Patch management for industrial control systems
For patch management of an industrial control system, predicted temporal evolution of risk due to vulnerability is provided to industrial control system operators to help schedule patching. A Markov chain representing the temporal evolution uses asset (e.g., industrial control system component) specific information to determine risk over time. This risk information may be used to prioritize and/or schedule patching. The operator is provided more information to help manage patching of the industrial control system, allowing better balancing of risk with manufacturing burden.
1. A method for patch management of an industrial control system, the industrial control system operably connected to a plurality of assets, the method comprising:
determining criticality rankings for each of the plurality of assets;
acquiring a vulnerability information for each of the plurality of assets, the combination of the asset and its associated vulnerability information defining a pair;
modeling a temporal evolution of the vulnerability information for each pair with a Markov chain, each temporal evolution including at least three states for the vulnerability and predicted times of transition between the states;
acquiring a patch for at least one of the pairs;
determining a current state and a time to transition to a subsequent state for each of the pairs;
determining a risk level for each of the pairs, the risk level based on the current state and the criticality rankings for the pair; and
comparing the risk level for each pair to a threshold risk level and the predicted time to transition to the subsequent state to define a time period during which patches must be installed, wherein acquiring comprises acquiring Common Vulnerability Scoring System information as the vulnerability information, and wherein modeling comprises modeling the temporal evolution of an exploit code maturity of the Common Vulnerability Scoring System information, the at least three states being proof-of-concept, functional, and high of the exploit code maturity.
2. The method of claim 1 wherein acquiring comprises acquiring the vulnerability information for a programmable logic controller, a remote terminal unit, a supervisory control and acquisition system, or a human-machine interface system for a manufacturing process.
3. The method of claim 1 wherein acquiring further comprises acquiring a time from disclosure of the vulnerability and information about exploitation of the vulnerability.
4. The method of claim 1 wherein transmitting comprises transmitting the first state as a current state and the first predicted time as a time to reach a threshold risk of exploitation of the vulnerability.
5. The method of claim 1 wherein transmitting comprise transmitting probabilities for the at least three states and probabilities for the predicted times.
6. The method of claim 1 wherein determining comprises calculating an aging rate of the vulnerability and an aging probability from an average time to disclosure, and calculating a risk score distribution across the at least three states as a cost of the Markov chain.
7. The method of claim 1 wherein transmitting further comprises transmitting a schedule to install the patch on the industrial control system based on the first predicted time.
8. The method of claim 1 wherein determining comprises determining as a function of asset exposure, asset criticality, or both of the industrial control system.
9. The method of claim 1 wherein acquiring further comprises acquiring a patch installation rate, wherein modeling comprises modeling as a function of the patch installation rate, and wherein transmitting further comprises transmitting a predicted time in a highest risk of the at least three states before the patch is applied.
10. The method of claim 1 wherein transmitting comprises transmitting the first state and the first predicted time in a visual representation of the Markov chain.
11. The method of claim 1 wherein determining comprises determining for a current time and further comprising repeating the determining for a user selected time.