1.5.4 Risk management Active risk management is a crucial element of improving ICT resilience by means of a defence-in-depth strategy. This should take the business’s appetite for risk into account. It is therefore important that the organisational unit in charge of operating and maintaining ICT systems is familiar with the methods and procedures of risk management within the organisation, and is able to apply these to cyber risks. The aim of the cyber risk process is to identify potential threats to the ICT systems, applications and data that are to be protected, to assess them, and to define how the identified risks are to be dealt with. The overall risk process is broken down into three sub-processes: risk analysis, risk assessment and risk response (taking the appropriate action). To review the effectiveness of this action, risks are re-evaluated all the time, and any changes reported. Where necessary, action may then be amended accordingly. There is no such thing as absolute security. That is why the management of the business must determine its appetite for risk. protect all (ICT) assets against all types of risk. The company’s resources should be deployed to ensure effective protection against known risks, as well as comprehensive monitoring of potential future risks. The resulting measures must cover ICT systems in their entirety. This includes people, procedures, properties, data and devices. An attacker only poses a threat to an ICT system if they succeed in exploiting a vulnerability in one of these elements. Organisations and businesses must monitor their security measures continuously, and adapt them to new threats where necessary. 1.6.2 Industrial control systems (ICS) The complex architecture of ICS means that, in the worst case, vulnerabilities can remain undetected for a very long time, and the corresponding exploits represent what is known as an advanced persistent threat (APT). Implementing a defence-indepth concept, as described above, offers appropriate protection against these threats. The following are typical methods of attacking ICS: 1.6 Elements of a defence-in-depth strategy 1.6.1 The defence-in-depth concept A business’s cybersecurity strategy must be geared to protecting the critical ICT assets that are required for its business processes. This demands a multi-layered approach that is known internationally as ‘defence in depth’. It refers to the coordinated use of multiple security measures to protect the ICT assets within the business. The strategy is based on the military principle that it is more difficult for an enemy to penetrate a complex, multilayered system of defence than a single barrier. At the same time, the methods and modus operandi of potential attackers are observed as a basis for the corresponding defence plan. In a cybersecurity context, a defence-in-depth concept is designed to recognise breaches in ICT security, to respond to them, and to minimise or mitigate the consequences of those security breaches. Defence in depth takes an holistic approach which seeks to • Attacks via the internet to an ICS that is accessible online, with the aim of establishing permanent remote access. • Remote access to the ICS using stolen access data. • Attacks on ICS by exploiting vulnerabilities in the web interface. • Planting malware in the ICS via compromised data carriers (e.g. USB sticks, smartphones, etc.) • Attacks on office systems (e.g. via phishing mails, drive-by infections, etc.) with the aim of penetrating the ICS via any interface. When implementing defence-in-depth concepts, it must be remembered that there are important differences between office systems and an ICS. Table 1 shows the security issues and their differing importance with regard to ICT and ICS. Minimum ICT standard 2018 6