工业控制系统与操作技术环境中的网络事件响应规划考虑因素指南（英）

GUIDANCE:ConsiderationsforCyberIncidentResponsePlanningwithinIndustrialControlSystems/OperationalTechnology.

Introduction

Thisguidanceisdesignedtohelporganisationsunderstandspecificconsiderationsthatare

requiredwithinIndustrialControlSystems(ICS)/OperationalTechnology(OT)systemsandtobetterprepareforacyberincidentwithinanICS/OTenvironment.Itisdesignedtocomplementandtobereadinconjunctionwiththe

NCSC’sgeneralIncidentResponseandManagementguidance,

and

focusesonthespecificanduniqueaspectsrelatingtoICS/OTenvironments.

HavinganeffectiveIncidentResponsePlaninplacealsosupportsseveralOutcomeswithinthe

NCSC’sCyberAssessmentFramework(CAF)

.AsummaryoftherelatedIndicatorsofGoodPractice(IGPs)coveredinthisguidanceisshownattheendofthisarticle.

IfyouareresponsibleforthemanagementormaintenanceofICS/OTassets,thisarticlewillhelpyoutonavigatethechallengesyoumayencounterwhenadoptingmatureincidentresponse

planningprocesses.

Per

NCSC’sguidance

itisimportanttoassumethatyoursystemsICS/OTwillbebreachedinthefuture,thiscouldbedueto:

•highnumbersoflegacysystemswithinICS/OTenvironments,

•limitedvisibilityintheoperationofthesystemsfromtheperspectiveofassetmanagement,

•limitedvisibilityofnetworkcommunications,

•communicationconduitstoexternalsystems.

Additionally,ICS/OTenvironments,despitebestefforts,canoftenbelackinginsegregationfromtheInformationTechnology(IT)environment,and/orsegmentationwithintheICS/OTenvironment.

Itisworthnotingthatfor

OperatorsofEssentialServices(OES)

covered

bytheSecurityofNetwork

&InformationSystemsRegulations(NIS-R)

thattheywouldberegulatedviatheuseofNCSC’sCAF

andwouldhavetohaveaccesstotheappropriateloggingandmonitoringwithintheirICS/OTenvironments.

Forthoseoperatorsthatarecoveredbythe

HealthandSafetyExecutive,OG86,Appendix2,Section

D,detailsrequirementsforIncidentResponseplanning.

WhileCyberIncidentResponsePlans(IRPs)shouldcaterforbothITandICS/OTsystems,

considerationmustbemadeforthe

keydifferentiatorsfoundinICS/OTenvironments.

So,inthisarticle,we'regoingtowalkthroughspecificconcernsinICS/OTIncidentResponsepreparationandplanning.

Wehavebrokenthespecificareasofconcerndowntothefollowing:

•Preparation

•Detection

•Triage

•Takingresponsiveaction

•TrackingandReporting

•StakeholderEngagement

•LessonsLearned

Preparation

Lessonslearnedfromrespondingtohighprofilecyber-attacksprovidesaclearmessagethat

preparationisessential,suchasthe

E-ISAC/SANSDefenseUseCase1fromtheAnalysisofthe

CyberAttackontheUkrainianPowerGrid.

Preparation-Definerolesandresponsibilities.

WhenconsideringrolesandresponsibilitieswithintheICS/OTCyberIRP,hereareacoupleofconsiderationstomake:

•ForICS/OTregardlessofwhichteamsperformanalysisand/orcollection,therolesand

responsibilitiesshouldbeclearlydefined.Thisisparticularlyimportantinrelationtoplantoperation,safetyanddecisionmakingassociatedwithproduction,quality,andsafety,

whichrequirestheidentificationandneutralisationofthethreatandbuildingconfidencethatthesystemcanbereturnedtoasafeoperationalstate.

•IncidentResponsecompaniesthatareheldonretainershouldbecapableofbeingabletoprovidesupportwithresourcesthatarecomfortableoperatinginhazardousenvironments.Insomecases,thoseresourcesmayneedtobecertifiedtooperateontheindustrialsites,soyoushouldconsiderwhotouseandhowtoon-boardthemincludinganyrequiredhealthandsafetyinductions,drugsandalcoholchecksetc.

