You can't really know whether an attack is imminent. All you can do is try to identify what the security posture of the systems is, and what resources, processes, and procedures you have in place in order to identify and respond to security incidents that affect those systems.
If you really need to boil it down to KPIs, here's what I would try to quantify for each of the devices/systems in question:
- How long has it been since this system received updates/patches?
- When was this system last covered by a penetration test?
- Does the system have any known issues that are documented in your risk register? How many? Of what severity / CVSS scores?
- When was the last network security architecture review that covered the network segment(s) that the system is connected to?
- Is this system in your asset management database and is the information up to date, including contact information about key stakeholders and maintainers?
- Do you know where this device physically is? Do you know what the physical access controls are for that location? Can you easily identify who has access to, and who has recently accessed, that area?
- Do you have a documented threat model that encompasses this system?
- Do you have visibility of this system within your SIEM? If you make changes to a critical system without the proper procedures, does your SOC notice?
- Do you have specific guidance relating to this system within a security incident response playbook? If that system were to be hit by ransomware, for example, do you have a predefined set of steps to follow in order to handle that incident? Can you recover?
- Are there any regulatory requirements relating to this system? Are they being properly considered as part of your security testing process?
- Could a breach of this system lead to a safety hazard? If so, what compensating measures do you have to help minimise the risk and impact?
And more generally as an organisation:
- When did you last test the responsiveness of your security monitoring and security team? e.g. with a red team exercise.
- Do you have a plan in place for the eventuality of several of your infosec team being unavailable (e.g. due to illness) during a security incident? Are others trained to use your security incident response playbooks? Do they have the necessary access to perform the steps within them?
- When was the last time you had a comprehensive review of all of your security documentation?
- Do you train your staff on how to handle phishing attacks? Do you send phishing emails to test them?
The more of these you can answer in a positive manner, the better. But don't just answer off the cuff based on your own personal memory of your organisation's security activities. Check that the documents you think exist, do exist, are up-to-date, and are known about by your staff. Verify that the procedures work as you expect them to. Run mock incident exercises. Where you have answered no to a question, or where you find deficiencies as part of your review, ensure that you put together a list of things that need further attention.
Finally, the key part: you can't just do this once. You need to go through and do this annually, at least.
