Our goal as IDA; risks arising from the intertwining of developments in recent years and especially IT / OT systems.
To identify these risks by using world-accepted security frameworks and standards to help manage it. These process also improve the security of OT systems and system infrastructures and includes solutions to increase visibility levels.
The whole process is based on IEC62443 standards and good practices within the “NIST Cyber Security Framework”. This process can be considered as a roadmap for organizations. With the NIST Framework,Current Profile and Target profile is defined. Current Profile shows the current status of the organization’s cybersecurity activities, while Target Profile, defines the level of cyber security that the organization wants to achieve.
The NIST Framework addresses the risk management of all systems that can be incorporated into an organization’s existing cybersecurity enhancements.
These process are done on the basis of NIST by following the steps below;
1 Scope;Goals and high-level priorities are set. Which systems and which processes are in the cyber security program?
will be taken into consideration.
2 Extraction of Inventory; Within the scope, legal or regulatory requirements and systems related to the overall risk approach; and
assets are identified. This study is done in a format that will be ready for the risk assessment stage.
3 Current Situation Analysis; After the studies, showing the current situation according to the results of the relevant category.
Existing Profile is created.
4 Risk Assessment; Relevant systems and assets, according to regulatory requirements and identified risk approach
are identified, and then threats and vulnerabilities to these systems and assets are identified.
5 Target Profiling; Categories, organizational goals, and legal implications that define targeted cybersecurity outcomes
It is evaluated by taking into account the requirements related to compliance and a Target Profile is created.
6 Differentiation, Analysis and Prioritization; The differences are addressed by comparing the Current Profile with the Target Profile, Target
In order to reach the Profile, an action plan for differences is prepared and resources are determined.
7 Implementing the Action Plan; It is determined what measures will be taken to address the gaps mentioned in the previous step, and
Then, the necessary applications and processes to reach the Target Profile are defined and an action plan is created.