RolesandResponsibilitiesshouldalwaysincludethefollowing:

•PlantOperations

•Safetysystemandassurancemanagers

•Productionmanagers

Forfurtherinformationonrolesandresponsibilitiespleasesee

NCSC’sGuidanceonbuildingA

CyberSecurityIncidentResponseTeam(CSIRT).

AnICS/OTspecificIncidentResponsedecisiontreedescribinghowthecommunicationwillflowthroughoutthewholeIncidentResponselifecyclewouldhelpdefinetherolesandresponsibilitiesneeded,andhowkeystakeholderswillbeintegratedandcalledon/off.

Actionpoint:DevelopanICS/OTspecificIncidentResponsedecisiontree/playbook.

ItisimportanttoestablishCross-Functionalincidentresponseteams,comprisingmembersfrombothITsecurityandICS/OTdepartments.Havingpre-designatedteamleadswhoareresponsibleforcoordinatingcommunication,decision-making,andtaskassignmentsbetweentheITsecurityandICS/OTteams.Theseindividualsandteamscansharerelevantthreatintelligence,indicatorsof

compromise(IOCs),andforensicfindingsbetweenITsecurityandICS/OTteams,acrossimplementedsecurecommunicationchannelsandinformationsharingplatforms.

Actionpoint:IdentifyandtrainkeyindividualstoactasthecoordinationpointbetweenITandICS/OTTeams.

Preparation-PrepareanICS/OTspecificCyberIncidentResponsePlan

ICS/OTsystemsandnetworksaretypicallysensitivetoavailabilityandintegrityrequirements,

requiringtheIncidentResponseprocedurestoconsiderhowsystemscanbeinteractedwithforforensiccollection.ThoseconsiderationsshouldbedocumentedinanICS/OTspecificresponseplan,whichmayhavetocaterfordifferentsystemsusedacrossanICS/OToperator’sestate,suchasdifferentsites,industrialprocesses,orfunctionalityofthesystems.

•Actionpoint:CreateanIRPthatisspecifictoyourICS/OTenvironment.KeysectionstoincludeinyourICS/OTCyberIRPincludethefollowing:

•Scope

oConsiderwhethertheICS/OTCyberIRPistobeenforced,whetheritcoversallofyourICS/OTenvironmentorisonasiteorbusinessunitbasis.Ifthelater,considerinteractionpointsandescalationroutesbetweenteams.

•Contactdetailsforkeyroles.

oAppointrolesandprovidetheircontactdetails.

•DescriptionofIncidentResponseprocesscoveringthefulllifecycleofanincident

oUseestablishedframeworkssuchasthe

SANSPICERLframework

(asshowninFigure1below)or

NIST.SP.800-61r2.

•Templatesforrecordingandreportingincidents.

oIfyouareanOperatorofEssentialService(OES),produceatemplateforthe

reportingrequirementstoassisttheIRteaminensuringthattheycapturetherightinformationinatimelymanner.

CISAhaveproducedanexcellentdocumentprovidingfurtherdetailonwhatshouldbeincluded

withinanICS/OTCyberIRP.

The

InformationCommissioner'sOfficeprovidesfurtherdetailson

reportingrequirements

forOES,althoughwithinintheUKeachCompetentAuthoritymayhavea

specificrequirement-forinstancetheDepartmentforEnergySecurity&NetZero

(

DES

NZ)provide

thefollowingguidancefortheEnergySector,whichisbasedonthresholds(seeAnnexD).

InadditiontoexercisingtheICS/OTIRPasmentionedlaterinthisarticle,trainingandawarenessofonelementscoveredwithintheplanneedtobeprovidedtothoseidentifiedwithinitashaving

responsibilities.

ActionPoint:ProvideTrainingandAwarenesstostaffinvolvedintheICS/OTIRP,sothattheyarebettertrainedfortherolestheyareresponsiblefor.

