CYBERSECURITY RISK ASSESSMENT AND MITIGATION FOR INDUSTRIAL CONTROL SYSTEMS

Various embodiments described herein relate to cybersecurity risk assessment and mitigation for industrial control systems. In an embodiment, a request to perform a cybersecurity assessment of a set of industrial assets is received. Additionally, the set of industrial assets are correlated to industrial asset data associated with the set of industrial assets and a first industrial asset feature set is compared to a cybersecurity rules set to determine a cybersecurity threat level indicator for respective industrial assets from the set of industrial assets. In response to the cybersecurity threat level indicator satisfying a defined criterion, one or more cybersecurity countermeasure actions for the respective industrial assets are then determined based on a comparison between a second industrial asset feature set and a predefined industrial asset feature set for a set of predefined industrial assets associated with one or more predefined cybersecurity countermeasures.

TECHNICAL FIELD

The present disclosure relates generally to industrial network security, and more particularly to cybersecurity risk assessment and mitigation for industrial control systems.

BACKGROUND

An industrial network (e.g., an industrial network associated with industrial automation and control systems) often includes thousands of assets such as, for example, sensors, input/output modules, controllers, firewall devices, supervisory nodes, application nodes, and/or other assets. Furthermore, different assets in an industrial network often include different sets of software and/or different sets of hardware connected to the same network or a different network via switches, routers, firewall devices, etc. As such, there are numerous technical challenges related to performing network security management with respect to an industrial network.

SUMMARY

In an embodiment, a system comprises one or more processors, a memory, and one or more programs stored in the memory. The one or more programs comprise instructions configured to receive a request to perform a cybersecurity assessment of a set of industrial assets within an industrial control system. In one or more embodiments, the request comprises a set of asset descriptors respectively describing an industrial asset from the set of industrial assets. In response to the request, the one or more programs further comprise instructions configured to correlate, based on the set of asset descriptors, the set of industrial assets to industrial asset data associated with the set of industrial assets. Additionally, in response to the request, the one or more programs further comprise instructions configured to compare a first industrial asset feature set from the industrial asset data to a cybersecurity rules set stored in an asset risk assessment signature repository to determine a cybersecurity threat level indicator for respective industrial assets from the set of industrial assets. In response to the request and a determination that that the cybersecurity threat level indicator for the respective industrial assets satisfies a defined criterion, the one or more programs further comprise instructions configured to determine one or more cybersecurity countermeasure actions for the respective industrial assets based on a comparison between a second industrial asset feature set from the industrial asset data and a predefined industrial asset feature set for a set of predefined industrial assets associated with one or more predefined cybersecurity countermeasures. Furthermore, in response to the request, the one or more programs further comprise instructions configured to cause performance of the one or more cybersecurity countermeasure actions associated with the industrial control system.

In another embodiment, a computer-implemented method comprises receiving a request to perform a cybersecurity assessment of a set of industrial assets within an industrial control system. In one or more embodiments, the request comprises a set of asset descriptors respectively describing an industrial asset from the set of industrial assets. In response to the request, the computer-implemented method also comprises comparing a first industrial asset feature set from the industrial asset data to a cybersecurity rules set stored in an asset risk assessment signature repository to determine a cybersecurity threat level indicator for respective industrial assets from the set of industrial assets. Additionally, in response to the request and a determination that that the cybersecurity threat level indicator for the respective industrial assets satisfies a defined criterion, the computer-implemented method also comprises determining one or more cybersecurity countermeasure actions for the respective industrial assets based on a comparison between a second industrial asset feature set from the industrial asset data and a predefined industrial asset feature set for a set of predefined industrial assets associated with one or more predefined cybersecurity countermeasures. In response to the request, the computer-implemented method also comprises causing performance of the one or more cybersecurity countermeasure actions associated with the industrial control system.

In yet another embodiment, a computer program product comprises at least one computer-readable storage medium having program instructions embodied thereon. The program instructions are executable by a processor to cause the processor to receive a request to perform a cybersecurity assessment of a set of industrial assets within an industrial control system. In one or more embodiments, the request comprises a set of asset descriptors respectively describing an industrial asset from the set of industrial assets. In response to the request, the program instructions further cause the processor to correlate, based on the set of asset descriptors, the set of industrial assets to industrial asset data associated with the set of industrial assets. Additionally, in response to the request, the program instructions further cause the processor to compare a first industrial asset feature set from the industrial asset data to a cybersecurity rules set stored in an asset risk assessment signature repository to determine a cybersecurity threat level indicator for respective industrial assets from the set of industrial assets. In response to the request and a determination that that the cybersecurity threat level indicator for the respective industrial assets satisfies a defined criterion, the program instructions further cause the processor to determine one or more cybersecurity countermeasure actions for the respective industrial assets based on a comparison between a second industrial asset feature set from the industrial asset data and a predefined industrial asset feature set for a set of predefined industrial assets associated with one or more predefined cybersecurity countermeasures. Furthermore, in response to the request, the program instructions further cause the processor to cause performance of the one or more cybersecurity countermeasure actions associated with the industrial control system.

DETAILED DESCRIPTION

Reference will now be made in detail to embodiments, examples of which are illustrated in the accompanying drawings. In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the various described embodiments. However, it will be apparent to one of ordinary skill in the art that the various described embodiments may be practiced without these specific details. In other instances, well-known methods, procedures, components, circuits, and networks have not been described in detail so as not to unnecessarily obscure aspects of the embodiments. The term “or” is used herein in both the alternative and conjunctive sense, unless otherwise indicated. The terms “illustrative,” “example,” and “exemplary” are used to be examples with no indication of quality level. Like numbers refer to like elements throughout.

The phrases “in an embodiment,” “in one embodiment,” “according to one embodiment,” and the like generally mean that the particular feature, structure, or characteristic following the phrase can be included in at least one embodiment of the present disclosure, and can be included in more than one embodiment of the present disclosure (importantly, such phrases do not necessarily refer to the same embodiment).

If the specification states a component or feature “can,” “may,” “could,” “should,” “would,” “preferably,” “possibly,” “typically,” “optionally,” “for example,” “often,” or “might” (or other such language) be included or have a characteristic, that particular component or feature is not required to be included or to have the characteristic. Such component or feature can be optionally included in some embodiments, or it can be excluded.

In general, the present disclosure provides for an “Internet-of-Things” or “IoT” platform for enterprise performance management that uses real-time accurate models and visual analytics to deliver intelligent actionable recommendations for sustained peak performance of an enterprise or organization. The IoT platform is an extensible platform that is portable for deployment in any cloud or data center environment for providing an enterprise-wide, top to bottom view, displaying the status of processes, assets, people, and safety. Further, the IoT platform of the present disclosure supports end-to-end capability to execute digital twins against process data and to translate the output into actionable insights, as detailed in the following description.

An industrial network (e.g., an industrial network associated with industrial automation and control systems) often includes thousands of assets such as, for example, sensors, input/output modules, controllers, firewall devices, supervisory nodes, application nodes, and/or other assets. Furthermore, different assets in an industrial network often include different sets of software and/or different sets of hardware connected to the same network or a different network via switches, routers, firewall devices, etc. As such, there are numerous technical challenges related to performing network security management with respect to an industrial network.

In an example, an infrastructure of a process industry plant such as a petrochemical plant, an oil and gas refinery, a pharmaceutical plan, a food and beverage plant, a fertilizer plant, a power plant, or another type of industrial plant is generally susceptible to a cyberattack via an industrial automation system and/or a control system of the industrial plant. An industrial automation system and/or a control system of an industrial plant is generally directly or indirectly connected to information technology networks such as a main control room for the industrial plant, a satellite rack room for the industrial plant, a plant network of the industrial plant, the Internet. As such, cyber attackers often exploit an industrial automation system and/or a control system of an industrial plant to take advantage of known and/or newly discovered infrastructure vulnerabilities of the industrial plant. Unlike computers and/or other computing devices implemented via an internet technology network, portions of an industrial automation system and/or a control system of an industrial plant generally include a distributed control system, process controllers, programmable logic controllers, supervisory control and data acquisition systems, computing stations (e.g., consoles, human-machine interfaces, etc.) and/or another type of system configured for process control functionalities with respect to the industrial plant. The portions of the industrial plant associated with process control functionalities is therefore generally susceptible to a cyberattack.

Thus, to address these and/or other issues, cybersecurity risk assessment and mitigation for industrial control systems is provided. In various embodiments, industrial assets in an industrial network are identified, a cybersecurity threat related to respective industrial assets is analyzed, a risk assessment with respect to the respective cybersecurity threats is performed, and/or one or more countermeasures for the respective cybersecurity threats are determined based on the risk assessments. The one or more countermeasures can also be executed to mitigate the cybersecurity risk with respect to the industrial network. In various embodiments, the one or more countermeasures can include one or more recommended network architectures and/or one or more industrial network changes to mitigate the cybersecurity risk.

In one or more embodiments, a request to perform a cybersecurity assessment of a set of industrial assets within an industrial control system is received. The request includes a set of asset descriptors respectively describing an industrial asset from the set of industrial assets. In response to the request, the set of asset descriptors is correlated to industrial asset data associated with the set of industrial assets based on the set of asset descriptors. Additionally, a first industrial asset feature set from the industrial asset data is compared to a cybersecurity rules set stored in an asset risk assessment signature repository to determine a cybersecurity threat level indicator for respective industrial assets from the set of industrial assets. In response to a determination that that the cybersecurity threat level indicator for the respective industrial assets satisfies a defined criterion, one or more cybersecurity countermeasure actions for the respective industrial assets are determined based on a comparison between a second industrial asset feature set from the industrial asset data and a predefined industrial asset feature set for a set of predefined industrial assets associated with one or more predefined cybersecurity countermeasures. Additionally, performance of the one or more cybersecurity countermeasure actions associated with the industrial control system is caused.

