Manage the Cybersecurity Risks of your BMS

Building management systems (BMS) and building automation systems (BAS) are great innovations, but present latent cybersecurity and operational risks to organizations. The consequences of a cyberattack on a BMS or BAS could result in operational disruption from the denial of use of the building.

Over the past decade, there have been several examples of attacks on BMS and components. Weaponization and operationalization of vulnerabilities in BMS by threat actors with tools such as ransomware is likely to occur in the next three years. BMS owners and managers can act today to reduce the risks and build on established cybersecurity frameworks to protect their assets and operations.

There are unique considerations involved in assessing the cybersecurity of operational technology (OT) like BMS and BAS. Therefore, it is imperative to work with experts and firms with considerable experience in assessing OT systems and the security of your BMS supply chain.

Background

BMS and BAS offer great promise in improved efficiency, comfort, security, and occupant experience. However, these complex cyberphysical systems also expose the building and occupants to new risks and threats, with negative consequences that in the past required physical access to realize. Today it’s possible for a building manager or staff to control these systems from a mobile application or a cloud-hosted application.

Key Concepts and Terminology

Staff responsible for a BMS or BAS may have extensive engineering or facilities experience, but no exposure to cybersecurity beyond general cybersecurity user awareness training. Unfortunately, in today’s threatscape, that leads to the BMS posing a latent risk: a risk that is present but unknown and unmanaged.

A BMS is one type of Operational Technology (OT), digital control systems that manage physical processes. These systems typically consist of the same types of components that you would find in a traditional information technology (IT) or information and communication technology (ICT) environment, such as servers, switches, routers, firewalls, databases, communication protocols, and applications. Generally, these are specialized variants of the components, but over the past decade we have observed a strong trend of convergence between IT and OT components.

Often these types of systems will be referred to as cyberphysical systems and may be abbreviated as CPS. Simply, a cyberphysical system is one in which a digital computer or microcontroller manages equipment that can produce a physical effect. Cyberphysical systems are vulnerable to the same types of cyberattacks and exploitation of vulnerabilities as IT systems.

Cybersecurity vulnerabilities are defects in the environment such as software or hardware, which can be exploited by a threat actor (attacker) to produce a cybersecurity impact. For IT systems, this generally means it impacts the administration or the business by affecting systems like email, web servers, or systems such as customer billing or enterprise resource planning (ERP) systems. For OT systems, the impact can be more consequential since it can shut down the core operations of a business. For example, in the case of a pipeline company, a cyberattack on an OT system, such as a ransomware attack, can shut down the operations of the pipeline with cascading effects to customers and others downstream who rely on the timely delivery of product through the pipeline. This exact type or attack occurred in 2021 on Colonial Pipeline.

Consequences

A compromised BMS would allow the attacker to control the BMS and cause effects that are only limited by the physical constraints on the building management systems. These types of effects could render a building unoccupiable for short- or long-term periods, due to the intentional manipulation of building environments like temperature, air quality, and humidity. Power, fire suppression, and other high-impact building services could be made inoperable or used to cause physical damage to a building. These risks are especially high in facilities that have very tight environmental requirements necessary to support the intended use, such as precision manufacturing.

In the case of an office building, reasonable business and operational continuity can be realized through its organization enabling work from home. However, in the case of a precision manufacturing plant, production would cease and goods in the production process may be damaged or spoiled due to the disruption. Likewise, a hotel or hospital would experience significant operational disruption and considerable costs in reaccommodating guests or patients at other facilities.

Threat Intelligence

Cybersecurity threat intelligence informs stakeholders about the extent to which threat actors are actively researching, developing, or exploiting cybersecurity vulnerabilities, and seeks to identify the approximate identity of those threat actors. For example, as a defender, it’s often helpful to know whether the threat actor is a malicious individual, organized crime group, or nation-state actor.

The following are examples of real-world attacks on BMS devices:

• In 2015, a cybersecurity expert disclosed to me that a nation state had compromised the home thermostat in the expert’s residence. In this case, the threat actor’s objective was to use the thermostat to ensure they retained a presence or persistence in the target’s home network for surveillance purposes rather than to produce a cyberphysical effect.[1]
  
• In 2021, unknown attackers took control of many of the BAS devices that controlled the lighting, motion detection system, and other operations in an office park in Germany. The intruders were able to gain control of the devices and set a password that prevented anyone else from accessing them. They also bricked many of the affected devices and it took third-party security consultants quite a while to remedy the situation, and they were only able to do so after managing to retrieve the key that locked the systems down from the memory of one of the devices.
  
