In this chapter we have taken the first steps toward creating a security posture and program for our ICS. We discovered the assets in play, their specifics and their importance in the overall process (know what you have) and we intelligently looked at all the possible ways things can go wrong with the discovered assets (know what is wrong with what you have). We are now in a position to effectively spend our security budget on controls that have the biggest impact, securing the assets we need the most.
In the next chapter we will embark into the mitigation and prevention material of this book with a primer on ICS security reference architecture.
