ATT&CK, CVE).
• Applied fuzzy logic for mapping threats and vulnerabilities.
• Generated graphical outputs: risk levels, threat distribution, and lifecycle exposure matrices.

Main Results:

• The tool successfully identified high-risk assets and critical operational stages requiring mitigation.
• Experimentation on an industrial platform validated the tool's effectiveness.
• Intrusion testing confirmed the tool's capacity for accurate risk identification.

Conclusions:

• The developed framework offers a practical foundation for structured, scalable, and governance-aligned OT risk assessments.
• The semi-automated tool enhances the evaluation of cybersecurity risks in integrated OT/IT environments.
• This approach improves the identification and mitigation of cybersecurity threats in industrial settings.