◇ OpenCyber Academy
Rapid course · Chapter 4 · English

Chapter 4 — Safe habits, response basics and next steps

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Safe habits, response basics and next steps

Lesson map

Lesson 04 published. Map, example, EX039.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Everyday habits"]
  N2["4.2 Responding to an incident"]
  N3["4.3 Updates and devices"]
  N4["4.5 Where next"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX039"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Everyday habits"]
  N2["4.2 Responding to an incident"]
  N3["4.3 Updates and devices"]
  N4["4.5 Where next"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX039"]

[Learning outcomes]
    |
    v
[4.1 Everyday habits]
    |
    v
[4.2 Responding to an incident]
    |
    v
[4.3 Updates and devices]
    |
    v
[4.5 Where next]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX039]

Learning outcomes

You will (1) practise the everyday habits that protect an OT site; (2) outline the first steps of an incident response; (3) explain the safety and legal limits on security work; and (4) plan your next course.

4.1 Everyday habits

Use only site-issued USB drives, scanned before use. Never plug unknown devices into site equipment. Lock screens. Keep passwords out of sight and out of chat. Report lost badges and laptops quickly. Do not install software on site computers. These habits block the commonest ways malware and intruders get in.

Each habit closes a simple route. A found USB stick can carry malware straight past every firewall; an unlocked screen in the control room lets anyone send commands under your name; a password shared in chat can be read long after the conversation ends. These small rules matter most at sites like Elmstead, where many visitors and contractors pass through.

4.2 Responding to an incident

NIST SP 800-82r3 stresses planning response with operations. At Elmstead the steps are: make people and equipment safe using site procedures; call the on-call engineer; record what you see; preserve evidence; let the engineer and incident lead decide containment, such as disconnecting the vendor portal or putting the battery into a safe idle state; restore from verified backups; learn and improve.

A trainee's part in this list is mostly the first four steps. Containment and restoration are decisions for people who understand how SC-1, the inverters and the battery will react, and who can agree them with the grid operator if needed. Elmstead keeps the steps on a card in the control room so that nobody has to remember them under pressure.

4.3 Updates and devices

Vendors release firmware fixes; the owner applies them at planned times after checking compatibility. For new devices, ask suppliers questions drawn from ETSI EN 303 645 and NIST IR 8259: unique passwords, a vulnerability disclosure policy, an update period, encrypted communication.

The answers belong in the inventory beside the device. A camera that has no update period, or a controller whose vendor will not say how to report a weakness, is a risk the owner should know about before buying rather than after installing. Firmware updates are tested on one unit first where possible, with a way to return to the previous version.

4.4 Limits

Never test, scan or log into systems you are not authorised to use. Never bypass safety systems such as fire detection or battery protection. Never share exploit code or attack instructions. Learning happens on simulators and lab equipment.

Being on site does not change these limits. A trainee who sees an exposed login page, or who is handed a password by a friendly vendor technician, still has no authority to use it. The right move is to report what you found to the engineer. Authority comes from the owner, in writing, for a defined task.

4.5 Where next

The next course in this curriculum covers critical infrastructure and sector security. Longer courses in this area go deeper into networks, protocols, monitoring and design. Keep a record of exercises completed.

Before moving on, revisit the Elmstead running case and check that you can explain each of its events in your own words: the inverter list, the zones, the 14:00 command and the camera drill. Note which exercises you scored below three on and return to those chapters. The longer courses in this area build on exactly these foundations.

Worked example (synthetic Elmstead)

During a drill, Jonah finds a camera showing an unfamiliar login screen. He follows the card on the control room wall: tells the on-call engineer, photographs the screen, notes the time, touches nothing. The engineer isolates the camera zone at its firewall; the control zone keeps running. In the debrief Jonah suggests adding the camera vendor's support number to the card.

Synthetic case — Elmstead. The drill is invented.

Errors and limits

These habits reduce risk but cannot remove it. Procedures differ by site; follow local rules.

Exercises

Synthesis

Good habits, a practised response, respect for safety and legal limits, and continued study protect OT sites.

Continue studying — chapter 04 of 04

← Chapter 03 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →