A Preliminary Risk Assessment for Operational Technology Systems

Abstract

In 2015, the German government launched Industry 4.0, which aims to increase the productivity, cost efficiency, and other aspects of the manufacturing process. Prior to this, the manufacturing process was limited to the factory floor, making it difficult to operate a supply chain from the manufacturing site to the sales department. The advent of Industry 4.0 has enabled an integrated supply chain between the two by linking information technology (IT) and operations technology (OT). However, as OT systems are connected to the Internet, they face increased risks such as cyber security. Additional non-cyber risks stemming from operational aspects in the supply chain due to the linkage of IT and OT are also expected. In this study, we conducted a risk assessment of OT systems connected to the Internet after Industry 4.0 from both cyber and non-cyber perspectives. Specifically, as an initial study, the risks of OT systems were comprehensively extracted using the Risk Breakdown Structure method and a total of 16 risk factors were identified, including the isolation of failures in OT systems and the lack of security functions in existing facilities (cyber side) and the safety management of the combined IT-OT systems (non-cyber side).