The safety system trips while you are hunting an intruder in the plant
The prompt — read this to the room
You are on day two of investigating suspicious traffic inside the control network of a chemical blending plant. Responders have a laptop on the OT switch capturing packets. At 14:20 the safety instrumented system trips reactor R-3 on high pressure, venting to the flare and closing the feed valves. The control room saw the pressure transmitter spike, but two field gauges read normal throughout. Operators want to reset the safety system and restart the batch, which is worth $400,000. The responders want the safety controller left untouched until they know whether anyone has reached it. Who decides?
Who to involve
Most important first.
- OT / plant engineer
- Incident response lead
- CISO / Head of security
- SOC analyst
- IT operations
What it tests
- Agree a decision rule for a safety-system trip during a live security investigation.
- Distinguish a genuine process upset, an instrument fault and a manipulated signal using available evidence.
- Decide when, and on what evidence, the safety controller can be trusted again.
- Show that responders’ own tools on the OT network are controlled and cannot cause harm.
Outline of activities
- 1Day-two context: what the hunt has found so far
- 2The trip: real upset, faulty transmitter or manipulated signal?
- 3Restart pressure versus preserving the safety controller
- 4Proving the safety system is trustworthy before restart
- 5Rules of engagement for responders working on OT networks
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…