• In April 2023, Schneider Electric proactively issued a security advisory disclosing that it had become aware of a publicly available exploit targeting the KNX product. This exploit would have enabled an attacker to access admin functionality without a password through a directory traversal attack, or to use a brute-force attack to access the administration panel.

We assess that within the next three years, threat actors will develop ransomware payloads specific to BMS and BAS deployments. Threat actors have already developed ransomware to specifically target medical devices, another type of OT, in hospitals.

Suggested Course or Action for BMS Managers

Following a mature cybersecurity management framework like the US National Institute of Standards’ Cybersecurity Framework (NIST CSF) is a wonderful place to start. There are recommended levels appropriate to organizations with any level of cybersecurity maturity.

The following is advice contained in most frameworks, distilled to eight high-level recommendations:

1. Know your suppliers and look upstream. Select BMS suppliers with established product security programs who do not build hardware or develop software in hostile countries like the People’s Republic of China (PRC).
   
2. Conduct a risk assessment. Once you have identified partners and suppliers, properly assess each product’s cybersecurity posture so that you know the risks they may pose to your organization. Consider where each device or component was manufactured and who exactly did so. Is there a possible backdoor or counterfeit part, or could more common software quality issues result in a breach?
   
3. Utilize third-party testing. Hire a third-party firm to test your system and those of your key suppliers, to provide actionable results on what you need to fix first. Ideally this should be performed in multiple steps through the design and build process, with the final security assessment completed as part of the site acceptance test.
   
4. Regularly scan and patch all vulnerable systems. Here it is important to have chosen vendors who provide regular security patches. Be careful with older systems, which may experience a denial of service through improper use of automated scanners.
   
5. Use strong passwords and credentials. Teach your employees about the importance of using strong passwords and credentials and not reusing them across accounts.
   
6. Use multi-factor authentication (MFA). Ensure that your staff has set up secure MFAeverywhere possible. SMS MFA solutions are not adequately secure.
   
7. Conduct regular security awareness training. Teach employees how to identify phishing scams, update software, and become more security conscious. This training should focus on those who have privileged access to the BMS.
   
8. Harden the security of the devices connected to your networks. Ideally, your suppliers and partners will provide recommendations for device configuration and security best practices.

Key Assessment Considerations

Third-party cybersecurity testing comes with specific risks of production impacts, outages, and other unintended consequences. It is critical to choose experienced, expert team members or third-party assessor organizations. It is absolutely necessary that any assessor or penetration tester working in an OT environment have extensive experience in those environments. OT environments with older programmable logic controllers (PLCs) can experience outages when those devices are pinged or scanned by a tool, due to limited resources or poor TCP/IP software stack implementations. Experienced assessors and OT-aware cybersecurity tools know how to achieve the same testing goals in OT environments using passive analysis methods such as analysis of network packet captures.

Unique OT Considerations

Given the very long useful life of many OT assets, including BMS and BAS deployments, frequently one may find several non-patchable vulnerabilities in that type of environment. Consequently, you should focus on a layered security approach, which makes it very difficult for a threat actor to get to the vulnerable, unpatchable components before they are detected and evicted from the environment. As such, heavy emphasis should be placed on assessing the segmentation, access controls, sensors, and detection capabilities between IT and OT environments.

Supply Chain Considerations

The recent supply chain attacks targeting Hezbollah operatives demonstrate how even organizations with mature counterintelligence capabilities can still fall victim to a supply chain interdiction. This demonstrates the high likelihood of successful attacks against companies and organizations with less defensive capabilities, including BMS users and suppliers. It is critical to buy BMS from trusted suppliers and countries.

Since it is uneconomical to assess every product an organization integrates into their operations, a risk-centric approach should be taken to use the limited resources available to focus on assessing the highest-risk and highest-consequence products and suppliers. Specifically for OT, the focus should be on those suppliers and products that if compromised could bring a complete halt to operations.

Asking a key supplier to show some type of summary of their secure development policies, as well as a summary of the results of an independent cybersecurity validation and verification by a qualified third-party assessor, is a great way to know whether your supplier takes product cybersecurity seriously and assesses the risk exposure their products bring to their customers’ organizations.

