Industrial Cyber Risk Management with Jason Christopher

### Overview In this episode of the Unsolicited Response show, host Dale Peterson interviews Jason Christopher, Principal Cyber Risk Advisor at Dragos and lead author of the paper *Industrial Cyber Risk Management: A Guideline for Operational Technology*. The discussion explores how operational technology (OT) and industrial control system (ICS) security should align with traditional corporate risk management frameworks. Christopher argues that ICS security has historically suffered by treating itself as too unique to be quantified or integrated with standard enterprise risk. Instead, industrial cyber risk must be viewed as an integral component of overall business risk alongside safety, reliability, and financial risk.

### Key Topics - **Defining Industrial Cyber Risk as Business Risk**: The term provides a shared baseline for CISOs and VPs of Engineering/Operations. Christopher stresses that industrial cyber risk is a nested subset of business risk, mapping directly to criteria such as safety, environmental harm, business continuity, and financial impact rather than solely IT concerns like website or email security. - **The Modified Risk Equation**: The paper proposes an updated risk equation: `Risk = (Consequence × Threat × Vulnerability) / Resilience`. Adding resilience into the denominator highlights proactive engineering controls, passive safety systems, and process physics that organizations can directly control to reduce overall risk, rather than leaving risk solely to the whim of external threats and vulnerabilities. - **Governance and Stakeholders**: Rather than security operating in isolation, risk management should leverage an Industrial Cyber Risk Committee with diverse stakeholders including engineering, operations, HR, and procurement. - **Threat Intelligence in Risk Management**: Rather than defaulting threat to a static value of 1 or relying on daily tactical feeds, strategic risk management should use threat profiles updated every 6 to 12 months, reflecting adversary capabilities, motivations, and targeting of specific sectors or regions.

### Technical Details - **Step 4: Risk Evaluation Waterfall**: Christopher outlines three tiers of evaluation: 1. *Architecture Reviews*: Baseline gap analysis against best practices or standards, which every industrial site should perform. 2. *Qualitative Risk Analysis*: Heat maps using defined impact criteria across financial, environmental, and operational dimensions. Christopher notes heat maps provide useful prioritization and trend analysis even if subjective. 3. *Quantitative Risk Analysis*: Financial modeling (e.g., using frameworks like FAIR or calculating loss expectancies). Christopher cautions against false precision (such as overly specific dollar-and-cent estimates), noting that quantitative methods are rarely statistically modelable in ICS due to intentional malicious adversaries, and should be reserved only for top-tier high-impact facilities. - **Resilience Heat Map Design**: Christopher explains the paper's Figure 4 heat map, which essentially joins two heat maps: tracking increasing threat motivation/capability on one side and decreased capacity for resilience on the other, allowing organizations to visualize how changes in projects, remote access, or engineering controls impact risk.

### Takeaways - Aligning OT risk with enterprise business risk enables security leaders to justify budgets by showing cost-benefit analysis against multi-million-dollar physical or operational consequences. - Asset owners should leverage existing business risk matrices, consequence definitions, and insurance data rather than creating redundant scoring systems. - Security teams should review the paper's risk register examples to bridge the communication gap between technical practitioners and executive leadership.