Analysing security risks of an industrial automation and control system

摘要

An industrial automation and control system (14) comprises communicatively interconnected components (16) for operating an industrial process and/or plant (10). A method for analysing security risks of the industrial automation and control system (14) comprises: identifying at least one security relation (22) between at least one component (16) of the system, at least one security threat (24) affecting the component (16) and at least one security control element (20) for mitigating the security threat (24); storing the at least one security relation (22); during operation of the system (14), observing a change of a security control element (20) of the system (10); and updating a security risk of at least one component (16) of the system (14) based on the security relation (22) and the observed change of the security control element (20).