---

[1] Proprietary intelligence. Additional details are withheld to protect those involved and are not necessary for the example.

It’s a fact: enterprise security operations centers (SOCs) that are most satisfied with their investments in Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) operate and maintain less than a dozen playbooks. This is something I’ve uncovered in recent years whilst building SIEM+SOAR and autonomous SOC solutions – and it perhaps runs counterintuitive to many security leaders’ visions for SOAR use and value.

SOAR technology is one of those much-touted security silver bullets that have tarnished over time and been subsumed into broader categories of threat detection and incident response (TDIR) solutions, yet it continues to remain a distinct must-have modern SOC capability.

Why do satisfied SOCs run so few playbooks? After all, a core premise of SOAR was that you can automate any (perhaps all) security responses, and your SOC analysts would spend less time on ambient security noise – giving them more time to focus on higher-priority incidents. Surely “success” would include automating as many responses as possible?

Beyond the fact that “security is hard,” the reality is that threat detection and response is as dynamic as the organization you’re trying to protect. New systems, new policies, new business owners, new tools, and a sea of changing security products and API connector updates mean that playbooks must be dynamic and vigilantly maintained, or they become stale, broken, and ineffective.

Every SOC team has at least one playbook covering their phishing response. It’s one of the most common and frequently encountered threats within the enterprise, yet “phishing” covers an amazingly broad range of threats and possible responses, so a playbook-based response to the threat is programmatically very complex and brittle to environmental changes.

From a SOC perspective of automating and orchestrating a response, you would either build a lengthy single if/then/else-stye playbook or craft individual playbooks for each permutation of the threat. Smart SOC operators quickly learn that the former is more maintainable and scalable than the latter. A consequence of this is that you need analysts with more experience to maintain and operate the playbook. Any analyst can knock-up a playbook for a simple or infrequently encountered threat vector, but it takes business knowledge and vigilance to maintain each playbook’s efficacy beyond the short term.

Surely AI and a sprinkle of LLM magic will save the day though, right?

I can’t count the number of security vendors and startups that have materialized over the last couple of years with AI and LLM SOAR capabilities, features, or solutions – all with pitches that suggest playbooks are dead, dying, replaced, accelerated, automatically maintained, dynamically created, managed, open sourced, etc., so the human SOC analyst does less work going forward. I remain hopeful that 10% of any of that eventually becomes true.

For the immediate future, SOC teams should continue to be wary of any AI stories that emphasize making it easier to create playbooks (or their product-specific equivalent of a playbook). More is NOT better. It’s too easy (and all too common) to fall down the rathole of creating a new playbook for an existing threat because it’s too hard to find and maintain an earlier iteration of that threat’s playbook. Instead, focus on a subset of the most common and time-consuming threats that your SOC already faces daily, and nail them using the smallest number of playbooks you can get away with.

With the Rolling Stones’ “(I Can’t Get No) Satisfaction” playing in the background, perhaps you’ll get some modicum of SIEM+SOAR satisfaction by keeping your playbook playlist under a dozen.

— Gunter Ollmann

The damage caused by Hurricane Helene in Spruce Pine will likely cause disruptions at the start of the microchip and integrated circuit (IC) supply chain by preventing the mining and distribution of high purity quartz until the mines and local transportation networks are fully repaired.

BACKGROUND

Hurricane Helene Impacts

In late September 2024, Hurricane Helene impacted the Caribbean, Florida, Georgia, Tennessee, North Carolina and other southeastern states in the United States[1]. Its impacts varied widely depending on location and the associated exposure to the primary effects – wind, rain, and storm surge – of the hurricane. While Florida was primarily affected by wind and storm surge, and Georgia was impacted by wind, Tennessee and western North Carolina faced torrential rainfall from Helene after significant rainfall from another storm system in the prior days.

These rains produced catastrophic flooding in the mountains of Tennessee[2] and North Carolina[3], which caused tremendous damage to road and rail transportation networks in affected areas. In western North Carolina, the state’s Department of Transportation advised, “All roads in Western NC should be considered closed[4].”

