Preparing for an incident response

Preparation and planning are essential to an organization’s ability to detect issues, minimize losses, mitigate exploited vulnerabilities, and restore computing services.


Keeping systems up and running and productive is the primary mission of every manufacturer. Even with the best cyber defense mechanisms in place, cyber incidents will likely occur. The question now remains: Is your organization prepared to properly identify what went wrong and recover?

Preparation and planning are essential to an organization's ability to respond to a cyber incident. The ability to identify the source of an incident and analyze the extent of the compromise is necessary to rapidly detect issues, minimize losses, mitigate exploited vulnerabilities, and restore computing services, according to a report in the Industrial Control System Cyber Emergency Response Team Monitor (ICS-CERT Monitor).

Cyber incidents are tense, complicated, and not often part of routine operations. When properly maintained, operational preparedness measures can ensure the availability of information necessary to recover from an incident quickly while minimizing the impact.

A senior technical staff member who has the authority to make key decisions in a timely manner should lead a dedicated incident handling team. In addition to the lead and forensics analysts, a control systems incident response team should include control systems subject matter experts and stakeholders from corporate information technology (IT)—network and host management—public relations, legal counsel, and law enforcement, if necessary.

The team should end up trained in proper incident handling techniques and should practice using the tools to establish and maintain proficiency. Control system environments have special needs that require evaluation when establishing operating procedures. An overall incident preparedness checklist should end up created and reviewed annually using a "table-top" exercise. Documentation should be accessible to operations personnel to help facilitate analysis of the incident and identify priorities for recovery. There should also be an incident response information-gathering checklist. This checklist should identify the types of information that should be collected to aid analysis by external CERTs or partners.

It is also important to establish an "out-of-band" communications policy. Any communications regarding an incident or potential incident should not go through the standard communication channels, e.g., corporate e-mail or voice over IP (VoIP) systems, as these may have already suffered compromise and will tip off the attacker you are aware of their presence in your network. In addition, any files relating to the incident or handling policy should be stored off the network under the control of the incident response team. 

Logging is vital for incident response

Logging is an important aspect of incident response. System and network device logs are essential to incident investigators. The types of logging a user should think about include firewall, proxy, domain name server (DNS), dynamic host configuration protocol (DHCP), web app, audio visual (A/V), intrusion detection system (IDS)/intrusion prevention system (IPS), and host and application logs. Additional logging to think about is flow data from routers, switches, and packet captures. This type of network data will be helpful when responding to a control system event because network-related logs are sometimes all that is available. If the control system endpoints do support logging, these, too, should undergo review for a better understanding of what took place. Log integrity is essential during an incident investigation; therefore, logs should be continuously stored on a separate system, frequently backed-up, and cryptographically hashed to allow detection of log alterations.

Other critical components of incident response are forensic data collection, analysis, and reporting. These elements are essential to preserving important evidence. Organizations should consult with trained forensic investigators for advice and assistance prior to implementing any recovery or forensic efforts.

Gregory Hale is the editor and founder of Industrial Safety and Security Source (, a news and information website covering safety and security issues in the manufacturing automation sector. This content originally appeared on Edited by Chris Vavra, production editor, CFE Media, Control Engineering,

ONLINE extra

See additional stories from ISSSource about cyber security below.

For additional information and resources on cyber incident response for industrial control systems, go to ICS-CERT's fact sheet entitled "Preparing for Incident Response."

No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
Each year, a panel of Control Engineering and Plant Engineering editors and industry expert judges select the System Integrator of the Year Award winners in three categories.
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Additive manufacturing benefits; HMI and sensor tips; System integrator advice; Innovations from the industry
Robotic safety, collaboration, standards; DCS migration tips; IT/OT convergence; 2017 Control Engineering Salary and Career Survey
Integrated mobility; Artificial intelligence; Predictive motion control; Sensors and control system inputs; Asset Management; Cybersecurity
Featured articles highlight technologies that enable the Industrial Internet of Things, IIoT-related products and strategies to get data more easily to the user.
This article collection contains several articles on how automation and controls are helping human-machine interface (HMI) hardware and software advance.
This digital report will explore several aspects of how IIoT will transform manufacturing in the coming years.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Infrastructure for natural gas expansion; Artificial lift methods; Disruptive technology and fugitive gas emissions
Mobility as the means to offshore innovation; Preventing another Deepwater Horizon; ROVs as subsea robots; SCADA and the radio spectrum
Future of oil and gas projects; Reservoir models; The importance of SCADA to oil and gas
Automation Engineer; Wood Group
System Integrator; Cross Integrated Systems Group
Jose S. Vasquez, Jr.
Fire & Life Safety Engineer; Technip USA Inc.
This course focuses on climate analysis, appropriateness of cooling system selection, and combining cooling systems.
This course will help identify and reveal electrical hazards and identify the solutions to implementing and maintaining a safe work environment.
This course explains how maintaining power and communication systems through emergency power-generation systems is critical.
click me