Figure1-SixPhasesintheIncidentResponsePlan(PICERL)

Detection

DetectionofcybersecurityeventsfromICS/OTnetworkshasbeenalong-standingchallengeforICS/OToperators,particularlythosewithlegacysystemswhichwerenotdesignedwithsecurityinmind.Beingabletodetect,correlateandanalyseeventsfromICS/OTiscrucialinbeingableto

respondandrecoverfromanincident.

Figure2-EventDetectioninICS/OTenvironments

FurtherguidanceandinsightsonloggingandmonitoringwithinICS/OTenvironmentsthatsupportseventdetectioncanbefoundonthe

ICSCOIWebsite.

OperatorsalsoutilisetheconceptofSecurityOperationsCentres(SOCs),withspecialisedSOCanalysts,whowillmonitoreventsona24/7

basis

.NCSChasadditionalguidanceonSOCsandthefunctionsandroleswithinthem.

Detection-People

Operations,engineering,andmaintenanceteamswillknowyoursystemsbestandhowthey

behave.Trainingtheseteamstoreportsuspiciousbehaviour,and

Buildingaculturethat

encouragesthereportingofsuspiciousbehaviour

isanecessarylong-termorganisationalactivity,thatwillincreaseeventdetectioncoverage,andalsohelpstoraiseawarenessofcybersecuritywiththosewhodonotperformcybersecurityrolesfulltime.

AusefulreferenceforwhattoconsiderwhentrainingICS/OToperatorstoreportpotentialcybersecurityeventshasbeencreatedby

NERCintheUSandisfoundhere.

•Actionpoint:Documenttheeventdetectionexamplesfromyourenvironmentinyour

ICS/OTCyberIRP.Includingnotificationscouldcomefromhelpingtoreinforcesecurity

cultureacrosstheorganisation,andregularreviewsoftheICS/OTCyberIRPcanbeusedtocheckvalidityoftheeventdetectioncapability.

Detection-Process

Securityeventsfromnetworkmonitoring,hostloggingorsecurityappliancessuchasfirewallscanbeusedbyyourICS/OTmonitoringteamstodetectandrespondtoevents.Thiscouldbetaking

decisiveandspecificactiontoanevent,oritcouldbeactivatingtheincidentresponseplanto

gathertheteamandinvestigateinmoredetail.ItcanbechallengingforICS/OToperatorstohireandretainICS/OTsecurityspecialiststoperformthemonitoringfunction.ThirdpartymonitoringarrangementscanbeconsideredtosupplementICS/OToperators’organisationalcapability.

OptionsforsupportrangefromtheintegrationofICS/OTmonitoringsolutionsintoenterpriseSOC

iSCrelatedguidance),

oroutsourcingthemonitoringtoaManagedSecurityServices

Sourcesofcybersecurityeventscanalsobefoundfromoutsideofyourownorganisation.ICS/OT

operatorscanutilisecommunitynotificationarrangementssuchas

InformationSharingand

AnalysisCenters,

monitoring

NCSCCISPnotifications

andsubscribingto

NCSC’searlywarning

system

.FurtherinformationonThreatinformationisalsoavailableonNCSCswebsite.T

heUK

governmentalsopublishedapapertohelpgovernmentdepartmentswithunderstandinghowthey

shouldhandlethreatinformation

whichoperatorswillalsofinduseful.

Detection-Technology

Detectioncapability

forICS/OTsystemsifITbasedcanrelyonthedeploymentofEndpoint,

DetectionandResponse(EDR)solutionswhicharecommonlydeployedacrossentireenterprise

networks(althoughquiteoftenabusiness/riskdecisionismadetonotenabletheresponse

solution).PassivenetworkmonitoringisoftenagoodsolutiontodeploytominimisedisruptiontoICS/OTsystemsandassetswhereactivescanningorhost-basedagentsareprohibited,impracticalordangeroustodeploy.