Accordingly, with the cybersecurity risk assessment and mitigation disclosed herein, likelihood of a cyberattack with respect to a network (e.g., an industrial network) is reduced. Moreover, with the cybersecurity risk assessment and mitigation disclosed herein, performance of a network (e.g., an industrial network) and/or assets within a network are improved. For instance, by employing one or more techniques disclosed herein, network performance, asset performance and/or process performance is optimized. Additionally, performance of a processing system associated with cybersecurity vulnerability assessment of assets is improved by employing one or more techniques disclosed herein. For example, a number of computing resources, a number of a storage requirements, and/or number of errors associated with cybersecurity vulnerability assessment of assets is reduced by employing one or more techniques disclosed herein.

FIG.1illustrates an exemplary networked computing system environment100, according to the present disclosure. As shown inFIG.1, networked computing system environment100is organized into a plurality of layers including a cloud layer105, a network layer110, and an edge layer115. As detailed further below, components of the edge115are in communication with components of the cloud105via network110.

In various embodiments, network110is any suitable network or combination of networks and supports any appropriate protocol suitable for communication of data to and from components of the cloud105and between various other components in the networked computing system environment100(e.g., components of the edge115). According to various embodiments, network110includes a public network (e.g., the Internet), a private network (e.g., a network within an organization), or a combination of public and/or private networks. According to various embodiments, network110is configured to provide communication between various components depicted inFIG.1. According to various embodiments, network110comprises one or more networks that connect devices and/or components in the network layout to allow communication between the devices and/or components. For example, in one or more embodiments, the network110is implemented as the Internet, a wireless network, a wired network (e.g., Ethernet), a local area network (LAN), a Wide Area Network (WANs), Bluetooth, Near Field Communication (NFC), or any other type of network that provides communications between one or more components of the network layout. In some embodiments, network110is implemented using cellular networks, satellite, licensed radio, or a combination of cellular, satellite, licensed radio, and/or unlicensed radio networks.

Components of the cloud105include one or more computer systems120that form a so-called “Internet-of-Things” or “IoT” platform125. It should be appreciated that “IoT platform” is an optional term describing a platform connecting any type of Internet-connected device, and should not be construed as limiting on the types of computing systems useable within IoT platform125. In particular, in various embodiments, computer systems120includes any type or quantity of one or more processors and one or more data storage devices comprising memory for storing and executing applications or software modules of networked computing system environment100. In one embodiment, the processors and data storage devices are embodied in server-class hardware, such as enterprise-level servers. For example, in an embodiment, the processors and data storage devices comprise any type or combination of application servers, communication servers, web servers, super-computing servers, database servers, file servers, mail servers, proxy servers, and/virtual servers. Further, the one or more processors are configured to access the memory and execute processor-readable instructions, which when executed by the processors configures the processors to perform a plurality of functions of the networked computing system environment100.

Computer systems120further include one or more software components of the IoT platform125. For example, in one or more embodiments, the software components of computer systems120include one or more software modules to communicate with user devices and/or other computing devices through network110. For example, in one or more embodiments, the software components include one or more modules141, models142, engines143, databases144, services145, and/or applications146, which may be stored in/by the computer systems120(e.g., stored on the memory), as detailed with respect toFIG.2below. According to various embodiments, the one or more processors are configured to utilize the one or more modules141, models142, engines143, databases144, services145, and/or applications146when performing various methods described in this disclosure.

Accordingly, in one or more embodiments, computer systems120execute a cloud computing platform (e.g., IoT platform125) with scalable resources for computation and/or data storage, and may run one or more applications on the cloud computing platform to perform various computer-implemented methods described in this disclosure. In some embodiments, some of the modules141, models142, engines143, databases144, services145, and/or applications146are combined to form fewer modules, models, engines, databases, services, and/or applications. In some embodiments, some of the modules141, models142, engines143, databases144, services145, and/or applications146are separated into separate, more numerous modules, models, engines, databases, services, and/or applications. In some embodiments, some of the modules141, models142, engines143, databases144, services145, and/or applications146are removed while others are added.

The computer systems120are configured to receive data from other components (e.g., components of the edge115) of networked computing system environment100via network110. Computer systems120are further configured to utilize the received data to produce a result. According to various embodiments, information indicating the result is transmitted to users via user computing devices over network110. In some embodiments, the computer systems120is a server system that provides one or more services including providing the information indicating the received data and/or the result(s) to the users. According to various embodiments, computer systems120are part of an entity which include any type of company, organization, or institution that implements one or more IoT services. In some examples, the entity is an IoT platform provider.

Components of the edge115include one or more enterprises160a-160neach including one or more edge devices161a-161nand one or more edge gateways162a-162n. For example, a first enterprise160aincludes first edge devices161aand first edge gateways162a, a second enterprise160bincludes second edge devices161band second edge gateways162b, and an nth enterprise160nincludes nth edge devices161nand nth edge gateways162n. As used herein, enterprises160a-160nrepresent any type of entity, facility, or vehicle, such as, for example, companies, divisions, buildings, manufacturing plants, warehouses, real estate facilities, laboratories, aircraft, spacecraft, automobiles, ships, boats, military vehicles, oil and gas facilities, or any other type of entity, facility, and/or entity that includes any number of local devices.

According to various embodiments, the edge devices161a-161nrepresent any of a variety of different types of devices that may be found within the enterprises160a-160n. Edge devices161a-161nare any type of device configured to access network110, or be accessed by other devices through network110, such as via an edge gateway162a-162n. According to various embodiments, edge devices161a-161nare “IoT devices” which include any type of network-connected (e.g., Internet-connected) device. For example, in one or more embodiments, the edge devices161a-161ninclude assets, sensors, actuators, processors, computers, valves, pumps, ducts, vehicle components, cameras, displays, doors, windows, security components, boilers, chillers, pumps, HVAC components, factory equipment, and/or any other devices that are connected to the network110for collecting, sending, and/or receiving information. Each edge device161a-161nincludes, or is otherwise in communication with, one or more controllers for selectively controlling a respective edge device161a-161nand/or for sending/receiving information between the edge devices161a-161nand the cloud105via network110. With reference toFIG.2, in one or more embodiments, the edge115include operational technology (OT) systems163a-163nand information technology (IT) applications164a-164nof each enterprise161a-161n. The OT systems163a-163ninclude hardware and software for detecting and/or causing a change, through the direct monitoring and/or control of industrial equipment (e.g., edge devices161a-161n), assets, processes, and/or events. The IT applications164a-164nincludes network, storage, and computing resources for the generation, management, storage, and delivery of data throughout and between organizations.

The edge gateways162a-162ninclude devices for facilitating communication between the edge devices161a-161nand the cloud105via network110. For example, the edge gateways162a-162ninclude one or more communication interfaces for communicating with the edge devices161a-161nand for communicating with the cloud105via network110. According to various embodiments, the communication interfaces of the edge gateways162a-162ninclude one or more cellular radios, Bluetooth, WiFi, near-field communication radios, Ethernet, or other appropriate communication devices for transmitting and receiving information. According to various embodiments, multiple communication interfaces are included in each gateway162a-162nfor providing multiple forms of communication between the edge devices161a-161n, the gateways162a-162n, and the cloud105via network110. For example, in one or more embodiments, communication are achieved with the edge devices161a-161nand/or the network110through wireless communication (e.g., WiFi, radio communication, etc.) and/or a wired data connection (e.g., a universal serial bus, an onboard diagnostic system, etc.) or other communication modes, such as a local area network (LAN), wide area network (WAN) such as the Internet, a telecommunications network, a data network, or any other type of network.

According to various embodiments, the edge gateways162a-162nalso include a processor and memory for storing and executing program instructions to facilitate data processing. For example, in one or more embodiments, the edge gateways162a-162nare configured to receive data from the edge devices161a-161nand process the data prior to sending the data to the cloud105. Accordingly, in one or more embodiments, the edge gateways162a-162ninclude one or more software modules or components for providing data processing services and/or other services or methods of the present disclosure. With reference toFIG.2, each edge gateway162a-162nincludes edge services165a-165nand edge connectors166a-166n. According to various embodiments, the edge services165a-165ninclude hardware and software components for processing the data from the edge devices161a-161n. According to various embodiments, the edge connectors166a-166ninclude hardware and software components for facilitating communication between the edge gateway162a-162nand the cloud105via network110, as detailed above. In some cases, any of edge devices161a-n, edge connectors166a-n, and edge gateways162a-nhave their functionality combined, omitted, or separated into any combination of devices. In other words, an edge device and its connector and gateway need not necessarily be discrete devices.

FIG.2illustrates a schematic block diagram of framework200of the IoT platform125, according to the present disclosure. The IoT platform125of the present disclosure is a platform for enterprise performance management that uses real-time accurate models and visual analytics to deliver intelligent actionable recommendations and/or analytics for sustained peak performance of the enterprise160a-160n. The IoT platform125is an extensible platform that is portable for deployment in any cloud or data center environment for providing an enterprise-wide, top to bottom view, displaying the status of processes, assets, people, and safety. Further, the IoT platform125supports end-to-end capability to execute digital twins against process data and to translate the output into actionable insights, using the framework200, detailed further below.

As shown inFIG.2, the framework200of the IoT platform125comprises a number of layers including, for example, an IoT layer205, an enterprise integration layer210, a data pipeline layer215, a data insight layer220, an application services layer225, and an applications layer230. The IoT platform125also includes a core services layer235and an extensible object model (EOM)250comprising one or more knowledge graphs251. The layers205-235further include various software components that together form each layer205-235. For example, in one or more embodiments, each layer205-235includes one or more of the modules141, models142, engines143, databases144, services145, applications146, or combinations thereof. In some embodiments, the layers205-235are combined to form fewer layers. In some embodiments, some of the layers205-235are separated into separate, more numerous layers. In some embodiments, some of the layers205-235are removed while others may be added.

The IoT platform125is a model-driven architecture. Thus, the extensible object model250communicates with each layer205-230to contextualize site data of the enterprise160a-160nusing an extensible graph based object model (or “asset model”). In one or more embodiments, the extensible object model250is associated with knowledge graphs251where the equipment (e.g., edge devices161a-161n) and processes of the enterprise160a-160nare modeled. The knowledge graphs251of EOM250are configured to store the models in a central location. The knowledge graphs251define a collection of nodes and links that describe real-world connections that enable smart systems. As used herein, a knowledge graph251: (i) describes real-world entities (e.g., edge devices161a-161n) and their interrelations organized in a graphical interface; (ii) defines possible classes and relations of entities in a schema; (iii) enables interrelating arbitrary entities with each other; and (iv) covers various topical domains. In other words, the knowledge graphs251define large networks of entities (e.g., edge devices161a-161n), semantic types of the entities, properties of the entities, and relationships between the entities. Thus, the knowledge graphs251describe a network of “things” that are relevant to a specific domain or to an enterprise or organization. Knowledge graphs251are not limited to abstract concepts and relations, but can also contain instances of objects, such as, for example, documents and datasets. In some embodiments, the knowledge graphs251include resource description framework (RDF) graphs. As used herein, a “RDF graph” is a graph data model that formally describes the semantics, or meaning, of information. The RDF graph also represents metadata (e.g., data that describes data). According to various embodiments, knowledge graphs251also include a semantic object model. The semantic object model is a subset of a knowledge graph251that defines semantics for the knowledge graph251. For example, the semantic object model defines the schema for the knowledge graph251.

As used herein, EOM250includes a collection of application programming interfaces (APIs) that enables seeded semantic object models to be extended. For example, the EOM250of the present disclosure enables a customer's knowledge graph251to be built subject to constraints expressed in the customer's semantic object model. Thus, the knowledge graphs251are generated by customers (e.g., enterprises or organizations) to create models of the edge devices161a-161nof an enterprise160a-160n, and the knowledge graphs251are input into the EOM250for visualizing the models (e.g., the nodes and links).

The models describe the assets (e.g., the nodes) of an enterprise (e.g., the edge devices161a-161n) and describe the relationship of the assets with other components (e.g., the links). The models also describe the schema (e.g., describe what the data is), and therefore the models are self-validating. For example, in one or more embodiments, the model describes the type of sensors mounted on any given asset (e.g., edge device161a-161n) and the type of data that is being sensed by each sensor. According to various embodiments, a KPI framework is used to bind properties of the assets in the extensible object model250to inputs of the KPI framework. Accordingly, the IoT platform125is an extensible, model-driven end-to-end stack including: two-way model sync and secure data exchange between the edge115and the cloud105, metadata driven data processing (e.g., rules, calculations, and aggregations), and model driven visualizations and applications. As used herein, “extensible” refers to the ability to extend a data model to include new properties/columns/fields, new classes/tables, and new relations. Thus, the IoT platform125is extensible with regards to edge devices161a-161nand the applications146that handle those devices161a-161n. For example, when new edge devices161a-161nare added to an enterprise160a-160nsystem, the new devices161a-161nwill automatically appear in the IoT platform125so that the corresponding applications146understand and use the data from the new devices161a-161n.

In some cases, asset templates are used to facilitate configuration of instances of edge devices161a-161nin the model using common structures. An asset template defines the typical properties for the edge devices161a-161nof a given enterprise160a-160nfor a certain type of device. For example, an asset template of a pump includes modeling the pump having inlet and outlet pressures, speed, flow, etc. The templates may also include hierarchical or derived types of edge devices161a-161nto accommodate variations of a base type of device161a-161n. For example, a reciprocating pump is a specialization of a base pump type and would include additional properties in the template. Instances of the edge device161a-161nin the model are configured to match the actual, physical devices of the enterprise160a-160nusing the templates to define expected attributes of the device161a-161n. Each attribute is configured either as a static value (e.g., capacity is 1000 BPH) or with a reference to a time series tag that provides the value. The knowledge graph250can automatically map the tag to the attribute based on naming conventions, parsing, and matching the tag and attribute descriptions and/or by comparing the behavior of the time series data with expected behavior. In one or more embodiments, each of the key attribute contributing to one or more metrics to drive a dashboard is marked with one or more metric tags such that a dashboard visualization is generated.

The modeling phase includes an onboarding process for syncing the models between the edge115and the cloud105. For example, in one or more embodiments, the onboarding process includes a simple onboarding process, a complex onboarding process, and/or a standardized rollout process. The simple onboarding process includes the knowledge graph250receiving raw model data from the edge115and running context discovery algorithms to generate the model. The context discovery algorithms read the context of the edge naming conventions of the edge devices161a-161nand determine what the naming conventions refer to. For example, in one or more embodiments, the knowledge graph250receives “TMP” during the modeling phase and determine that “TMP” relates to “temperature.” The generated models are then published. The complex onboarding process includes the knowledge graph250receiving the raw model data, receiving point history data, and receiving site survey data. According to various embodiments, the knowledge graph250then uses these inputs to run the context discovery algorithms. According to various embodiments, the generated models are edited and then the models are published. The standardized rollout process includes manually defining standard models in the cloud105and pushing the models to the edge115.

The IoT layer205includes one or more components for device management, data ingest, and/or command/control of the edge devices161a-161n. The components of the IoT layer205enable data to be ingested into, or otherwise received at, the IoT platform125from a variety of sources. For example, in one or more embodiments, data is ingested from the edge devices161a-161nthrough process historians or laboratory information management systems. The IoT layer205is in communication with the edge connectors165a-165ninstalled on the edge gateways162a-162nthrough network110, and the edge connectors165a-165nsend the data securely to the IoT platform205. In some embodiments, only authorized data is sent to the IoT platform125, and the IoT platform125only accepts data from authorized edge gateways162a-162nand/or edge devices161a-161n. According to various embodiments, data is sent from the edge gateways162a-162nto the IoT platform125via direct streaming and/or via batch delivery. Further, after any network or system outage, data transfer will resume once communication is re-established and any data missed during the outage will be backfilled from the source system or from a cache of the IoT platform125. According to various embodiments, the IoT layer205also includes components for accessing time series, alarms and events, and transactional data via a variety of protocols.

The enterprise integration layer210includes one or more components for events/messaging, file upload, and/or REST/OData. The components of the enterprise integration layer210enable the IoT platform125to communicate with third party cloud applications211, such as any application(s) operated by an enterprise in relation to its edge devices. For example, the enterprise integration layer210connects with enterprise databases, such as guest databases, customer databases, financial databases, patient databases, etc. The enterprise integration layer210provides a standard application programming interface (API) to third parties for accessing the IoT platform125. The enterprise integration layer210also enables the IoT platform125to communicate with the OT systems163a-163nand IT applications164a-164nof the enterprise160a-160n. Thus, the enterprise integration layer210enables the IoT platform125to receive data from the third-party applications211rather than, or in combination with, receiving the data from the edge devices161a-161ndirectly.

The data pipeline layer215includes one or more components for data cleansing/enriching, data transformation, data calculations/aggregations, and/or API for data streams. Accordingly, in one or more embodiments, the data pipeline layer215pre-processes and/or performs initial analytics on the received data. The data pipeline layer215executes advanced data cleansing routines including, for example, data correction, mass balance reconciliation, data conditioning, component balancing and simulation to ensure the desired information is used as a basis for further processing. The data pipeline layer215also provides advanced and fast computation. For example, cleansed data is run through enterprise-specific digital twins. According to various embodiments, the enterprise-specific digital twins include a reliability advisor containing process models to determine the current operation and the fault models to trigger any early detection and determine an appropriate resolution. According to various embodiments, the digital twins also include an optimization advisor that integrates real-time economic data with real-time process data, selects the right feed for a process, and determines optimal process conditions and product yields.

According to various embodiments, the data pipeline layer215employs models and templates to define calculations and analytics. Additionally or alternatively, according to various embodiments, the data pipeline layer215employs models and templates to define how the calculations and analytics relate to the assets (e.g., the edge devices161a-161n). For example, in an embodiment, a pump template defines pump efficiency calculations such that every time a pump is configured, the standard efficiency calculation is automatically executed for the pump. The calculation model defines the various types of calculations, the type of engine that should run the calculations, the input and output parameters, the preprocessing requirement and prerequisites, the schedule, etc. According to various embodiments, the actual calculation or analytic logic is defined in the template or it may be referenced. Thus, according to various embodiments, the calculation model is employed to describe and control the execution of a variety of different process models. According to various embodiments, calculation templates are linked with the asset templates such that when an asset (e.g., edge device161a-161n) instance is created, any associated calculation instances are also created with their input and output parameters linked to the appropriate attributes of the asset (e.g., edge device161a-161n).

According to various embodiments, the IoT platform125supports a variety of different analytics models including, for example, first principles models, empirical models, engineered models, user-defined models, machine learning models, built-in functions, and/or any other types of analytics models. Fault models and predictive maintenance models will now be described by way of example, but any type of models may be applicable.

Fault models are used to compare current and predicted enterprise160a-160nperformance to identify issues or opportunities, and the potential causes or drivers of the issues or opportunities. The IoT platform125includes rich hierarchical symptom-fault models to identify abnormal conditions and their potential consequences. For example, in one or more embodiments, the IoT platform125drill downs from a high-level condition to understand the contributing factors, as well as determining the potential impact a lower level condition may have. There may be multiple fault models for a given enterprise160a-160nlooking at different aspects such as process, equipment, control, and/or operations. According to various embodiments, each fault model identifies issues and opportunities in their domain, and can also look at the same core problem from a different perspective. According to various embodiments, an overall fault model is layered on top to synthesize the different perspectives from each fault model into an overall assessment of the situation and point to the true root cause.

According to various embodiments, when a fault or opportunity is identified, the IoT platform125provides recommendations about an optimal corrective action to take. Initially, the recommendations are based on expert knowledge that has been pre-programmed into the system by process and equipment experts. A recommendation services module presents this information in a consistent way regardless of source, and supports workflows to track, close out, and document the recommendation follow-up. According to various embodiments, the recommendation follow-up is employed to improve the overall knowledge of the system over time as existing recommendations are validated (or not) or new cause and effect relationships are learned by users and/or analytics.

