All tabletop exercises
OT / ICS·Advanced·Mixed audience
Ransomware jumps from the office network to the plant floor
The prompt — read this to the room
It is 05:40 on a Monday at a 900-person auto-parts manufacturer running three shifts. Office laptops started showing ransom notes an hour ago. Now the night-shift supervisor reports that two HMI screens on the stamping line show the same note, and the historian server has stopped updating. The PLCs are still running and the presses are still making parts, but operators can no longer see process values on screen. The first shift arrives in 80 minutes. Do you keep the line running blind, shut it down, or cut the plant off from the corporate network first?
Total duration
2 h 30 min
People to involve
7
Best fit
Manufacturing
Who to involve
Most important first.
- OT / plant engineer
- CISO / Head of security
- Incident response lead
- IT operations
- CEO / Managing director
- Legal counsel
- Communications / PR
What it tests
- Decide whether and how to sever IT/OT connectivity, and show who holds the authority to do it.
- Establish whether the line can run safely without HMI visibility, and the conditions that force a stop.
- Agree a recovery order for IT and OT systems that does not reinfect restored plant assets.
- Produce customer, staff and media statements that match what is actually known.
Outline of activities
- 1Night-shift report: ransom notes on HMIs and a silent historian
- 2The isolation call: who can cut the IT/OT link, and how fast
- 3Running blind: safety limits, manual operation and the shift change
- 4Scoping: how the malware crossed and which plant assets it touched
- 5Recovery order, customer deliveries and outside pressure
- 6Debrief against the decision log
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…