OT Risk Assessment and Analysis

Honda - 5 Days of Production Downtime, 0 Days of Risk Assessment

In 2020, WannaCry ransomware stopped Honda factories worldwide. The attack came through corporate network but stopped production. 5 days of downtime, losses in tens of millions. If Honda had OT risk assessment, they would have known IT/OT segmentation was priority #1.

Without OT risk assessment:

• You invest in security randomly - “because others do it”
• You don’t know which systems are critical for production
• No prioritization - everything is “High” or nothing is
• Management doesn’t understand cyber risk for OT (IT language vs business language)
• After incident you discover you secured the wrong systems
• You don’t meet NIS2 (risk assessment is a requirement)

From Assets Through Threats to Risk Valuation

OT risk assessment is not a CVE list with “High/Medium/Low”. It’s understanding which attacks can stop production, how much it costs, and what to do about it. In business language, with concrete numbers.

What you get:

• OT asset inventory (SCADA, PLC, HMI, protocols, connections)
• Identification of business-critical processes
• Dependency mapping (what depends on what)
• Threat modeling - attack scenarios for your industry and architecture
• Vulnerability assessment - where are the gaps
• Likelihood assessment of vulnerability exploitation (not all CVEs are realistic)
• Impact valuation in EUR - how much each system downtime costs
• Risk scoring with matrix: likelihood x impact
• Risk heat map - priority visualization
• Risk treatment plan - what to do with each risk (accept/mitigate/transfer/avoid)
• Action roadmap with priorities and estimated costs
• Business case for management - ROI from security investment

Who Is It For?

This service is for you if:

• You have security budget but don’t know where to spend it
• Management asks “how much does this cyber risk cost us?”
• You want to meet NIS2 (risk assessment is a requirement)
• You’re planning IEC 62443 compliance (risk assessment is the first step)
• Auditors/customers require risk assessment for OT
• You’re undergoing digital transformation and connecting IT with OT

Our Methodology

IEC 62443 + NIST + Practice

We apply recognized methodologies adapted to OT specifics:

1. Asset Identification (Week 1-2)

• Passive discovery (network traffic monitoring)
• Active scanning (careful, outside production hours)
• Interviews with OT team
• Documentation review (network diagrams, P&ID)
• Deliverable: Asset inventory

2. Process Mapping (Week 2-3)

• Critical process identification
• Dependency mapping between systems
• Downtime impact assessment for each system
• Deliverable: Process map + impact valuation

3. Threat Modeling (Week 3-4)

• Attack scenarios from real-world cases
• Threat actor analysis (cybercrime, nation-state, insider)
• Attack paths - how attacker can reach OT
• Deliverable: Threat catalog

4. Vulnerability Assessment (Week 4-5)

• CVE identification in OT systems
• Configuration analysis (hardening, segmentation)
• Security control assessment
• Deliverable: Vulnerability list

5. Risk Calculation (Week 5-6)

• Likelihood scoring (how probable is exploitation)
• Impact scoring (in EUR and time)
• Risk = Likelihood x Impact
• Risk prioritization
• Deliverable: Risk matrix

6. Risk Treatment (Week 6)

• For each risk: accept/mitigate/transfer/avoid
• Roadmap with remediation actions
• Cost estimation of implementation vs risk cost
• Deliverable: Risk treatment plan

Risk Scoring - How We Value Risk

Example: Ransomware Can Stop Production Line #3

Threat: Ransomware spreads from IT to OT Vulnerability: No segmentation between corporate network and OT Asset: Production line #3 (SCADA + 12 PLCs)

Likelihood (probability):

• Threat actor capability: High (ransomware-as-a-service available)
• Attack vector difficulty: Medium (requires pivot from IT to OT)
• Existing controls: Low (no firewall between IT-OT)
• Likelihood score: 70% (High)

Impact:

• Production downtime: 24h (backup recovery time)
• Line #3 downtime cost: €125,000/day
• Recovery cost (backup, reinstallation): €12,500
• Reputation: lost contract with key customer (estimated €500,000)
• Total Impact: ~€625,000

Risk = Likelihood x Impact = 70% x €625,000 = €437,500

Risk Treatment:

• Mitigate: IT/OT segmentation with industrial firewall (cost: €20,000)
• Mitigate: SCADA/PLC backup + recovery test (cost: €12,500)
• Total mitigation cost: €32,500
• ROI: €32,500 spent eliminates €437,500 risk = 13x return

Decision: Priority #1 - implement ASAP

Report Format

Executive Summary for Board + Technical Details for Team

Executive Summary (10 pages):

• Top 10 risks in EUR
• Heat map - priority visualization
• Recommendations with business case (cost vs benefit)
• Timeline and budget

Technical Report (50-100 pages):

• Detailed asset inventory
• Attack scenarios with diagrams
• Vulnerability list with CVE
• Risk matrix with scoring
• Risk treatment plan
• Action roadmap

Appendices:

• Network diagrams
• Asset inventory (Excel)
• Threat catalog
• Compliance mapping (NIS2, IEC 62443)

Related Glossary Terms

Learn more about key concepts related to this service:

• BEC
• CIS (Center for Internet Security)
• CVE
• ICS
• OT (Operational Technology)
• SCA
• SSE
• Tor