Chapter 11 — Incident response for hospital building systems
Lesson map
Lesson 11 published. Map, example, EX051.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Planning ahead"]
N2["11.2 Detect and assess"]
N3["11.3 Contain"]
N4["11.4 Evidence and recovery"]
N5["11.5 Communication"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX051"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Planning ahead"]
N2["11.2 Detect and assess"]
N3["11.3 Contain"]
N4["11.4 Evidence and recovery"]
N5["11.5 Communication"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX051"]
[Learning outcomes]
|
v
[11.1 Planning ahead]
|
v
[11.2 Detect and assess]
|
v
[11.3 Contain]
|
v
[11.4 Evidence and recovery]
|
v
[11.5 Communication]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX051]
Learning outcomes
You will (1) adapt the incident response steps to building systems; (2) decide when to isolate the BMS; and (3) coordinate with clinical, estates and IT teams.
11.1 Planning ahead
NIST SP 800-82r3 stresses preparing OT incident response with operations staff. In a hospital that means estates, clinical site managers, the IT security team and contractors agree beforehand: who leads, what each system's manual fall-back is, and how to reach contractors at night.
Write the agreement down as a short plan with phone numbers, the fall-back for each critical system and who may order isolation. Exercise it at least once with estates and a contractor, perhaps on a quiet weekend. The first incident is the wrong time to discover that the chiller contractor has no night contact.
11.2 Detect and assess
An alarm, an out-of-window setpoint or a ransom note on BMS-WS starts the process. The first question is clinical: is any area unsafe now? The site manager and estates decide immediate protective steps — moving a theatre list, switching to cylinder oxygen alarms monitored by staff.
Only after the clinical picture is clear does the security assessment begin: what is affected, how it started and whether it is spreading. At Millbrook the first call on the ransom night was to estates, who confirmed that theatres were empty and wards normal before the network team acted.
11.3 Contain
If the BMS cannot be trusted, controllers can usually run their last programmed schedules without the server. Isolating the BMS zone at its firewall stops further remote commands while plant keeps running locally. Estates staff patrol plant rooms and check critical values by hand.
Before isolating, check how each critical controller behaves without the server, because some fall back to defaults that differ from normal operation. At Millbrook the conduits were blocked at 22:55 and controllers carried on with their schedules, while estates engineers patrolled hourly. Note the time of each containment step for the incident record.
11.4 Evidence and recovery
Preserve logs and images before rebuilding; restore BMS-WS and the server from verified backups; check every critical point against local readings; reconnect conduits one at a time.
Agree beforehand where evidence will be stored and who will take it, so that rebuilding is not delayed. At Millbrook the incident lead had the BMS-WS disk image and the firewall log extract for 22:00–23:00 copied to the evidence store before the rebuild began. Keep the evidence until the incident lead decides it is no longer needed. Record each step and its time.
11.5 Communication
The incident lead informs hospital management, who decide about external notification. Analysts do not contact the press or regulators themselves.
Analysts support the incident lead by providing clear facts with times and sources. They should avoid informal messages to colleagues or contractors that could spread inaccurate information. If a regulator or journalist contacts an analyst directly, pass the request to the incident lead without comment. Keep a copy of every update sent, with its time, so the incident record shows what was said and when it was said.
Worked example (synthetic Millbrook)
At 22:40 BMS-WS shows a ransom message. Estates confirms theatres are empty and wards normal. The network team blocks the BMS zone conduits at 22:55; controllers continue on their schedules. Estates engineers patrol hourly. Next morning BMS-WS is rebuilt from a verified image, the server checked, and conduits restored by 14:00 after point checks.
Synthetic case — Millbrook. The incident is invented.
Errors and limits
Some controllers fail to safe defaults that differ from normal operation; know them before isolating. Patrol-based monitoring cannot last indefinitely; plan staffing.
Exercises
- EX051 — First question. What is the first question after BMS-WS shows a ransom message, and who answers it? Rubric: 3 = is any clinical area unsafe; site manager/estates; 2 = question only; 1 = IT question; 0 = none.
- EX052 — Why isolation is acceptable. Explain why blocking the BMS zone conduits did not stop ventilation. Rubric: 3 = controllers run local schedules without server; 2 = partial; 1 = it did stop; 0 = none.
- EX053 — Manual monitoring. What replaces BMS monitoring while it is isolated? Rubric: 3 = estates patrols reading local values, staff checks of alarms; 2 = partial; 1 = vague; 0 = none.
- EX054 — Reconnecting. Describe how conduits are restored after recovery. Rubric: 3 = one at a time with point checks against local readings; 2 = partial; 1 = all at once; 0 = none.
- EX055 — Safe defaults. Why must Aisha know controllers' fail-safe behaviour before recommending isolation? Rubric: 3 = some defaults change operation (e.g. fans off/full), could affect patients; 2 = partial; 1 = no need; 0 = none.
Synthesis
Clinical safety leads, local control carries the plant, isolation stops remote harm and evidence precedes recovery.
Continue studying — chapter 11 of 12
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →