Insidious threat to control systems: The move to open standards is letting hackers take advantage of the control industry's ignorance

摘要

It is widely accepted in industrial security analysis that the security risk faced by an organization is a function of both the likelihood of successful attack against an asset and the consequence of such an attack, The second variable, consequence, while highly site-specific, is generally the easiest to understand. Often it can be estimated in terms of financial loss, acute health effects, or environmental impacts-concepts well understood from years of safety analysis of hazardous processes.