Spruce Pine High-quality Quartz Mine

Located in the Blue Ridge Mountains of western North Carolina[5], Spruce Pine is the source of the world’s highest quality (ultra-pure) quartz. Major mine owners and operators in the Spruce Pine area include Sibelco, a Belgium-based corporation[6], and The Quartz Corp, a Norway-based corporation. The quartz from this area is critical in the manufacture of semiconductors, photovoltaic cells, and optical fiber. As Sibelco explains, high purity quartz (HPQ) sands are used to produce “fused quartz[7] (almost pure amorphous silicon dioxide) crucibles used in the Czochralski process[8], and the production of fused quartz tubing and ingots used to create fabricated quartzware for the semiconductor wafer process[9].”

Sibelco has increased production of HPQ by 60% since 2019, and is investing an additional 200-million-USD to increase production by an additional 200-percent in 2024 to meet expected increases in market demand[10]. Unfortunately, operations are currently suspended at the mine due to the hurricane’s disruption of the most basic services, including road and rail links[11]. The CSX Transportation rail line into Spruce Pine is severely damaged, with entire bridges missing[12].

Alternatives for HPQ

There are slower, more expensive processes that make use of lower quality quartz inputs. Brazil, India, and the Russian Federation (Russia) are other sources of HPQ, but not the same in quality or amount[13]. Additional sources of varying quantity and quality exist in Madagascar, Norway, and the People’s Republic of China (PRC).

CONSEQUENCES

Why IOActive Cares

This incident involves key areas of Interest for IOActive – areas in which we have made significant investments to help our clients protect themselves. Specifically, this incident involves impacts to microchips and integrated circuits (ICs)[14], supply chain risks[15], and multimodal transportation and logistics[16].

Potential Supply Chain Impacts

Predictions and forecasts are only ever certain to be wrong, but they provide useful insight into possible future states, which aid decision makers and stakeholders in managing the risks. The key variable for this event is how long operations at the Spruce Pine mines might be suspended due to local impacts (mine-specific operational issues) or regional issues (such as multimodal transportation network disruption) stemming from the effects of Hurricane Helene.

Temporary repairs to bridges can be made in a matter of days, weeks, or months, depending on the level of damage, while more permanent repairs taking many months or years are planned and completed. Unfortunately, these temporary repairs may limit the weight of crossing vehicles until those permanent repairs are completed. The complete loss of several road and rail bridges and the washed-out sections of roads and rail lines will require several years to fully repair and return to full capacity. The extensive damage to the road and rail networks serving the Spruce Pine area will impact the mine operations for some time, but will likely be operating in a reduced, degraded state within a few months, assuming no additional natural disasters.

Cybersecurity Risks

When observing a consequential event such as an accident, storm, or other disaster, it’s helpful to ponder whether those same consequences can be produced from a cyberattack. It can be nearly impossible for anyone to comprehensively understand all the different failure modes of a complex system or system of systems. A convenient shortcut for a cyber threat actor is to look to recreate previous system failure modes rather than search for unique ones. Reviewing the consequences of this incident reveals several vectors that could allow a highly capable, determined threat actor to launch a cyberattack to shut down mining operations in Spruce Pines.

Broadly, attack targets could include locomotives or commercial vehicles operated on the roads, rail line signaling equipment, or mine information technology (IT) and operational technology (IT) systems. This assessment is based on the results of our public research and our confidential commercial work. A successful attack on any of these targets could produce a consequential impact for mining operations, but the duration of the impact is unlikely to be as long as the impacts from Hurricane Helene.

RECOMMENDATIONS

Risk Management

Since the Spruce Pine mines are such an important node in the global supply chain for microchips and ICs, additional all-hazards risk management and mitigation action should be taken at both the state and federal levels to ensure fewer, shorter interruptions and more resilient operations.

Cybersecurity

Strategically important mines such as this should have requirements for strong cybersecurity, including both IT and OT assets, to ensure that there are minimal to no operational disruptions from a cyberattack.

National Security

As the United States confronts the malign activities of the PRC, it should consider restrictions on key inputs to microchips and ICs, including HPQ, in addition to the existing restrictions on high-performance computing resources like GPUs[17] and semiconductor manufacturing equipment like lithography equipment[18].

