MaRCH: IT Outages And Recovery Objectives
We tackle two related topics in March. First, you need to understand OT’s reliance on IT. This is increasingly important as ransomware and other attacks are taking out IT and causing a downstream impact on Operations, even when OT is uncompromised.
Second, you need to understand your company’s recovery requirements and your ability to meet the recovery requirements in OT and Operations.
Week 10: What Systems On IT Does OT Rely On?
The most frequent category of a cyber attack caused outage in OT and Operations, is ransomware infecting systems on the IT network, also called the corporate or enterprise network. Stated another way, most cyber incidents causing an outage in Operations never reach...
Week 11: What Is Your “Island Mode”? Your Response To A Compromise On IT
Your IT network has been compromised. Your OT network seems to be working fine, but you’re worried that the compromise will spread to OT. What do you do? Colonial Pipeline faced this situation in 2021 when ransomware infected their IT network. Their response? Shut...
Week 12: Identify The Recovery Time Objective (RTO)
Your manufacturing line is down. How fast do you need to have it back in operation to avoid a high or catastrophic consequence that you identified in Weeks 11 – 12? The same “how fast do you need it back in operation to avoid a high or catastrophic consequence”...
Week 13: Evaluate The Ability To Recover And Meet The RTO (1st Pass)
In Week 21 you identified the recovery time objective (RTO). Your task this week is to evaluate, at a high level via interview and inspection, if that RTO can be credibly met. Assume a scenario where everything with an IP address in IT and OT has been compromised and...