According to various embodiments, the models are used to accurately predict what will occur before it occurs and interpret the status of the installed base. Thus, the IoT platform125enables operators to quickly initiate maintenance measures when irregularities occur. According to various embodiments, the digital twin architecture of the IoT platform125employs a variety of modeling techniques. According to various embodiments, the modeling techniques include, for example, rigorous models, fault detection and diagnostics (FDD), descriptive models, predictive maintenance, prescriptive maintenance, process optimization, and/or any other modeling technique.

According to various embodiments, the rigorous models are converted from process design simulation. In this manner, process design is integrated with feed conditions and production requirement. Process changes and technology improvement provide business opportunities that enable more effective maintenance schedule and deployment of resources in the context of production needs. The fault detection and diagnostics include generalized rule sets that are specified based on industry experience and domain knowledge and can be easily incorporated and used working together with equipment models. According to various embodiments, the descriptive models identifies a problem and the predictive models determines possible damage levels and maintenance options. According to various embodiments, the descriptive models include models for defining the operating windows for the edge devices161a-161n.

Predictive maintenance includes predictive analytics models developed based on rigorous models and statistic models, such as, for example, principal component analysis (PCA) and partial least square (PLS). According to various embodiments, machine learning methods are applied to train models for fault prediction. According to various embodiments, predictive maintenance leverages FDD-based algorithms to continuously monitor individual control and equipment performance. Predictive modeling is then applied to a selected condition indicator that deteriorates in time. Prescriptive maintenance includes determining an optimal maintenance option and when it should be performed based on actual conditions rather than time-based maintenance schedule. According to various embodiments, prescriptive analysis selects the right solution based on the company's capital, operational, and/or other requirements. Process optimization is determining optimal conditions via adjusting set-points and schedules. The optimized set-points and schedules can be communicated directly to the underlying controllers, which enables automated closing of the loop from analytics to control.

The data insight layer220includes one or more components for time series databases (TDSB), relational/document databases, data lakes, blob, files, images, and videos, and/or an API for data query. According to various embodiments, when raw data is received at the IoT platform125, the raw data is stored as time series tags or events in warm storage (e.g., in a TSDB) to support interactive queries and to cold storage for archive purposes. According to various embodiments, data is sent to the data lakes for offline analytics development. According to various embodiments, the data pipeline layer215accesses the data stored in the databases of the data insight layer220to perform analytics, as detailed above.

The application services layer225includes one or more components for rules engines, workflow/notifications, KPI framework, insights (e.g., actionable insights), decisions, recommendations, machine learning, and/or an API for application services. The application services layer225enables building of applications146a-d. The applications layer230includes one or more applications146a-dof the IoT platform125. For example, according to various embodiments, the applications146a-dincludes a buildings application146a, a plants application146b, an aero application146c, and other enterprise applications146d. According to various embodiments, the applications146includes general applications146for portfolio management, asset management, autonomous control, and/or any other custom applications. According to various embodiments, portfolio management includes the KPI framework and a flexible user interface (UI) builder. According to various embodiments, asset management includes asset performance and asset health. According to various embodiments, autonomous control includes energy optimization and/or predictive maintenance. As detailed above, according to various embodiments, the general applications146is extensible such that each application146is configurable for the different types of enterprises160a-160n(e.g., buildings application146a, plants application146b, aero application146c, and other enterprise applications146d).

The applications layer230also enables visualization of performance of the enterprise160a-160n. For example, dashboards provide a high-level overview with drill downs to support deeper investigations. Recommendation summaries give users prioritized actions to address current or potential issues and opportunities. Data analysis tools support ad hoc data exploration to assist in troubleshooting and process improvement.

The core services layer235includes one or more services of the IoT platform125. According to various embodiments, the core services235include data visualization, data analytics tools, security, scaling, and monitoring. According to various embodiments, the core services235also include services for tenant provisioning, single login/common portal, self-service admin, UI library/UI tiles, identity/access/entitlements, logging/monitoring, usage metering, API gateway/dev portal, and the IoT platform125streams.

FIG.3illustrates a system300that provides an exemplary environment according to one or more described features of one or more embodiments of the disclosure. According to an embodiment, the system300includes a cybersecurity risk mitigation computer system302to facilitate a practical application of cybersecurity assessment with respect to assets within a network. In one or more embodiments, the cybersecurity risk mitigation computer system302facilitates a practical application of monitoring network traffic broadcasted to the assets and/or based on responses from the assets to facilitate cybersecurity risk assessment with respect to assets within a network. In one or more embodiments, the cybersecurity risk mitigation computer system302stores and/or analyzes asset property data that is aggregated from one or more assets and/or one or more data sources associated with an enterprise system (e.g., a building system, an industrial system or another type of enterprise system).

In an embodiment, the cybersecurity risk mitigation computer system302is a server system (e.g., a server device) that facilitates cybersecurity assessment with respect to assets within a network. In another embodiment, the cybersecurity risk mitigation computer system302corresponds to and/or is integrated within an edge system (e.g., edge device) that facilitates cybersecurity assessment with respect to assets within a network. In one or more embodiments, the cybersecurity risk mitigation computer system302is a device with one or more processors and a memory. In one or more embodiments, the cybersecurity risk mitigation computer system302is a computer system from the computer systems120. For example, in one or more embodiments, the cybersecurity risk mitigation computer system302is implemented via the cloud105. The cybersecurity risk mitigation computer system302is also related to one or more technologies, such as, for example, cybersecurity technologies, cybersecurity assessment technologies, industrial technologies, process plant technologies, oil and gas technologies, petrochemical technologies, refinery technologies, process plant technologies, supply chain analytics technologies, enterprise technologies, connected building technologies, industrial technologies, Internet of Things (IoT) technologies, data analytics technologies, digital transformation technologies, cloud computing technologies, cloud database technologies, server technologies, network technologies, private enterprise network technologies, wireless communication technologies, machine learning technologies, artificial intelligence technologies, digital processing technologies, electronic device technologies, computer technologies, aircraft technologies, navigation technologies, asset visualization technologies, procurement technologies, and/or one or more other technologies.

Moreover, the cybersecurity risk mitigation computer system302provides an improvement to one or more technologies such as cybersecurity technologies, cybersecurity assessment technologies, industrial technologies, process plant technologies, oil and gas technologies, petrochemical technologies, refinery technologies, process plant technologies, supply chain analytics technologies, enterprise technologies, connected building technologies, industrial technologies, IoT technologies, data analytics technologies, digital transformation technologies, cloud computing technologies, cloud database technologies, server technologies, network technologies, private enterprise network technologies, wireless communication technologies, machine learning technologies, artificial intelligence technologies, digital processing technologies, electronic device technologies, computer technologies, aircraft technologies, navigation technologies, asset visualization technologies, procurement technologies, and/or one or more other technologies. In an implementation, the cybersecurity risk mitigation computer system302improves performance of an industrial network, an industrial control system, and/or one or more industrial assets. For example, in one or more embodiments, the cybersecurity risk mitigation computer system302improves processing efficiency, reduces power consumption, reduces downtime, and/or mitigates cybersecurity risk for an industrial network, an industrial control system, and/or one or more industrial assets. In another implementation, the cybersecurity risk mitigation computer system302improves performance of a computing device. For example, in one or more embodiments, the cybersecurity risk mitigation computer system302improves processing efficiency of a computing device (e.g., a server), reduces power consumption of a computing device (e.g., a server), improves quality of data provided by a computing device (e.g., a server), etc.

The cybersecurity risk mitigation computer system302includes an asset discovery component304, a cybersecurity assessment component306and/or a cybersecurity action component308. Additionally, in one or more embodiments, the cybersecurity risk mitigation computer system302includes a processor310and/or a memory312. In certain embodiments, one or more aspects of the cybersecurity risk mitigation computer system302(and/or other systems, apparatuses and/or processes disclosed herein) constitute executable instructions embodied within a computer-readable storage medium (e.g., the memory312). For instance, in an embodiment, the memory312stores computer executable component and/or executable instructions (e.g., program instructions). Furthermore, the processor310facilitates execution of the computer executable components and/or the executable instructions (e.g., the program instructions). In an example embodiment, the processor310is configured to execute instructions stored in the memory312or otherwise accessible to the processor310.

The processor310is a hardware entity (e.g., physically embodied in circuitry) capable of performing operations according to one or more embodiments of the disclosure. Alternatively, in an embodiment where the processor310is embodied as an executor of software instructions, the software instructions configure the processor310to perform one or more algorithms and/or operations described herein in response to the software instructions being executed. In an embodiment, the processor310is a single core processor, a multi-core processor, multiple processors internal to the cybersecurity risk mitigation computer system302, a remote processor (e.g., a processor implemented on a server), and/or a virtual machine. In certain embodiments, the processor310is in communication with the memory312, the asset discovery component304, the cybersecurity assessment component306and/or the cybersecurity action component308via a bus to, for example, facilitate transmission of data among the processor310, the memory312, the asset discovery component304, the cybersecurity assessment component306and/or the cybersecurity action component308. The processor310may be embodied in a number of different ways and, in certain embodiments, includes one or more processing devices configured to perform independently. Additionally or alternatively, in one or more embodiments, the processor310includes one or more processors configured in tandem via a bus to enable independent execution of instructions, pipelining of data, and/or multi-thread execution of instructions.

The memory312is non-transitory and includes, for example, one or more volatile memories and/or one or more non-volatile memories. In other words, in one or more embodiments, the memory312is an electronic storage device (e.g., a computer-readable storage medium). The memory312is configured to store information, data, content, one or more applications, one or more instructions, or the like, to enable the cybersecurity risk mitigation computer system302to carry out various functions in accordance with one or more embodiments disclosed herein. As used herein in this disclosure, the term “component,” “system,” and the like, is a computer-related entity. For instance, “a component,” “a system,” and the like disclosed herein is either hardware, software, or a combination of hardware and software. As an example, a component is, but is not limited to, a process executed on a processor, a processor, circuitry, an executable component, a thread of instructions, a program, and/or a computer entity.

