Awareness

Question 1

Awareness

Answer 1

A cybersecurity awareness program is an initiative to educate people on cybersecurity topics and make them aware of organizational policy and their responsibilities regarding the IT and OT resources entrusted to them.

NIST 800-50 covers IT Information security awareness.

IEC62443 recommends cybersecurity in IACS should be equally emphasized as safety.

Cybersecurity awareness programs are therefore applicable to all persons.

Question 2

Effectiveness of Awareness

Answer 2

Cybersecurity awareness programs are only effective if they are tailored to the audience, consistent with company policy, and regularly communicated.

Depending on the type of audience, the awareness activities should be tailored so that the audience can relate to the context and applicable policies.

The awareness activities need to be repeated in a fashion that keeps drawing the intended audience’s attention and changes their behavior in the desired direction.

Question 3

Examples of Awareness Program

Answer 3

1- E-learning content for all IT-OT staff with assessment at the end.
2 - Red team/Blue team exercises by simulating the IACS environment.
3 - Showcasing the impact of malware infestation through simulation.
4 - Conducting Incident response drills.
5 - Board member’s session on high-impact IACS cybersecurity risks and how they affect the business.