RegardlessofthechoicesthatICS/OToperatorsmakeintermsofthreatdetectiontechnology

deployment,services,orin-housecapability,theyshouldhaveaclearunderstandingof

what

loggingandmonitoringcoverageexiststodayfortheirenvironment

.Thisiskeytohelpunderstand

potentialgapsandimprovementstologgingandmonitoringcoverage.Evenmoreimportantly,itprovidestheincidentresponseteam(howeveritiscomposed)withaclearpictureofwhereandhowtocollectlogstofacilitateanalysis.

•Actionpoint:DevelopaCollectionManagementFramework,sometimesreferredtoasa

logginginventory,thisisdocumentedresultofdeterminingwhatloggingandmonitoringisinplaceacrossanenvironment.Thiscanincludedocumentingthingslikewherenetwork

monitoringiscurrentlydeployed,whichhostsareconfiguredwithlogforwarding.This

documentcanalsobeusedtolistoutwhereforensiccollectioncanbeperformedfrom

assets.Forexample,theremaybelittlemonitoringdeployed,butpointingoutwherelogsorimagescouldbemanuallycollectedwillstillbeveryusefultoanincidentresponseteam.

Triage

Triage-Identifycriticalsystems.

OperatorsofICS/OTshouldhaveawell-documentedinventoryidentifyingcriticalsystemsand

assets.Thesemayhavebeenidentifiedthroughbusinesscontinuityplanningactivities,risk

managementactivities,tabletopexercise's,

crownjewelanalysis

o

rCCEactivities.

Regardlessofhowtheyareformed,theyshouldbeusedtodeterminewhatmattersmosttotheICS/OT

operations,andthereforeinformtheincidentresponseteamonwheretoprioritiseeffortsforperformingtriageandforensiccollection.

Triage-scopeandscale.

ICS/OToperatorsshouldfocusonhowtoscopeoutthescaleofanincidentintermsofhowmanysystems,sitesorbusinessunitsareaffectedandintermsofhowseveretheincidentis.Thisis

importantinhelpingtoinformwhichresourcesarerequiredinternallyandexternally,whichteamsneedtobeinformed,whichregulatoryreportingneedstobeinitiated.Itisalsovitallyimportantforinformingtheteamsresponsibleforcollectingforensicevidenceorperforminganyadditional

monitoring.Collectingforensicevidenceinindustrialenvironmentsandtransferringitto

somewhereitcanbeanalysedistypicallyachallengingprocessthattakessignificantamountsoftimeandspecialisedresource(ausefulresourcedevelopedbyNISTintheUScanbefound

here)

.Beingabletousecollectioninatimelyandstrategicmannerwillreducetheloadontheincidentresponseteamandhelpthemkeepagileintheirresponseefforts.

•Actionpoint:DocumentintheICS/OTCyberIRPwheretheincidentresponseteamcanfindICS/OTspecificforensiccollectionprocedures.

•Actionpoint:Planaheadtothinkaboutwhichcollectiontoolscanbeused,bywhomandhowtheywouldbeauthorisedforuse,andhowcollectedevidencecanbesecurely

transferredtowhereitcanbeanalysed.

Takingresponsiveaction

Takingresponsiveaction-Increasedthreats

Plansshouldbeinplacetotemporarilyenhancethesecurityofyournetworkandinformation

systems.Youmaychoosetoenacttheseplansinresponsetoneworheightenedlevelsofrisk(e.g.awidespreadoutbreakofverydamagingmalware),informedbyanorganisation’ssecurity

awarenessandsourcesofthreatintelligence.

Takingresponsiveaction-Containment

Beingabletoimplementcontainmentmethodologiescanprovideresponseteamwithsomequickresponseoptionsduringanincident.Containmentmethodologiesforindustrialenvironments

shouldbeclearlydefinedandagreedaheadoftimetoallowfortheirswiftimplementationinan

authorisedmanner.ICS/OToperatorsshouldusea

zonesandconduits

modeltohelpidentify

whereandhowcontainmentcanbeimplemented.Caremustbetakenwhenconsideringand

actingtoimplementcontainmentmeasures,astheresponsibilityfordoingsowillalmostcertainlylaywiththeauthorisedoperatorsofthesystems,nottheIncidentResponseTeam.TheIncident

ResponseTeamneedtobeabletoprovidetheadvice,withoutoversteppingdesignatedplant

operatingresponsibilities.Havingpre-developed,testedandagreedcontainmentmethodologieswillobviouslydecisionsneededtobemadeduringanincident.