In an embodiment, the cybersecurity risk mitigation computer system302(e.g., the asset discovery component304of the cybersecurity risk mitigation computer system302) determines asset property data related to the edge devices161a-161n. In one or more embodiments, the edge devices161a-161nare associated with a portfolio of assets. For instance, in one or more embodiments, the edge devices161a-161ninclude one or more assets in a portfolio of assets. The edge devices161a-161ninclude, in one or more embodiments, one or more databases, one or more assets (e.g., one or more industrial assets, one or more building assets, etc.), one or more IoT devices (e.g., one or more industrial IoT devices), one or more connected building assets, one or more sensors, one or more actuators, one or more processors, one or more computers, one or more valves, one or more pumps (e.g., one or more centrifugal pumps, etc.), one or more motors, one or more compressors, one or more turbines, one or more ducts, one or more heaters, one or more chillers, one or more coolers, one or more storage tanks, one or more boilers, one or more furnaces, one or more heat exchangers, one or more fans, one or more blowers, one or more conveyor belts, one or more vehicle components, one or more cameras, one or more displays, one or more security components, one or more HVAC components, industrial equipment, factory equipment, refinery equipment, and/or one or more other devices that are connected to the network110for collecting, sending, and/or receiving information.

In one or more embodiments, the edge device161a-161ninclude, or is otherwise in communication with, one or more controllers for selectively controlling a respective edge device161a-161nand/or for sending/receiving information between the edge devices161a-161nand the cybersecurity risk mitigation computer system302via the network110. The asset property data includes, for example, an internet protocol (IP) address, a media access control (MAC) address, a hostname, a manufacturer, an operating system, a transmission control protocol (TCP) port, a user datagram protocol (UDP) port, a service, a role, metadata, flow flags, port status (e.g., open state, closed state, etc.), asset state, asset type, asset discovery information, and/or other information associated with one or more edge devices from the edge devices161a-161n. In one or more embodiments, the asset property data is additionally or alternatively associated with one or more asset processes related to one or more edge devices from the edge devices161a-161n. For example, in one or more embodiments, the asset property data additionally or alternatively includes data generated by one or more asset processes, data generated by one or more asset processes, and/or other data related to one or more asset processes.

In one or more embodiments, the cybersecurity risk mitigation computer system302(e.g., the asset discovery component304of the cybersecurity risk mitigation computer system302) is in communication with the edge devices161a-161nvia the network110. In one or more embodiments, the network110is a Wi-Fi network, a Near Field Communications (NFC) network, a Worldwide Interoperability for Microwave Access (WiMAX) network, a personal area network (PAN), a short-range wireless network (e.g., a Bluetooth® network), an infrared wireless (e.g., IrDA) network, an ultra-wideband (UWB) network, an induction wireless transmission network, and/or another type of network. In one or more embodiments, the edge devices161a-161nare associated with an industrial environment (e.g., a plant, etc.). Additionally or alternatively, in one or more embodiments, the edge devices161a-161nare associated with components of the edge115such as, for example, one or more enterprises160a-160n.

The asset discovery component304is configured for asset discovery to detect one or more assets (e.g., the edge devices161a-161n) within the network110. For instance, the asset discovery component304is configured to perform one or more asset discovery processes associated with the network110to detect the one or more assets (e.g., the edge devices161a-161n) within the network110. In an embodiment, the asset discovery component304detects one or more assets within a certain IP range of the network110. In one or more embodiments, the asset discovery component304also aggregates asset property data related to the one or more assets (within the network110to provide industrial asset data. For instance, in one or more embodiments, the asset discovery component304aggregates the asset property data and/or related cybersecurity risk measures into an asset risk assessment signature repository318to store the industrial asset data. In an embodiment, the asset discovery component304performs the one or more asset discovery processes in response to an action (e.g., a user-initiated action, modification of an interactive graphical element, etc.) initiated via an electronic interface of a computing device associated with a user. In another embodiment, the asset discovery component304performs the one or more asset discovery processes in response to an action initiated in response to a timer (e.g., an asset schedule) satisfying a defined timer threshold value. For example, in certain embodiments, the asset discovery component304performs the one or more asset discovery processes based on a schedule (e.g., every 30 minutes, every hour, one or more times per day, one or more times per week, etc.). In one or more embodiments, the asset discovery component304performs the one or more asset discovery processes based on one or more performance requirements associated with the one or more assets within the network110. For example, in one or more embodiments, the asset discovery component304performs the one or more asset discovery processes based on CPU requirements, memory requirements, a firmware version, and/or other performance requirements associated with the one or more assets within the network110.

In one or more embodiments, the asset discovery component304performs the one or more asset discovery processes with respect to one or more assets in a Level 0 (e.g., zone 0) of the network110, a Level 1 (e.g., zone 1) of the network110, and/or a Level 2 (e.g., zone 2) of the network110. In one or more embodiments, a Level 0 (e.g., zone 0) of the network110includes field instrumentation assets associated with technical parameters such as, for example, firmware version/revision, tag name, sensor type, status, manufacturer, communication type, and/or other information. Additionally, a Level 1 (e.g., zone 1) of the network110includes embedded IOM's and controllers associated with parameters such as, for example, firmware version/revision, module type, synchronization status, manufacturer, module status, performance data (e.g., CPU performance, memory performance, etc.), and/or other information. Additionally, a Level 1 (e.g., zone 1) of the network110includes supervisory/application/network switches nodes asset report associated with parameters such as, for example, model, type, manufacturer, IOS type, mirror port information, up/down ports, memory, CPU, operating system, open TCP, UDP ports, and/or other information.

In one or more embodiments, the asset discovery component304generates the industrial asset data by monitoring network traffic broadcasted to the one or more assets. Additionally or alternatively, the asset discovery component304generates the industrial asset data based on one or more communications broadcasted by the one or more assets. In one or more embodiments, the asset discovery component304generates the industrial asset data by scanning, based on one or more data acquisition protocols associated with the one or more assets, one or more ports (e.g., one or more TCP ports, one or more UDP ports, etc.) of the one or more assets.

In one or more embodiments, the cybersecurity risk mitigation computer system302(e.g., the cybersecurity assessment component306of the cybersecurity risk mitigation computer system302) receives a request320to perform a cybersecurity assessment of the one or more assets within the network110. For example, the one or more assets within the network110can be set of industrial assets within an industrial control system associated with the network110. In one or more embodiments, the request320includes one or more asset descriptors that describe the one or more assets. For instance, in one or more embodiments, the request320includes one or more asset descriptors that describe the edge devices161a-161n. In an embodiment, the request320includes a set of asset descriptors respectively describing an industrial asset from the set of industrial assets. An asset descriptor includes, for example, an asset name, an asset identifier, an asset level, an IP address, a MAC address, a hostname, a manufacturer, an operating system identifier, a TCP port identifier, a UDP port identifier, a service identifier, a role identifier, metadata, an asset state, asset discovery information, a sensor identifier, and/or other information associated with the one or more assets. In certain embodiments, the request320can be received in response to a change in the industrial control system, the network110, and/or one or more assets within the industrial network. In certain embodiments, the request320can be received in response to an action performed via an electronic interface of a computing device. For example, a user can initiate the request320via an electronic interface of a computing device.

In one or more embodiments, the request320includes a request to generate a dashboard visualization associated with the cybersecurity assessment. In one or more embodiments, the request320is received in response to an action (e.g., a user-initiated action, modification of an interactive graphical element, etc.) initiated via an electronic interface of a computing device. In one or more embodiments, the request320is received in response to an action initiated via a processing unit (e.g., an edge device, a controller, etc.) associated with the one or more assets. In one or more embodiments, the request320is received in response to an asset schedule satisfying a defined criterion (e.g., an asset schedule interval being above a threshold timer). In one or more embodiments, the request320is received in response to detection of a possible anomaly associated with an asset (e.g., in response to an anomaly index for an asset being greater than a specified threshold level). Additionally or alternatively, in one or more embodiments, the request320includes one or more user identifiers describing a user role for a user associated with access of a dashboard visualization. A user identifier includes, for example, an identifier for a user role name (e.g., a manager, an executive, a maintenance engineer, a process engineer, etc.).

In response to the request320, the cybersecurity assessment component306correlates, based on the one or more asset descriptors, the one or more assets to industrial asset data associated with the one or more assets. For example, in response to the request320, the cybersecurity assessment component306correlates, based on the set of asset descriptors, the set of industrial assets to industrial asset data associated with the set of industrial assets. The industrial asset data includes, for example, IP addresses, MAC addresses, hostname data, manufacturer data, operating system data, TCP port data, UDP port data, service data, role data, metadata, flow flags data, port status data (e.g., open state data, closed state data, etc.), asset state data, asset type data, asset discovery information, a timestamp, detected signal strength data associated with an asset communicating on the network, a type of wireless protocol associated with an asset, a networking event associated with an asset, a beacon event associated with an asset, a probing event associated with an asset, an authentication event associated with an asset, and/or other information associated with respective assets.

Additionally, in response to the request320, the cybersecurity assessment component306compares an industrial asset feature set from the industrial asset data to a cybersecurity rules set stored in an asset risk assessment signature repository to determine a cybersecurity threat level indicator for respective assets. For example, in response to the request320, the cybersecurity assessment component306can compare an industrial asset feature set from the industrial asset data to a cybersecurity rules set stored in an asset risk assessment signature repository to determine a cybersecurity threat level indicator for respective industrial assets from the set of industrial assets. The industrial asset feature set can include one or more features related to IP addresses, MAC addresses, hostname data, manufacturer data, operating system data, TCP port data, UDP port data, service data, role data, metadata, flow flags data, port status data (e.g., open state data, closed state data, etc.), asset state data, asset type data, asset discovery information, a timestamp, detected signal strength data associated with an asset communicating on the network, a type of wireless protocol associated with an asset, a networking event associated with an asset, a beacon event associated with an asset, a probing event associated with an asset, an authentication event associated with an asset, and/or other features associated with respective assets.

