Beyond yes or no: Managing risks patching in critical infrastructure

Effective patch management in operational technology (OT) is primarily a strategic decision centered around risk management. This session will introduce attendees to a comprehensive, iterative approach to OT patching, designed specifically to navigate the unique challenges that arise in this field. These challenges include the complexity of system lifecycles, potential risks associated with exploitation, and the overarching importance of maintaining operational safety.

Attendees will gain insights into the practicalities of prioritising vulnerabilities through the Stakeholder-Specific Vulnerability Categorization (SSVC) method. This method provides a structured framework that integrates critical factors such as Common Vulnerability Scoring System (CVSS) scores, the current status of exploitability, and the tangible impacts that vulnerabilities may have on business operations and processes. By the end of the session, attendees will be equipped with the knowledge to make informed decisions that enhance the security posture of their OT environments while balancing safety and operational efficiency.