---

[1] https://en.wikipedia.org/wiki/Hurricane_Helene
[2] https://www.knoxnews.com/story/weather/2024/09/30/hurricane-helene-deadly-east-tennessee-floods-what-to-know-schools-roads/75447229007/
[3] https://climate.ncsu.edu/blog/2024/09/rapid-reaction-historic-flooding-follows-helene-in-western-nc/
[4] https://x.com/NCDOT/status/1839685402589827554
[5] 7638 South Highway 226, Spruce Pine, NC, 28777, United States
[6] https://www.sibelco.com/en/about-us
[7] https://en.wikipedia.org/wiki/Fused_quartz
[8] https://www.sciencedirect.com/topics/chemistry/czochralski-process
[9] https://www.sibelco.com/en/materials/high-purity-quartz
[10] https://assets-eu-01.kc-usercontent.com/54dbafb3-2008-0172-7e3d-74a0128faac8/64fae543-971f-46f5-9aec-df041f6f50f6/Webcast_H1_2024_Results_final.pdf
[11] https://www.thequartzcorp.com/articles/impact-of-hurricane-helene-on-the-quartz-corp-in-spruce-pine
[12] https://www.freightwaves.com/news/csxs-former-clinchfield-railroad-barely-recognizable-after-historic-flood
[13] http://www.sinosi.com/hotsales/Product/02%20HPQ%20Promotion%20_English%20Version.pdf
[14] https://ioactive.com/service/full-stack-security-assessments/silicon-security/
[15] https://ioactive.com/supply-chain-risks-go-beyond-cyber/
[16] https://ioactive.com/industry/transportation/
[17] https://www.reuters.com/technology/nvidia-may-be-forced-shift-out-some-countries-after-new-us-export-curbs-2023-10-17/
[18] https://www.csis.org/analysis/updated-october-7-semiconductor-export-controls

People are always on the move, changing their homes and their workspaces. With increasing frequency, they move from their current jobs to new positions, seeking new challenges, new people and places, to higher salaries.

Time and hard work bring experience and expertise, and these two qualities are what companies look for; they’re looking for skilled workers every single day, on multiple job search and recruiting platforms. However, these job postings might reveal sensitive information about the company that even the most seasoned Human Resources specialists don’t notice.

Job posting websites are a goldmine of information. Inherently, recruiters have to disclose certain data points, such as the technologies used by the company, so that candidates can assess whether they should apply. On the other hand, these data points could be used by malicious actors to profile a specific company and launch more sophisticated targeted attacks against the company and its employees.

To demonstrate this concept, I did research on tens of job postings from the following websites:

• LinkedIn – https://www.linkedin.com/jobs/
• Glassdoor – https://www.glassdoor.com
• Indeed – https://www.indeed.com
• CareerBuilder – https://www.careerbuilder.com
• Monster – https://www.monster.com
• ZipRecruiter – https://www.ziprecruiter.com
• Ladders – https://www.theladders.com
• Wellfound – https://wellfound.com

Surprisingly, more than 40% of job postings reveal relatively sensitive information, such as the following, which are just a sample of the information obtained from a variety of companies:

As you can see, a variety of information is disclosed inadvertently in these job postings:

• Exact version of the software used in the backend or by end users
• Programming languages, frameworks and libraries used
• Cloud Service Providers where customer data resides
• Intranet and collaborative software used within the company
• Antivirus and endpoint security software in use
• Industry-specific and third-party software used
• Databases, storage and backup, and recovery platforms used
• Business relationships with other companies
• Security controls implemented in the company’s SDLC

Armed with this information, one can simply connect the data dots and infer things like:

• Whether a company uses proprietary or open-source software, implying the use of other similar proprietary/open-source applications that could be targeted in an attack.
• Whether a company performs Threat Modeling and follows a secure SDCL, providing an attacker with a vague idea of whether the in-house-developed applications are secure or not.
• Whether a company has business relationship with other companies, enabling an attacker to target third-party companies in order to use them as pivot to attack the targeted company.

In summary, IOActive strongly encourages recruiters not to include sensitive information other than that required by the job position – in attempting to precisely target the exact candidate for a job, the level of detail you use could be costly.

With global cybercrime damage costs exceeding $11 trillion last year and moving toward an estimated $20 trillion by 2026, robust cybersecurity risk management has never been more imperative.

