Chapter 23 — Critical infrastructure and sector security: methods I | Bachelor's Critical infrastructure and sector security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 23 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["23.1 A structured risk assessment"]
  N2["23.2 The trouble with matrices"]
  N3["23.3 Consequence-first"]
  N4["23.5 Practical activity"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["23.1 A structured risk assessment"]
  N2["23.2 The trouble with matrices"]
  N3["23.3 Consequence-first"]
  N4["23.5 Practical activity"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX045"]

[Learning outcomes and connection]
    |
    v
[23.1 A structured risk assessment]
    |
    v
[23.2 The trouble with matrices]
    |
    v
[23.3 Consequence-first]
    |
    v
[23.5 Practical activity]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes and connection

After this chapter you can (1) carry out a structured risk assessment following the stages in NIST SP 800-30; (2) explain the weaknesses of risk matrices; (3) apply a consequence-first approach that starts from the worst effects on the service; and (4) compare the two approaches on one case and say when each is appropriate. It builds on Chapters 1, 12, 15 and 19–22 and prepares Chapter 24 (controls) and Chapter 26 (methods II).

23.1 A structured risk assessment

NIST SP 800-30 describes risk assessment in stages: prepare (purpose, scope, assumptions, sources); conduct (identify threat sources and events, vulnerabilities and predisposing conditions, determine likelihood and impact, determine risk); communicate results; and maintain the assessment as things change (SP 800-30 Rev. 1). The method's strength is discipline: it forces you to write down scope and assumptions, and to say where each judgement came from. Its outputs are usually qualitative ratings (very low to very high) on scales the organisation defines.

23.2 The trouble with matrices

Many organisations combine likelihood and impact ratings in a 5×5 risk matrix. Matrices are easy to communicate but have known problems. Ordinal labels ("3 = possible") are multiplied as if they were numbers. Very different risks receive the same cell. Rare, catastrophic events land in the same colour as frequent minor ones. Ratings depend heavily on who is in the room. Chapter 1's habit helps: where possible, put rough quantities behind the labels (an annual probability range, an outage duration, a harm), and show the worst credible consequence separately from the rating.

23.3 Consequence-first

For critical services, likelihood is often the least knowable input: adversaries adapt, and the events that matter most are rare. A consequence-first approach starts from the other end: identify the outcomes that must not happen (loss of water supply to the hospital for more than 8 hours; uncontrolled chlorine dosing), trace which functions and systems could cause them, and ask what an adversary or failure would need to achieve each. Idaho National Laboratory's Consequence-driven Cyber-informed Engineering (CCE) formalises this: identify high-consequence events, map the systems involved, illuminate the paths an adversary would take, and mitigate — preferably with engineering changes that remove the possibility rather than detect it (INL CCE). ISA/IEC 62443-3-2 also bases its risk assessment for system design on zones, conduits and consequences (IEC 62443-3-2 catalogue page).

23.4 Worked example: chlorine dosing at CW (synthetic)

This case is synthetic. Risk-matrix view: the threat "unauthorised change to chlorine dosing setpoint" is rated likelihood 2 (unlikely) and impact 5 (severe) = 10, amber. The register says "monitor". Consequence-first view: the unacceptable outcome is "water leaving the works with chlorine outside safe limits for long enough to harm customers". Paths: a setpoint change from the HMI (operator error or compromise); a forged command to the dosing PLC over the control network; a sensor reporting false residual chlorine so the controller over-doses; a vendor laptop connected to the PLC. Engineering mitigations that do not depend on detecting the attacker: a hard-wired maximum dosing-pump rate; an independent residual-chlorine analyser on the outlet that trips the outlet valve via a separate circuit; a physical key switch for PLC programming mode. The matrix said "monitor"; the consequence analysis produced three concrete changes, one of which (the hard limit) removes the most dangerous outcome regardless of how the attacker got in.

23.5 Practical activity

Take Calder Transit's light-rail signalling. Write one unacceptable consequence, three paths to it (at least one non-malicious), and one engineering mitigation that removes or bounds the consequence. Then rate the same scenario on a 5×5 matrix and compare what each approach told you.

For signalling, an unacceptable consequence might be "two trains authorised into the same block". Paths include a corrupted interlocking configuration after maintenance (non-malicious), a forged command from a compromised control workstation, and a failed track circuit misread as clear. An engineering mitigation is the interlocking's own safety logic, independent of the control workstation. On a 5×5 matrix the same scenario may score 5 for impact and 1 for likelihood, giving a cell that understates it.

23.6 Common errors and limits

Multiplying ordinal labels as if they were measurements.
Rating likelihood for novel adversary actions with false confidence.
Treating "monitor" as a mitigation.
Consequence-first analysis that only lists consequences and never maps paths or mitigations.
Ignoring non-malicious paths to the same consequence.

The chlorine example shows the third error directly: the matrix result "monitor" left the dangerous outcome possible. The first error produced its score of 10. The consequence analysis avoided the fourth by naming paths and mitigations, and the fifth by listing operator error and false sensor readings as paths beside compromise.

Exercises — chapter 23

EX045 — Same cell, different risk. Objective: expose matrix limits. Inputs: risk A: likelihood 5, impact 2 (daily nuisance outages of the staff Wi-Fi); risk B: likelihood 2, impact 5 (loss of CVH theatre ventilation). Steps: compute both matrix scores, explain why the equal score misleads and propose how to present them instead. Expected evidence: scores and explanation. Rubric: 3 = both 10; explains ordinal misuse and the different nature of harm; proposes separate worst-credible-consequence column or quantitative ranges; 2 = partial; 1 = scores only; 0 = none.

EX046 — Consequence-first. Objective: apply the method. Inputs: Calder Mutual's payment switch. Steps: define one unacceptable consequence, map three paths and give one engineering mitigation and one procedural one. Expected evidence: the analysis. Rubric: 3 = specific consequence (e.g. fraudulent high-value transfers released, or payments unavailable > 4 h on salary day), plausible paths including insider/error, engineering mitigation (hard transaction limits, out-of-band confirmation) and procedural one; 2 = generic; 1 = consequence only; 0 = none.

Chapter synthesis

Structured risk assessment brings discipline to scope, assumptions and judgement; risk matrices simplify communication but distort comparisons. Consequence-first methods such as CCE start from what must not happen and favour engineering mitigations that bound harm regardless of the attacker. Use both, and say which one drives each recommendation.