ConsiderationshouldbegiventothedisconnectionofthelikesofSCADAservers/workstationsandHMIsfromtheICS/OTnetworkifinfectedwithmalware.Ideallythemethodologies(likelycentredarounddisconnectingnetworksfromIT/DMZ’s/vendorremoteaccess/SiteIslandMode)willalso

clearlydescribewhattheimpactwillbetoplantoperationsinorderforstakeholderstomakeariskinformeddecision.Forexample,ifplantdisconnectionatthislocationoccurs,visibilitywillbelosttoXsystems,orservicestoYwillbeaffected.Theseactionswouldsupport:

•IsolationoftheICS/OTenvironmentifthethreatisdetectedinthewiderIT/EnterprisebusinessnetworkandhasnotyetreachedtheICS/OTenvironment.

•Topreventmalwareconnectingouttoitscommandandcontrolnetwork.

•Stopanyremoteaccessthathasbeenestablishedbyathreat.

Actionpoint:DocumentwhereandhowcontainmentcanbeimplementedacrosstheICS/OTenvironment.IncludethisinformationintheICS/OTCyberIRPalongsidetheconsequencesandpotentialconsequencesassociatedwiththeaction.Forexample,cuttingthelinkstothesystemmayreduceriskfromfurtherlateralmovementofanattacker,butmayalsoresultinalossof

visibilitytooperatorsofthesystemorvisibilityofsecuritymonitoringtothatnetworksegment.HavingdetailednetworkmappingdocumentationavailableofallconnectionsinandoutoftheICS/OTenvironmentdefiningthepurposeofeach,includingwhichconnectionsareessentialtomaintainnormaloperationsandwhatcanbesafelydisconnectedwouldsupportquicker

containmentactivities.Anotheractivitytohaveundertakentosupportquickercontainment

activitieswouldbetohaveaseparatefirewallpolicypre-definedthatlimitsconnectivitytotheminimumnecessarywhichcanbequicklyinstalledonenforcement/containmentpoints.

Takingresponsiveaction-Recovery

Iftheanalysishasdeterminedthatrecoverymeasuresarerequired,awell-documented

arrangementforperformingsystemrestorationwillbeneeded.ItiscommonforICS/OToperatorstoutilisecontrolsystemvendorsorintegratorstosupportintherecoveryandrestorationefforts.As

withcontainmentactions,theIncidentResponseteamshouldbeprovidingadviceandguidancetotheoperationsteamwhowillhaveresponsibilityformakingtherecoverydecisionandactions.

FormanyICS/OToperatorstherewillbearelianceonvendorstosupporttheprocessforrecoveryfrombackup.Therewillalsobearelianceonpromptaccesstobackups,(andforthelikesof

ProgrammableLogicControllers(PLCs),theprogrammingsoftwaretodownloadtheprogramtothePLC).FormanyICS/OTpackages,itislikelytobepossibletousestandardhardwareandoperatingsystems.However,forothervendorsolutions,morebespokehardwarewillberequired.ThiswillrequireadditionalconsiderationforICS/OToperatorsoverITrecovery/remediation.

Additionally,itisnotuncommonforthesameICS/OTsitetousemultipleversionsofthesameorsimilarsystems(whichcouldmeanthatmakingrelevantbackupsofassetsmore

challenging).Considerationshouldbegiventothefactthatassetsmayneedtobereplacedastheyhavebeenrenderedunusable,orafasterresponsetorecoverywouldbethereplacementofthe

asset.