The cybersecurity rules set can be a set of rules for particular industrial asset features. For example, the cybersecurity rules set can define particular industrial asset features as a certain cybersecurity threat for an industrial control system. Cybersecurity threat level indicators can include, but are not limited to, “critical,” “high,” “moderate,” “low,” “cybersecurity threat,” “non-cybersecurity threat”, etc. Additionally, in some embodiments, particular industrial asset features of varying severity can also be assigned to respective categories classifying the type of cybersecurity threat. For instance, a rule pertaining to a particular industrial asset features can be defined as a “security event” with a cybersecurity event level of “critical,” whereas a rule pertaining to another particular industrial asset features can be defined as a “non-security event” with a cybersecurity event level of “low.” Additionally and/or alternatively, in various embodiments, the cybersecurity rules set can reflect international cybersecurity standards for industrial networks (e.g., ISA/IEC 62443) and respective cybersecurity threat level indicators can be attributed to rules associated with the international standards.

In certain embodiments, the cybersecurity assessment component306can determine the set of asset descriptors based on textual analysis of data provided via an electronic interface of a computing device. For example, the cybersecurity assessment component306can determine the set of asset descriptors based on textual analysis of one or more documents related to one or more industrial assets from the set of assets and/or one or more documents related to the industrial control system. In certain embodiments, the cybersecurity assessment component306can determine the set of asset descriptors based on a scan of a network topology (e.g., network nodes) associated with the industrial control system. For example, the network topology can illustrate connections and/or a layout of industrial assets within the industrial control system. In certain embodiments, the network topology can provide one or more portions of the industrial asset data. In certain embodiments, the knowledge graphs251can define one or more portions of the network topology. In certain embodiments, the cybersecurity assessment component306can provide the first industrial asset feature set to a machine learning model (e.g., a machine learning model from the models142) configured to determine the cybersecurity threat level indicator based on the cybersecurity rules set. The machine learning model can be a classifier model configured to classify a cybersecurity threat level indicator for an industrial assets, a neural network model configured to predict a cybersecurity threat level indicator for an industrial assets, or another type of machine learning model.

Additionally, in response to a determination that that the cybersecurity threat level indicator for the respective industrial assets satisfies a defined criterion, the cybersecurity assessment component306can determine one or more cybersecurity countermeasure actions for the respective assets based on a comparison between an industrial asset feature set from the industrial asset data and a predefined industrial asset feature set for a set of predefined assets associated with one or more predefined cybersecurity countermeasures. For example, in response to a determination that that the cybersecurity threat level indicator for the respective industrial assets satisfies a defined criterion, the cybersecurity assessment component306can determine one or more cybersecurity countermeasure actions for the respective industrial assets based on a comparison between a second industrial asset feature set from the industrial asset data and a predefined industrial asset feature set for a set of predefined industrial assets associated with one or more predefined cybersecurity countermeasures. In various embodiments, the defined criterion can be related to particular cybersecurity threat levels. For example, the cybersecurity assessment component306can determine the one or more cybersecurity countermeasure actions in response to a determination that that the cybersecurity threat level indicator for the respective industrial assets corresponds to a certain type of cybersecurity threat level such as, for example, a “cybersecurity threat” or a “critical” threat level.

In various embodiments, an industrial asset feature set can be configured as one or more data signatures (e.g., one or more digital patterns, one or more digital fingerprints, etc.) that correspond to industrial asset characteristics and/or industrial asset events. Additionally, in various embodiments, a cybersecurity rules set can be configured as one or more data signatures (e.g., one or more digital patterns, one or more digital fingerprints, etc.) that correspond to one or more cybersecurity events and/or one or more cybersecurity risk patterns. The industrial asset feature set associated with the comparison for determining the cybersecurity countermeasure actions can include one or more features related to IP addresses, MAC addresses, hostname data, manufacturer data, operating system data, TCP port data, UDP port data, service data, role data, metadata, flow flags data, port status data (e.g., open state data, closed state data, etc.), asset state data, asset type data, asset discovery information, a timestamp, detected signal strength data associated with an asset communicating on the network, a type of wireless protocol associated with an asset, a networking event associated with an asset, a beacon event associated with an asset, a probing event associated with an asset, an authentication event associated with an asset, and/or other features associated with respective assets. The predefined industrial asset feature set for the set of predefined industrial assets can include predefined IP addresses, predefined MAC addresses, predefined hostname data, predefined manufacturer data, predefined operating system data, predefined TCP port data, predefined UDP port data, predefined service data, predefined role data, predefined metadata, predefined flow flags data, predefined port status data, predefined asset state data, predefined asset type data, predefined asset discovery information, a predefined type of wireless protocol, predefined networking event information, and/or other features associated with the set of predefined industrial assets in order to provide a cybersecurity countermeasure with low cybersecurity risk. The industrial asset feature set associated with the comparison for determining the cybersecurity countermeasure actions can correspond to at least a portion of the industrial asset feature set employed to determine the cybersecurity threat level indicator. Alternatively, the industrial asset feature set associated with the comparison for determining the cybersecurity countermeasure actions can be a different industrial asset feature set than the the industrial asset feature set employed to determine the cybersecurity threat level indicator.

In an embodiment, at least a portion of the cybersecurity rules set and/or the predefined industrial asset feature set for the set of predefined industrial assets is stored in the asset risk assessment signature repository318. Additionally or alternatively, at least a portion of the cybersecurity rules set and/or the predefined industrial asset feature set for the set of predefined industrial assets is stored in an asset vulnerability signature repository associated with another database (e.g., the memory312, etc.).

Based on the one or more cybersecurity countermeasure actions, the cybersecurity action component308can generate cybersecurity action data322. For example, in response to a match between the second industrial asset feature set and the predefined industrial asset feature set, the cybersecurity assessment component306can determine that the one or more cybersecurity countermeasure actions and the cybersecurity action component308can generate the cybersecurity action data322based on the one or more cybersecurity countermeasure actions. The cybersecurity action data322can include information and/or control signals associated with the one or more cybersecurity countermeasure actions to cause performance of the one or more cybersecurity countermeasure actions associated with the industrial control system. The one or more cybersecurity countermeasure actions can be one or more actions related to the network110, the industrial control system, one or more assets (e.g., one or more industrial assets), and/or an electronic interface of a computing device.

In certain embodiments, the one or more cybersecurity countermeasure actions includes a predetermined action associated with security control for the industrial control system and/or an asset. In an embodiment, the one or more cybersecurity countermeasure actions includes altering an administrative control with respect to an asset, altering a policy with respect to an asset, alter a configuration setting with respect to an asset, disconnecting a physical hardware device associated with an asset from the industrial control system, increasing a degree of monitoring with respect to an asset, altering strength of authentication with respect to an asset, altering a communication channel associated with an asset, generating a notification to indicate a new asset to replace a particular asset in the industrial control system, and/or one or more other types of actions with respect to an asset.

In an embodiment, the one or more cybersecurity countermeasure actions includes generating a report associated with the cybersecurity assessment. In another embodiment, the one or more cybersecurity countermeasure actions includes generating a user-interactive electronic interface that renders a visual representation of data associated with the cybersecurity assessment. In another embodiment, the one or more cybersecurity countermeasure actions includes disconnecting one or more assets from the network110. In another embodiment, the one or more cybersecurity countermeasure actions includes providing one or more recommended actions for one or more assets based on the cybersecurity assessment. In another embodiment, the one or more cybersecurity countermeasure actions includes transmitting, to a computing device, one or more notifications associated with the cybersecurity assessment. In another embodiment, the one or more cybersecurity countermeasure actions includes altering one or more portions of the network110based on the cybersecurity assessment. In another embodiment, the one or more cybersecurity countermeasure actions includes providing an optimal process condition for an asset based on the cybersecurity assessment. For example, in another embodiment, the one or more cybersecurity countermeasure actions includes adjusting a set-point and/or a schedule for an asset based on the cybersecurity assessment. In another embodiment, the one or more cybersecurity countermeasure actions includes one or more corrective actions to take for an asset based on the cybersecurity assessment. In another embodiment, the one or more cybersecurity countermeasure actions includes providing an optimal maintenance option for an asset based on the cybersecurity assessment. In another embodiment, the one or more cybersecurity countermeasure actions includes an action associated with the application services layer225, the applications layer230, and/or the core services layer235based on the cybersecurity assessment.

In certain embodiments, the cybersecurity action component308provides a dashboard visualization to an electronic interface of a computing device based on the cybersecurity assessment. In one or more embodiments, the dashboard visualization includes data associated with the cybersecurity assessment. In one or more embodiments, the dashboard visualization includes one or more metrics associated with the cybersecurity assessment. In one or more embodiments, the dashboard visualization includes a recommended asset to replace a particular asset in the industrial control system based on the cybersecurity assessment. In certain embodiments, the one or more cybersecurity countermeasure actions includes configuring the dashboard visualization (e.g., based on the cybersecurity assessment) to provide individual control of the one or more assets via the dashboard visualization. In certain embodiments, the one or more cybersecurity countermeasure actions includes configuring the dashboard visualization (e.g., based on the cybersecurity assessment) to facilitate creation of one or more work orders for the one or more assets.

In certain embodiments, the cybersecurity action component308can provide a threat level mapping of a network topology associated with the industrial control system based on the one or more cybersecurity countermeasure actions. The threat level mapping can provide one or more indicators for respective industrial assets deemed to be related to a particular cybersecurity threat level. In one or more embodiments, the cybersecurity action component308can determine and/or provide asset information for a new industrial asset to replace one or more industrial assets in the industrial control system in response to the determination that the cybersecurity threat level indicator for the respective industrial assets satisfies the defined criterion. In one or more embodiments, the cybersecurity action component308can generate an alert for an electronic interface of a computing device in response to the determination that the cybersecurity threat level indicator for the respective industrial assets satisfies the defined criterion. In one or more embodiments, the cybersecurity action component308can generate a ranking of cybersecurity countermeasure actions in response to the determination that the cybersecurity threat level indicator for the respective industrial assets satisfies the defined criterion. In certain embodiments, the ranking of cybersecurity countermeasure actions can be ranked according to respective cybersecurity threat levels and/or cybersecurity mitigation recommendations.

