At a recent meeting of ICS Security “experts,” the discussion turned to risk-assessment standards. I posed the question: Why are are we so infatuated with the Risk Equation when it offers so little guidance. “Why not use consequences and defenses?” I asked. “Isn’t that how most Engineers and Operators think?” “Risk is what they understand […]