AspartofthedocumentedarrangementforperformingsystemrestorationitwoulditbeusefulforICS/OToperatorstoworkouthowlongrestoringsystemstoaknowngoodstatewouldtake,asanoperatormighttakedifferentstepsiftheyknowthatitwouldtake2hourstowipeandrestoreknowngoodbackupsontotheirICS/OTsystemsratherthan2weeks.

Factoringsystemrestorationtimethatwouldensuresafetyandintegrityislikelytobeveryimportant,inadditiontoconsideringwhatresources(time/expertise/software/hardware)isrequiredtoachieveit.

ItisalsoimportanttomakesurethatICS/OTOperatorsknowwhethertheycouldfullyrebuildtheirsystemsiftheywereimpactedisimportant.EspeciallygiventhelegacynatureofalotofICS/OT

environments,understandingifthereareviablelikeforlikespares,orwhatwouldbedoneiffor

instancethemanufacturerofanoldWindowsbasedHMIbeenboughtoutandtheoriginalsoftwarecopyisnolongeraround.

Actionpoint:DocumentintheICS/OTCyberIRPthesupportrequiredfortherecoveryand

restorationofsystemsandindustrialprocesses,includingcontactdetailsforvendorsand/or

systemintegrators.ICS/OToperatorsmayalreadyhaveinplacearrangementsforthestorageandtestingofbackupimagesandtheacquisitionsparesforrestorationfromtheresultofbusiness

continuityplanninganddisasterrecoveryprocedures.Wherethesealreadyexist,considerifthey

canbeusedinrelationtorespondingtoacyberincident.Forexample,considerhowtestingoftheimagescanbeperformedtoensurethatbackupsarenotalsocompromised,andconsiderhowthecontainmenteffortscanbevalidatedtoensurethatareplacementsystemisnotintroducedintoanetworkwhichisstillcompromised.

Actionpoint:ReferenceBusinessContinuityPlan(BCP)andDisasterRecoveryPlan(DRP)outputsintotheICS/OTCyberIRP,listingoutorprovidingdocumentreferencestowhereandhowbackupsarecreated,stored,andtested.

TrackingandReporting

TrackingandReporting-Timelines

Buildingatimelineofanincidentiscrucialregardlessofwhetheritisacybersecurityeventin

andITorICS/OTenvironment,orwhetheritisanindustrialaccidentormalfunctionofasystemresultinginanoperationalincident.ICS/OToperatorsshouldputinplacearrangementstoensurethattheincidentresponseteamarerecordingincidenttimelinesthroughouttheincident.

Keyinformationtorecordincludes:

•Timeofeventoccurring,includingcheckingthattimefromsystemsissynchronisedoradjustedfordrift.

•Timethatinformationwasreceivedfromstakeholders.

•Timethatactionwastakenandwhoactionswereassignedto.

Actionpoint:Createatemplatethatincidentresponseproviderscanusetorecordandtrackdetailsonanincidentandincludethis(orareferencetoit)withintheICS/OTCyberIRP.

TrackingandReporting-Communicating

ICS/OTtypicallyisperformingfunctionsthatarethecoreofthebusinessintermsofrevenue

generationandwillbeperformingfunctionalitythatispreventinghazardoussituationssuchaslossofcontainment,personnelprotectionorprotectingagainstuncontrolledenvironmentaldischarges.

Therefore,itisvitallyimportantthatincidentresponseteamsareabletoadviseoperationsandsafetypersonnelontheimpactorpotentialforimpactonoperationsandthesystemsperformingsafetyfunctions.Incidentresponseteamsarerecommendedtokeepthisinmindthroughoutanincidentresponseinvestigation,andactivelyconsiderandrecordthisduringregularincident

responseupdatecalls.Regularandclearcommunicationiskeyfromtheincidentresponseteamwithotherstakeholderswhichshouldincludeoperations,health&safetyrepresentatives,

engineering,andmaintenanceteams.

Communicationsacrossteamsshouldcoverandregularlyrevisit:

•Whatisknownabouttheattackand/ormalware?(orwasitanattackorafailure/mistakeinachangeconfiguration?)