FIG.4illustrates a system300′ that provides an exemplary environment according to one or more described features of one or more embodiments of the disclosure. In an embodiment, the system300′ corresponds to an alternate embodiment of the system400shown inFIG.4. According to an embodiment, the system300′ includes the cybersecurity risk mitigation computer system302, the edge devices161a-161n, the asset risk assessment signature repository318and/or a computing device402. In one or more embodiments, the cybersecurity risk mitigation computer system302is in communication with the edge devices161a-161nand/or the computing device402via the network110. The computing device402is a mobile computing device, a smartphone, a tablet computer, a mobile computer, a desktop computer, a laptop computer, a workstation computer, a wearable device, a virtual reality device, an augmented reality device, or another type of computing device located remote from the cybersecurity risk mitigation computer system302.

In one or more embodiments, the cybersecurity action component308communicates one or more portions of the cybersecurity action data322to the computing device402. For example, in one or more embodiments, the cybersecurity action data322includes one or more visual elements for a visual display (e.g., a user-interactive electronic interface) of the computing device402that renders a visual representation of the data associated with the cybersecurity assessment. In certain embodiments, the visual display of the computing device402displays one or more graphical elements associated with the cybersecurity action data322(e.g., the data associated with the cybersecurity assessment). In another example, in one or more embodiments, the cybersecurity action data322includes one or notifications associated with the cybersecurity assessment. In one or more embodiments, the cybersecurity action data322allows a user associated with the computing device402to make decisions and/or perform one or more actions with respect to the cybersecurity assessment. In one or more embodiments, the cybersecurity action data322allows a user associated with the computing device402to control the one or more portions of the one or more assets (e.g., one or more portions of the edge devices161a-161n). In one or more embodiments, the cybersecurity action data322allows a user associated with the computing device402to generate one or more work orders for the one or more assets. In one or more embodiments, the cybersecurity action data322provides a report associated with the cybersecurity assessment via a display of the computing device402. In certain embodiments, the report can include a layout visualization of the industrial control system with a visual indicator that identifies particular industrial assets with a particular cybersecurity threat level. In certain embodiments, the visual indicator can be an interactive visual indicator that provides information for a recommended asset to replace the particular industrial asset with the particular cybersecurity threat level.

FIG.5illustrates a system500according to one or more embodiments of the disclosure. The system500includes the computing device402. In one or more embodiments, the computing device402employs mobile computing, augmented reality, cloud-based computing, IoT technology and/or one or more other technologies to provide performance data, video, audio, text, graphs, charts, real-time data, graphical data, one or more communications, one or more messages, one or more notifications, and/or other media data associated with the cybersecurity assessment. The computing device402includes mechanical components, electrical components, hardware components and/or software components to facilitate determining prioritized actions and/or one or more metrics associated with the asset data314. In the embodiment shown inFIG.5, the computing device402includes a visual display504, one or more speakers506, one or more cameras508, one or more microphones510, a global positioning system (GPS) device512, a gyroscope514, one or more wireless communication devices516, a power supply518, and/or a computing device system520.

In an embodiment, the visual display504is a display that facilitates presentation and/or interaction with one or more portions of the dashboard visualization data322. In one or more embodiments, the computing device402displays an electronic interface (e.g., a graphical user interface) associated with an asset performance management platform. In one or more embodiments, the visual display504is a visual display that renders one or more interactive media elements via a set of pixels. The one or more speakers506include one or more integrated speakers that project audio. The one or more cameras508include one or more cameras that employ autofocus and/or image stabilization for photo capture and/or real-time video. The one or more microphones510include one or more digital microphones that employ active noise cancellation to capture audio data. The GPS device512provides a geographic location for the computing device402. The gyroscope514provides an orientation for the computing device402. The one or more wireless communication devices516includes one or more hardware components to provide wireless communication via one or more wireless networking technologies and/or one or more short-wavelength wireless technologies. The power supply518is, for example, a power supply and/or a rechargeable battery that provides power to the visual display504, the one or more speakers506, the one or more cameras508, the one or more microphones510, the GPS device512, the gyroscope514, and/or the one or more wireless communication devices516. In certain embodiments, the dashboard visualization data322associated with the cybersecurity assessment is presented via the visual display504and/or the one or more speakers506.

FIG.6illustrates a system600that provides an exemplary environment according to one or more described features of one or more embodiments of the disclosure. According to an embodiment, the system600includes the computing device system520to provide a practical application of mitigating cybersecurity threats for an industrial network. In one or more embodiments, the user computing device system620provides a practical application of transmitting requests to perform a cybersecurity assessment of assets related the network110, to mitigate cybersecurity threats associated with the one or more assets, and/or to generate reports detailing the cybersecurity assessment. In one or more embodiments, the computing device system520provides a practical application of receiving and rendering reporting data comprising visual representations related to the cybersecurity assessment.

In an embodiment, the computing device system520facilitates interaction with the cybersecurity risk mitigation computer system302. The computing device system520includes a communication component604, an asset device component606, and/or an electronic interface component608. Additionally, in one or more embodiments, the computing device system520includes a processor610and/or a memory612. In certain embodiments, one or more aspects of the computing device system520(and/or other systems, apparatuses and/or processes disclosed herein) constitute executable instructions embodied within a computer-readable storage medium (e.g., the memory612). For instance, in an embodiment, the memory612stores computer executable component and/or executable instructions (e.g., program instructions). Furthermore, the processor610facilitates execution of the computer executable components and/or the executable instructions (e.g., the program instructions). In an example embodiment, the processor610is configured to execute instructions stored in the memory512or otherwise accessible to the processor610.

The processor610is a hardware entity (e.g., physically embodied in circuitry) capable of performing operations according to one or more embodiments of the disclosure. Alternatively, in an embodiment where the processor610is embodied as an executor of software instructions, the software instructions configure the processor610to perform one or more algorithms and/or operations described herein in response to the software instructions being executed. In an embodiment, the processor610is a single core processor, a multi-core processor, multiple processors internal to the user computing device system620, a remote processor (e.g., a processor implemented on a server), and/or a virtual machine. In certain embodiments, the processor610is in communication with the memory612, the communication component604, the asset device component606and/or the electronic interface component608via a bus to, for example, facilitate transmission of data among the processor610, the memory612, the communication component604, the asset device component606, and/or electronic interface component608. The processor610may be embodied in a number of different ways and, in certain embodiments, includes one or more processing devices configured to perform independently. Additionally or alternatively, in one or more embodiments, the processor610includes one or more processors configured in tandem via a bus to enable independent execution of instructions, pipelining of data, and/or multi-thread execution of instructions.

The memory612is non-transitory and includes, for example, one or more volatile memories and/or one or more non-volatile memories. In other words, in one or more embodiments, the memory612is an electronic storage device (e.g., a computer-readable storage medium). The memory612is configured to store information, data, content, one or more applications, one or more instructions, or the like, to enable the computing device system520to carry out various functions in accordance with one or more embodiments disclosed herein. As used herein in this disclosure, the term “component,” “system,” and the like, is a computer-related entity. For instance, “a component,” “a system,” and the like disclosed herein is either hardware, software, or a combination of hardware and software. As an example, a component is, but is not limited to, a process executed on a processor, a processor, circuitry, an executable component, a thread of instructions, a program, and/or a computer entity.

In one or more embodiments, the communication component604is configured to generate the request320. In various embodiments, the communication component604generates the request320in response to an action performed with respect to a user interface configuration for an interactive user interface rendered on a visual display via the electronic interface component608. The action can be, for example, initiating execution of an application (e.g., a mobile application) via a user computing device that presents the interactive user interface, altering an interactive graphical element via the interactive user interface, or another type of action with respect to the interactive user interface rendered via the electronic interface component608. Additionally or alternatively, in one or more embodiments, the communication component604generates the request320in response to execution of a user authentication process via a user computing device. For example, in an embodiment, the user authentication process is associated with password entry, facial recognition, biometric recognition, security key exchange, and/or another security technique associated with a user computing device.

In various embodiments, an interactive user interface is configured via the electronic interface component608as a dashboard visualization. In one or more embodiments, the request320includes a reference to one or more asset device instances that describe one or more respective physical industrial assets in the industrial control system. For instance, in one or more embodiments, the request320includes a reference to one or more asset device instances associated with the edge devices161a-161nin order to update and/or modify the configuration parameters associated with the edge devices161a-n. In one or more embodiments, the asset device instances comprise metadata related to, but not limited by, asset device identifiers, MAC addresses, IP addresses, hostnames, vendor names, operating system identifiers, data related to networking protocols being employed by the asset devices (e.g., TCP and/or UDP), device status (e.g., “pending,” or “under investigation”), historical log data such as timestamp data, identifiers corresponding to various networking devices (e.g., networking switch and/or router addresses) used by the asset device during transmission, port numbers used, and/or other descriptions.

In various embodiments, the communication component604is configured to transmit the request320. In one or more embodiments, the communication component604transmits the request320to the cybersecurity risk mitigation computer system302. In one or more embodiments, the communication component604transmits the request320via the network110.

In one or more embodiments, in response to the request320, the communication component604and/or the asset device component606is configured to receive the cybersecurity action data322from the cybersecurity risk mitigation computer system302. In certain embodiments, the communication component604and/or the asset device component606incorporates encryption capabilities to facilitate encryption and/or decryption of one or more portions of the cybersecurity action data322. Additionally, the asset device component606can work in conjunction with the electronic interface component608to render a visualization associated with the cybersecurity action data322.

