All tabletop exercises
OT / ICS·Intermediate·Technical audience
A pasteuriser setpoint changes and nobody on shift did it
The prompt — read this to the room
At 02:15 the HMI at a regional dairy shows the pasteuriser hold-tube temperature setpoint has moved from 72.5°C to 68.0°C. Nobody on the night shift admits to changing it. The change log names the engineering workstation's shared login, and that workstation sits in a locked, empty office. The flow-diversion valve worked and no under-temperature milk left the line, but 9,000 litres are now held in a silo pending a decision. The morning tanker leaves at 06:00. Was this an attacker, a scheduled job or a mistake, and how do you find out without destroying the evidence?
Total duration
1 h 45 min
People to involve
6
Best fit
Manufacturing, Food
Who to involve
Most important first.
- OT / plant engineer
- Incident response lead
- SOC analyst
- IT operations
- Physical security / facilities
- CISO / Head of security
What it tests
- Restore a known-safe process state without losing the evidence needed to explain the change.
- Separate the three explanations (intrusion, automation, human error) using logs that actually exist.
- Show which OT logs, project backups and access records the team can produce within an hour.
- Decide on product release with food-safety and security evidence side by side.
Outline of activities
- 1The alarm: an unexplained setpoint change and product on hold
- 2Make it safe, then preserve: what to capture before anyone touches the PLC
- 3Three hypotheses tested against logs, badges and network data
- 4The product decision and who signs it
- 5Hardening the engineering workstation and change control
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…