Quantifying Risk Reduction Achieved By OT Security Controls

How much does a security control reduce cyber risk? What control or mix of controls provides the most efficient cyber risk reduction? Tough questions that a team of researchers at INL and Sandia tried to answer in a project: Cyber Resilience for Wind Installations.
In this session Jake explains their quantification approach from the project, what they learned, and how they are now iterating and improving this risk reduction quantification.
Dale's note: this was one of the most interesting projects I've seen coming out of the lab. Not for the wind / DER aspects, but for the effort to come up with and use metrics. This was an invited talk.