Visibility Metrics

Improving visibility in the control network is perhaps one of the most common recommendations from cybersecurity professionals. At this point, the main questions are 1.) how to decide what should be done first? and 2.) how to justify the investment to the plant management team?

Answering those questions requires a reliable and validated assessment of current visibility. Unfortunately, visibility is a qualitative term with no universal scale or benchmarks. As a result, the process involves dealing with a highly subjective component of the defence strategy (i.e., my concept of good visibility vs yours).

Oscar presents a simple framework to evaluate visibility through Indirect measurable parameters (i.e., proxies). The goal is to develop a formalized and verifiable procedure to assess visibility objectively.