The interconnected nature of modern technology means that, by default, even small vulnerabilities can lead to catastrophic losses. And it’s not just about finances. Unmitigated risk raises the specter of eroded customer confidence and tainted brand reputation. In this comprehensive guide, we’ll give enterprise defenders a holistic, methodical, checklist-style approach to cybersecurity risk management. We’ll focus on practical applications, best practices, and ready-to-implement strategies designed to mitigate risks and safeguard digital assets against ever-more numerous—and increasingly capable—threats and adversaries.

What is Cybersecurity Risk Management?

This subspecialty of enterprise risk management describes a systematic approach to identifying, analyzing, evaluating, and addressing cyber threats to an organization’s assets and operations. At its core, it involves a continuous cycle of risk assessment, risk decision-making, and the implementation of risk controls intended to minimize the negative impact of cyber incidents.

A proactive cyber risk mitigation approach helps organizations protect critical digital assets and bolster business continuity, legal compliance, and customer trust. By integrating risk management with the organization’s overall strategic planning, cybersecurity teams can prioritize resources efficiently and align their efforts with the business’s risk appetite and objectives.

Why Has Cyber Risk Management Become So Critical?

Getting control over cyber risk is quickly becoming a core requirement for businesses operating in today’s digital ubiquity. The proliferation of digital information and internet connectivity have paved the way for sophisticated cyber threats that can penetrate many of our most robust defenses. With the digital footprint of businesses expanding exponentially, the potential for data breaches, ransomware attacks, and other forms of cybercrime has escalated dramatically.

These incidents can result in devastating financial losses, legal repercussions, and irreparable damage to an organization’s reputation. Furthermore, as regulatory frameworks around data protection become more stringent, failure to comply can lead to significant penalties. Given these conditions, an aggressive and comprehensive approach to managing cybersecurity risks is crucial for safeguarding an organization’s assets, ensuring operational continuity, and maintaining trust with customers and stakeholders.

Effective Cyber Risk Management: A Framework-Based Approach

Adopting a structured, framework-based approach to cybersecurity risk management lets security teams corral the complexity of digital environments with a methodical, strategic mitigation methodology. For most enterprise applications, there’s no need to reinvent the wheel. There are a myriad of established frameworks that can be modified and customized for effective use in nearly any environment.

Perhaps the best known is the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF), a companion to NIST’s well-tested and widely implemented Cybersecurity Framework (CSF). The NIST RMF offers a structured and systematic approach for integrating security, privacy, and risk management processes into an organization’s system development life cycle.

Such frameworks provide a comprehensive set of guidelines that help identify and assess cyber threats and facilitate the development of effective strategies to mitigate these risks. By standardizing cybersecurity practices, organizations can ensure a consistent and disciplined application of security measures across all departments and operations.

This coherence and uniformity are crucial for effectively addressing vulnerabilities and responding to incidents promptly. Equally important, frameworks incorporate best practices and benchmarks that help guide organizations toward achieving compliance with regulatory requirements, thus minimizing legal risks and enhancing the safeguarding of customer data. In essence, a framework-based approach offers a clear roadmap for managing cyber risk in a way that’s aligned with organizational strategic objectives and industry standards.

What follows is a checklist based on the 7-step RMF process. This is just a starting point. A framework to-do list like this can and should be tweaked to aid in reducing and managing specific cyber risks in your unique enterprise environment.

1. Preparation

In this initial phase, organizations focus on establishing the context and priorities for the Risk Management Framework process. This involves identifying critical assets, defining the boundaries, and codifying a risk management strategy that aligns with the organization’s objectives and resources. This is the foundation upon which a tailored approach to managing cybersecurity risk will ultimately be built throughout the system’s lifecycle.

• Establish the context for risk management and create a risk management strategy.
• Define roles and responsibilities across the organization.
• Develop a taxonomy for categorizing information and information systems.
• Determine the legal, regulatory, and contractual obligations.
• Prepare an inventory of system elements, including software and hardware.

2. Systems Categorization

Expanding on the categorization step (above), this phase involves identifying the types of information processed, stored, and transmitted to determine potential impact as measured against the information security CIA triad (confidentiality, integrity, and availability). Organizations can assign appropriate security categories to their systems by leveraging a categorization standard such as the Federal Information Processing Standard (FIPS) 199, ensuring that the protective measures taken are tailored to the specific needs and risks associated with the information being handled. This step is crucial as it lays the groundwork for selecting suitable security controls in the later stages of the risk management process.

