Preparing for an incident response

Preparation and planning are essential to an organization’s ability to detect issues, minimize losses, mitigate exploited vulnerabilities, and restore computing services.


Keeping systems up and running and productive is the primary mission of every manufacturer. Even with the best cyber defense mechanisms in place, cyber incidents will likely occur. The question now remains: Is your organization prepared to properly identify what went wrong and recover?

Preparation and planning are essential to an organization's ability to respond to a cyber incident. The ability to identify the source of an incident and analyze the extent of the compromise is necessary to rapidly detect issues, minimize losses, mitigate exploited vulnerabilities, and restore computing services, according to a report in the Industrial Control System Cyber Emergency Response Team Monitor (ICS-CERT Monitor).

Cyber incidents are tense, complicated, and not often part of routine operations. When properly maintained, operational preparedness measures can ensure the availability of information necessary to recover from an incident quickly while minimizing the impact.

A senior technical staff member who has the authority to make key decisions in a timely manner should lead a dedicated incident handling team. In addition to the lead and forensics analysts, a control systems incident response team should include control systems subject matter experts and stakeholders from corporate information technology (IT)—network and host management—public relations, legal counsel, and law enforcement, if necessary.

The team should end up trained in proper incident handling techniques and should practice using the tools to establish and maintain proficiency. Control system environments have special needs that require evaluation when establishing operating procedures. An overall incident preparedness checklist should end up created and reviewed annually using a "table-top" exercise. Documentation should be accessible to operations personnel to help facilitate analysis of the incident and identify priorities for recovery. There should also be an incident response information-gathering checklist. This checklist should identify the types of information that should be collected to aid analysis by external CERTs or partners.

It is also important to establish an "out-of-band" communications policy. Any communications regarding an incident or potential incident should not go through the standard communication channels, e.g., corporate e-mail or voice over IP (VoIP) systems, as these may have already suffered compromise and will tip off the attacker you are aware of their presence in your network. In addition, any files relating to the incident or handling policy should be stored off the network under the control of the incident response team. 

Logging is vital for incident response

Logging is an important aspect of incident response. System and network device logs are essential to incident investigators. The types of logging a user should think about include firewall, proxy, domain name server (DNS), dynamic host configuration protocol (DHCP), web app, audio visual (A/V), intrusion detection system (IDS)/intrusion prevention system (IPS), and host and application logs. Additional logging to think about is flow data from routers, switches, and packet captures. This type of network data will be helpful when responding to a control system event because network-related logs are sometimes all that is available. If the control system endpoints do support logging, these, too, should undergo review for a better understanding of what took place. Log integrity is essential during an incident investigation; therefore, logs should be continuously stored on a separate system, frequently backed-up, and cryptographically hashed to allow detection of log alterations.

Other critical components of incident response are forensic data collection, analysis, and reporting. These elements are essential to preserving important evidence. Organizations should consult with trained forensic investigators for advice and assistance prior to implementing any recovery or forensic efforts.

Gregory Hale is the editor and founder of Industrial Safety and Security Source (, a news and information website covering safety and security issues in the manufacturing automation sector. This content originally appeared on Edited by Chris Vavra, production editor, CFE Media, Control Engineering,

ONLINE extra

See additional stories from ISSSource about cyber security below.

For additional information and resources on cyber incident response for industrial control systems, go to ICS-CERT's fact sheet entitled "Preparing for Incident Response."

No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Make Big Data and Industrial Internet of Things work for you, 2017 Engineers' Choice Finalists, Avoid control design pitfalls, Managing IIoT processes
Engineering Leaders Under 40; System integration improving packaging operation; Process sensing; PID velocity; Cybersecurity and functional safety
Mobile HMI; PID tuning tips; Mechatronics; Intelligent project management; Cybersecurity in Russia; Engineering education; Road to IANA
This article collection contains several articles on the Industrial Internet of Things (IIoT) and how it is transforming manufacturing.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

SCADA at the junction, Managing risk through maintenance, Moving at the speed of data
Flexible offshore fire protection; Big Data's impact on operations; Bridging the skills gap; Identifying security risks
The digital oilfield: Utilizing Big Data can yield big savings; Virtualization a real solution; Tracking SIS performance
click me