Statistical Methods for Developing Cybersecurity Response Thresholds for Operational Technology Systems Using Historical Data

Abstract

Operational technology (OT) systems face increasing cybersecurity risks from adversarial behavior. A Bayesian network risk model was developed to enhance the comprehension of observable cyber events caused by malicious activity in OT environments. This paper leverages historical data to enable users to provide actionable decision intelligence. Distributions of alert thresholds are defined for the model's primary outputs using open source reporting of 27 cyber attacks affecting OT systems. The user can tune the thresholds relative to these distributions based on their relative risk tolerances. By using this approach, users can tailor the model's interpretation to their response requirements.