• Identify the types of information processed, stored, and transmitted by the system.
• Assess the potential impact of loss of Confidentiality, Integrity, and Availability (CIA) associated with each type.
• Document findings in a formal security categorization statement.

3. Selecting Appropriate Security Controls

This critical step begins the safeguarding of information systems against potential threats and vulnerabilities in earnest. Based on the categorization of the information system, organizations select a baseline of security and privacy controls (NIST Special Publication 800-53 or some equivalent controls standard is a good starting point here), corresponding to the system’s impact level. This baseline acts as the jumping-off point for the security controls, which can be tailored to address the specific risks identified throughout the risk assessment process. Customization involves adding, removing, or modifying controls to ensure a robust defense tailored to the unique requirements and challenges of the organization.

• Select an appropriate baseline of security controls (NIST SP 800-53 or equivalent).
• Tailor the baseline controls to address specific organizational needs and identified risks.
• Document the selected security controls in the system security plan.
• Develop a strategy for continuously monitoring and maintaining the effectiveness of security controls.

4. Implementing the Selected Controls

Implementing security controls involves the physical and technical application of measures chosen during the previous selection phase. This step requires careful execution to ensure all controls are integrated effectively within the environment, aligning with its architecture and operational practices. Documenting the implementation details is crucial to provide a reference for future assessments and maintenance activities.

• Implement the security controls as documented in Step 3.
• Document the security controls and the responsible entities in place.
• Test thoroughly to ensure compatibility and uninterrupted functionality.
• Prepare for security assessment by documenting the implementation details.

5. Assessing Controls Performance

Assessing security controls involves evaluating effectiveness and adherence to the security requirements outlined in the overall security plan. This phase is critical for identifying any control deficiencies or weaknesses that could leave the information system vulnerable. Independent reviewers or auditors typically conduct assessments to ensure objectivity and a comprehensive analysis.

• Develop and implement a plan to assess the security controls.
• Perform security control assessments as per the plan.
• Prepare a Security Assessment Report (SAR) detailing the effectiveness of the controls.
• Determine if additional controls are needed and append the master security plan accordingly.

6. Authorizing the Risk Management Program

The authorization phase is a vital decision-making interval where one or more senior executives evaluate the security controls’ assessment results and decide whether the remaining risks to the information systems are acceptable to the organization. Upon acceptance, authorization is granted to operate the mitigation program for a specific time period, during which its compliance and security posture are continuously monitored. This authorization is formalized through the issuance of what is known as an Authorization to Operate (ATO) in some organizations, particularly in the public sector.

• Compile the required authorization package, including the master plan, the SAR, and the so-called Plan of Action and Milestones (POA&M).
• Assess the residual risk against the organizational risk tolerance.
• Document the authorization decision in an Authorization Decision Document.

7. Monitoring and Measuring Against Performance Metrics

The monitoring phase ensures that all implemented security controls remain effective and compliant over time. Continuous surveillance, reporting, and analysis can promptly address any identified vulnerabilities or changes in the operational environment. This ongoing process supports the kind of flexible, adaptive security posture necessary for dealing with evolving threats while steadfastly maintaining the integrity and availability of the information system.

• Implement the plan for ongoing monitoring of security controls.
• Report the system’s security state to designated leaders in the organization.
• Perform ongoing risk assessments and response actions, updating documentation as necessary.
• Conduct reviews and updates regularly, in accordance with the organizational timelines, or as significant changes occur.

Conclusion: Formalizing Cyber Risk Mitigation

A solid risk management framework provides a comprehensive guide for enhancing the security and resilience of information systems through a structured process of identifying, implementing, and monitoring security controls.

Sticking to a framework checklist helps ensure a successful, systematic adoption. As noted throughout, engaging stakeholders from across the organization, including IT, security, operations, and compliance, is critical to ensuring a truly comprehensive risk management program. Additionally, periodic training and awareness for team members involved in various phases of the risk management project will contribute to the resilience and security of the organization’s digital assets.

Organizations can effectively safeguard their digital assets and mitigate unacceptable risks by following the outlined steps, tailoring the program to fit specific organizational needs, involving stakeholders, conducting regular training, and adapting to the evolving cybersecurity landscape. Ultimately, this kind of formal, structured cyber risk management fosters a culture of continuous improvement and vigilance in an enterprise, contributing to the overall security posture and the success of the organization.