In one or more embodiments, the electronic interface component608renders the cybersecurity action data322as respective interactive display elements on an interactive user interface. An interactive display element is a portion of the interactive user interface (e.g., a user-interactive electronic interface portion) that provides interaction with respect to a user of the user computing device. For example, in one or more embodiments, an interactive display element is an interactive display element associated with a set of pixels that allows a user to provide feedback and/or to perform one or more actions with respect to the interactive user interface. In an embodiment, in response to interaction with an interactive display element, the interactive user interface is dynamically altered to display one or more altered portions of the interactive user interface associated with different visual data and/or different interactive display elements. Additionally, in one or more embodiments, the electronic interface component608is configured to facilitate execution and/or initiation of one or more actions via an interactive user dashboard configured based on the cybersecurity action data322. In an embodiment, an action is executed and/or initiated via an interactive display element of the interactive user dashboard. In certain embodiments, the interactive user interface presents one or more notifications associated with the prioritized actions related to a cybersecurity assessment related to the cybersecurity action data322.

FIG.7illustrates an exemplary electronic interface700according to one or more embodiments of the disclosure. In one or more embodiments, the electronic interface700illustrates a topology for an industrial control system that includes industrial assets associated with a cybersecurity assessment as disclosed herein. For example, the electronic interface700can render a visualization for industrial assets702a-nincluded in an industrial control system that undergoes cybersecurity assessment by the cybersecurity risk mitigation computer system302. In an example, the cybersecurity assessment component306can determine one or more cybersecurity countermeasure actions for the industrial assets702a-nand the cybersecurity action component308can generate a visual indicator for the one or more cybersecurity countermeasure actions via the electronic interface700. For example, the electronic interface700can include a visual indicator704related to the industrial asset702bin response to a determination by the cybersecurity assessment component306that the industrial asset702bis related to a certain cybersecurity threat level. In another example, the electronic interface700can include a visual indicator706related to a particular connection708between two or more industrial assets from the industrial assets702a-nin response to a determination by the cybersecurity assessment component306that the connection708results in a particular cybersecurity threat for one or more industrial assets from the industrial assets702a-n.

FIG.8illustrates an exemplary flow diagram800according to one or more embodiments of the disclosure. In one or more embodiments, the flow diagram800is related to cybersecurity assessment associated with the cybersecurity risk mitigation computer system302. The flow diagram800includes a step802that identifies industrial assets in an industrial control system. At step804, cybersecurity threats related to the identified industrial assets are analyzed. At step806, a cybersecurity risk assessment related to the cybersecurity threats is performed. At808, one or more cybersecurity countermeasures related to the cybersecurity risk assessment is identified. At810, the one or more cybersecurity countermeasures are implemented. In certain embodiments, at812, cybersecurity threats related to the identified industrial assets is re-analyzed. In certain embodiment, new industrial assets in the industrial control system can then be identified to provide a new cybersecurity assessment for the industrial control system.

FIG.9illustrates a method900for cybersecurity risk assessment and mitigation for industrial control systems, in accordance with one or more embodiments described herein. The method900is associated with the cybersecurity risk mitigation computer system302, for example. For instance, in one or more embodiments, the method900is executed at a device (e.g., the cybersecurity risk mitigation computer system302) with one or more processors and a memory. In one or more embodiments, the method3000begins at block902that receives (e.g., by the cybersecurity assessment component306) a request to perform a cybersecurity assessment of a set of industrial assets within an industrial control system. In one or more embodiments, the request comprises a set of asset descriptors respectively describing an industrial asset from the set of industrial assets. In certain embodiments, the request is received in response to a change in the industrial control system. In certain embodiments, the request is received in response to an action performed via an electronic interface of a computing device.

At block904, it is determined whether the request is processed. If no, block904is repeated to determine whether the request is processed. If yes, the method900proceeds to block906. In response to the request, block906obtains, based on the set of asset descriptors (e.g., by the cybersecurity assessment component306) the set of industrial assets to industrial asset data associated with the set of industrial assets.

In response to the request, the method900additionally or alternatively includes a block908that compares (e.g., by the cybersecurity assessment component306) a first industrial asset feature set from the industrial asset data to a cybersecurity rules set stored in an asset risk assessment signature repository to determine a cybersecurity threat level indicator for respective industrial assets from the set of industrial assets. In certain embodiments, the set of asset descriptors are determined based on textual analysis of data provided via an electronic interface of a computing device. For example, in certain embodiments, the set of asset descriptors are determined based on textual analysis of one or more documents related to one or more industrial assets from the set of assets and/or one or more documents related to the industrial control system. In certain embodiments, the set of asset descriptors are determined based on a scan of a network topology associated with the industrial control system. For example, the network topology can illustrate connections and/or a layout of industrial assets within the industrial control system. In certain embodiments, the network topology can provide one or more portions of the industrial asset data. In certain embodiments, the first industrial asset feature set can be provided to a machine learning model configured to determine the cybersecurity threat level indicator based on the cybersecurity rules set. The machine learning model can be a classifier model configured to classify a cybersecurity threat level indicator for an industrial assets, a neural network model configured to predict a cybersecurity threat level indicator for an industrial assets, or another type of machine learning model.

In response to the request, the method900additionally or alternatively includes a block910that, in response to a determination that that the cybersecurity threat level indicator for the respective industrial assets satisfies a defined criterion, determines (e.g., by the cybersecurity assessment component306) one or more cybersecurity countermeasure actions for the respective industrial assets based on a comparison between a second industrial asset feature set from the industrial asset data and a predefined industrial asset feature set for a set of predefined industrial assets associated with one or more predefined cybersecurity countermeasures

In response to the request, the method900additionally or alternatively includes a block912that causes (e.g., by the cybersecurity action component308) performance of the one or more cybersecurity countermeasure actions associated with the industrial control system. In one or more embodiments, a threat level mapping of a network topology associated with the industrial control system can be provided based on the one or more cybersecurity countermeasure actions. The threat level mapping can provide one or more indicators for respective industrial assets deemed to be related to a particular cybersecurity threat level. In one or more embodiments, asset information for a new industrial asset to replace one or more industrial assets in the industrial control system can be provided in response to the determination that the cybersecurity threat level indicator for the respective industrial assets satisfies the defined criterion. In one or more embodiments, an alert for an electronic interface of a computing device can be generated in response to the determination that the cybersecurity threat level indicator for the respective industrial assets satisfies the defined criterion. In one or more embodiments, a ranking of cybersecurity countermeasure actions can be generated in response to the determination that the cybersecurity threat level indicator for the respective industrial assets satisfies the defined criterion.

FIG.10depicts an example system1000that may execute techniques presented herein.FIG.10is a simplified functional block diagram of a computer that may be configured to execute techniques described herein, according to exemplary embodiments of the present disclosure. Specifically, the computer (or “platform” as it may not be a single physical computer infrastructure) may include a data communication interface1060for packet data communication. The platform also may include a central processing unit (“CPU”)1020, in the form of one or more processors, for executing program instructions. The platform may include an internal communication bus1010, and the platform also may include a program storage and/or a data storage for various data files to be processed and/or communicated by the platform such as ROM1030and RAM1040, although the system1000may receive programming and data via network communications. The system1000also may include input and output ports1050to connect with input and output devices such as keyboards, mice, touchscreens, monitors, displays, etc. Of course, the various system functions may be implemented in a distributed fashion on a number of similar platforms, to distribute the processing load. Alternatively, the systems may be implemented by appropriate programming of one computer hardware platform.

Throughout this disclosure, references to components or modules generally refer to items that logically can be grouped together to perform a function or group of related functions. Like reference numerals are generally intended to refer to the same or similar components. Components and modules can be implemented in software, hardware, or a combination of software and hardware. The term “software” is used expansively to include not only executable code, for example machine-executable or machine-interpretable instructions, but also data structures, data stores and computing instructions stored in any suitable electronic format, including firmware, and embedded software. The terms “information” and “data” are used expansively and includes a wide variety of electronic information, including executable code; content such as text, video data, and audio data, among others; and various codes or flags. The terms “information,” “data,” and “content” are sometimes used interchangeably when permitted by context.

The hardware used to implement the various illustrative logics, logical blocks, modules, and circuits described in connection with the aspects disclosed herein can include a general purpose processor, a digital signal processor (DSP), a special-purpose processor such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA), a programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general-purpose processor can be a microprocessor, but, in the alternative, the processor can be any processor, controller, microcontroller, or state machine. A processor can also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. Alternatively, or in addition, some steps or methods can be performed by circuitry that is specific to a given function.

In one or more example embodiments, the functions described herein can be implemented by special-purpose hardware or a combination of hardware programmed by firmware or other software. In implementations relying on firmware or other software, the functions can be performed as a result of execution of one or more instructions stored on one or more non-transitory computer-readable media and/or one or more non-transitory processor-readable media. These instructions can be embodied by one or more processor-executable software modules that reside on the one or more non-transitory computer-readable or processor-readable storage media. Non-transitory computer-readable or processor-readable storage media can in this regard comprise any storage media that can be accessed by a computer or a processor. By way of example but not limitation, such non-transitory computer-readable or processor-readable media can include random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), FLASH memory, disk storage, magnetic storage devices, or the like. Disk storage, as used herein, includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk, and Blu-ray Disc™, or other storage devices that store data magnetically or optically with lasers. Combinations of the above types of media are also included within the scope of the terms non-transitory computer-readable and processor-readable media. Additionally, any combination of instructions stored on the one or more non-transitory processor-readable or computer-readable media can be referred to herein as a computer program product.

Many modifications and other embodiments of the inventions set forth herein will come to mind to one skilled in the art to which these inventions pertain having the benefit of teachings presented in the foregoing descriptions and the associated drawings. Although the figures only show certain components of the apparatus and systems described herein, it is understood that various other components can be used in conjunction with the supply management system. Therefore, it is to be understood that the inventions are not to be limited to the specific embodiments disclosed and that modifications and other embodiments are intended to be included within the scope of the appended claims. Moreover, the steps in the method described above can not necessarily occur in the order depicted in the accompanying diagrams, and in some cases one or more of the steps depicted can occur substantially simultaneously, or additional steps can be involved. Although specific terms are employed herein, they are used in a generic and descriptive sense only and not for purposes of limitation.

It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the disclosure being indicated by the following claims.