The vendor you let into the plant has been breached
The prompt — read this to the room
Your filling-machine supplier emails every customer on a Thursday afternoon: an attacker had access to its remote-support platform for at least three weeks and 'may have used customer connections'. Your beverage plant gives this supplier always-on remote access to the line controllers so it can tune machines without a site visit. Your firewall shows sessions from the supplier's platform on four evenings when the supplier says no engineer was working. Its account manager wants the connection left open because a firmware fix is scheduled for Monday. Do you cut them off, and what do you look at first?
Who to involve
Most important first.
- OT / plant engineer
- Vendor / procurement manager
- CISO / Head of security
- Incident response lead
- IT operations
- Legal counsel
What it tests
- Decide on vendor connectivity using risk evidence rather than the vendor’s schedule.
- Scope what the unexplained sessions could have reached and changed on the plant network.
- Use the contract to get logs, timelines and engineer names out of the supplier.
- Define the conditions under which supplier remote access is restored.
Outline of activities
- 1The supplier’s notice and the unexplained evening sessions
- 2Cut, restrict or monitor: the connectivity decision
- 3What the sessions touched: controller changes, files and credentials
- 4Working the contract: logs, notification duties and liability
- 5Re-admitting the supplier under new conditions
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…