•Whatisthepotentialimpactontheplant?

•Whichsystems/siteshavebeenaffected?

•Whataretheactionsthatneedtobeassignedandtowhom?

Theuseoftemplatescanaidthesediscussionsaswellasreferringtoapredefinedandagreed

incidentseveritymatrixwhichshouldberecordedwithintheICS/OTCyberIRP.Examplesof

incidentseveritymatricesareprovidedinthe

NCSC’sIncidentManagementguidance.

AnICS/OTspecificexamplecouldbe:

•Critical–Lossofessentialserviceforextendedduration,majorequipmentdamage,offsitemultipleinjuriesorfatalities,

•High–Reductioninoperationalproduction,plantdamage/systemoutage,longtermimpactonbusinesscontinuity,onsiteinjury

•Medium–shorttermimpactonproduction,losttimeaccident,

•Low–minordeviationonlowimportancesystem

The

MitreATT&CKICSspecificframework

lists

12techniquesunderthe‘Impact’tactic

thatcouldbeconsideredwhendevelopingthismatrix.

Anunderstandingisrequiredoftheregulatoryrequirementsrelatedtoincidentreportingand

complianceobligationsspecifictoICS/OTenvironments.Nominatedindividualsshouldnotify

regulatoryagenciesasrequiredbyapplicableregulationsandstandards,providingtimelyand

accurateinformationabouttheincidentandremediationefforts.Identifiedstaffshouldwork

closelywithlegalteamstonavigatethelegalandregulatoryconsiderationsassociatedwith

incidentresponse,suchaspreservingevidenceforpotentiallegalproceedingsandcomplyingwithdataprotectionlaws.

Actionpoint:DecideanddocumenttheICS/OTincidentseveritymatrixalignedtoyourICS/OToperations.

LessonsLearned

Aswithanyincidentresponseorprojectcloseout,takingthetimetodiscuss,documentand

disseminatelessonslearnedarekeytoimprovinganorganisationscapability.ThisisnodifferentforICS/OTincidentresponsebutisprovidedheretoensureitisnotforgotten.Itisrecommendedto

includethefollowareasforconsiderationduringanylessonslearnedactivities:

•Whatwentwell,wherecanwecelebratethecapabilityandcommitmentfromourteams?

•Howcanweensurewecanbetterprotectanddetectagainsttheattackvector?

•Whatweretheblockerstomakingdecisions?

•Whereareimprovementsrequiredonmonitoringandloggingcoverage?

•Whatnewcriticalassetswereidentified?(andfedbackintothetriageprocess).

LessonsLearned-TestingCapability

Whilelearningfromarealincidentisveryuseful.Thereisnobetterwayoftestinganorganisation’sabilitytoperformincidentresponsethantotestit.Oftentheterm“exercising”conducesthoughtsthatanexercisemustinvolveasignificantamountofplanningandtimeawayfromaday-jobforkeyoperationalstaff.However,exercisingcanandshouldincludearangeofwalk-throughs,drills,

tabletopexercisesuptocompany-wideandsector-wideexercises

.NCSCguidance

isavailable

providingeffectivestepstocreatingacybersecurityexercise.Examplesofexercisingcapabilitycanincludethefollowing:

•Gamificationusing

decisionsanddisruptions

orsimilar.

•Rehearsalofconceptdrill

•TeamwalkthroughofCyberIRPand/orprocedure

•

Genericscenariotabletopexercises

•Customisedtabletopexercisecraftedtobespecifictosystems,operationsandproceduresusedbytheoperator.

•Sector-wideexercisesuchas

PowerPlay

and

GridEx

Tabletopexercisesareveryusefulforexercisinganoperator'sabilitytoactivateanICS/OTincidentresponseteam,andworkincollaborationwithotherteamsincludingcorporatecommunications,operationsandlegal.ForICS/OT,thereisoftenaneedtoensurethatthereissufficientcyber

securitymaturityofanoperatorpriortoundertakingareasonablysizedtabletopexercise(i.e.½