Shiny Object Syndrome ... Is OT Anomaly Detection Worth It?

Rebekah Mohr of Accenture begins by talking about her experience in the early days of anomaly detection in OT. When she didn't select it, or even want it, and one day it generated so much traffic that it caused an outage resulting in a $1M+ loss. And then it was unplugged.
In this session she asks and answers three important questions:
1. How much risk does anomaly detection actually reduce?
2. How much does it cost to get those risk reduction benefits? (this is in real numbers, not hand waving)
3. Is this cost worth the benefits? (Rebekah spends some time analyzing this using bow-tie analysis, and considers other areas to spend this money)
Have we once again fallen into the shiny object syndrome?

[@hmedrano81]

Such a good presentation. I totally agree the asset owners should sort out their network and put basic controls in place before deploying a threat detection tool.

[@ppye2102]

The video is about the cost of building & maintaining in-house OT SOC vs. spending the money on other Security controls & security maintenance of these controls. A 3rd way is to use Outsourced Managed OT SOC services, most of the fixed costs would be sunk across multiple customers, hence reaching economies of scale.

[@Numulagam]

glad to see that she is aware of how its at the plant. Good one!