SEPTEMBER: Response
Whether you identify a cyber incident through your detection program, a ransomware message on a screen, or all your OT crashing, you need to be able to respond. Unfortunately, most asset owners begin planning their OT cyber incident response after the incident occurred. Not you though. You will start planning this month.
The month begins by leveraging your detection efforts in September. What do you do when a detection event happens? And is the defined procedure under control? The month continues then with some basic and initial incident response tasks. You won’t have a full OT cyber incident response plan at the end of October, but you will be much better positioned to respond during and after a cyber attack.
Week 35: Create Cybersecurity Call Outs
Call outs are common in Operations. If this happens, contact this person, take this action, watch this reading, order this maintenance, … Your task this week is to create OT detection call outs, the beginning of response. These call outs are actions assigned to roles....
Week 36: Validate Detection And Call Outs
Does your detection work? Will it identify aspects of a cyber attack as designed? Will it present the events / alerts / information to the appropriate role? Does that role understand their Call Outs? This week you will test each detection source and each Call Out...
Week 37: Identify The OT Incident Response Team
Regardless of your OT incident response plan status, non-existent to mature and tested, this week’s task is to identify the OT incident response team members. If you had an OT cyber incident, who would you involve in the response? List them and their roles / area of...
Week 38: Review Or Create Your Cyber Narrative
Your company has had a cyber incident that impacts OT and Operations. You may need to communicate with your customers, investors, media, regulators, government agencies and others. While the details of the cyber incident will affect what is said, your company should...