Towards Cost-Balanced Intrusion Detection in OT Environments

Conventionally isolated operational technology (OT) networks continue to merge with modern information technology (IT) networks in the pursuit of increased efficiency and ease-of-use. This interconnectedness introduces significant cybersecurity risks, which in turn prompts the adoption of IT security controls such as intrusion detection systems (IDSes). To manage the resulting alerts, organizations typically hire some dedicated staff to investigate as many alerts as possible, while ignoring any that cannot be acted upon in time. By contrast, we describe an economic approach that can identify a more optimal allocation of resources to investigate IDS alerts that minimizes overall expected costs. Using this economic model, we determine multiple filtering configurations of an anomaly-based IDS for electric utility and additive manufacturing OT environments. Through the use of open source information, we estimate costs associated with classification errors, allowing us to identify the economically-informed optimal filter configuration. By varying the annual malicious alert probability, we calculate estimated costs and recommended security analyst counts for a set of hypothetical scenarios.