-
Industrial
- Healthcare
-
Commercial
- Public Sector
- Threat Research
- Partners
-
Resources
Featured Content
- Company
Blog / 1 min read
When it comes to administering security patches for security flaws within your operational technology (OT) environment, risk should be your north star guiding all decisions. As I discussed at length in a previous blog, visibility is the foundation of OT vulnerability management, but that's just the first step.
Once you have pinpointed which common vulnerabilities and exposures (CVEs) are present on which OT assets, you must evaluate the likelihood and potential impact of exploitation for each CVE and set your priorities accordingly. In doing so, however, you will need to overcome some fundamental challenges related to OT vulnerability patch prioritization:
The extent to which a particular vulnerability poses risk to an OT environment varies on a case-by-case basis. Unique network characteristics can influence the likelihood and potential impact of a vulnerability being exploited, but assessing these factors is a complex, nuanced, and technically demanding endeavor. As such, many OT security solutions simply define a vulnerability's risk based on its CVE criticality score, which does not take situational context into account.
The newly enhanced Claroty Platform addresses these challenges with its risk scoring capabilities, assessing the level of risk a particular vulnerability poses with your OT environment based on the unique context and specific circumstances. Risk scoring is complemented by Claroty's Attack Vector Mapping feature, which identifies and visualizes which vulnerabilities pose the greatest risk to which critical assets. With the latest Claroty Platform 4.1 enhancements, users can now see potential attack vectors ranked by level of risk pose, providing users with a clear sense of their priorities for taking the most effective course of action. Users can also leverage Claroty's Hygiene Score to assess the security of their OT environment on a holistic level over time, with the ability to discover how vulnerabilities, security controls, threats, and other variables affect their overall posture.
