Chapter 15 — Reporting an incident and first actions | Technical OT, IoT and cyber-physical security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 15 — Reporting an incident and first actions

Lesson map

Lesson 15 published. Map, example, EX057.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 First steps"]
  N2["15.2 A good first report"]
  N3["15.3 Preserving evidence"]
  N4["15.4 Communication"]
  N5["15.5 Notification duties"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX057"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 First steps"]
  N2["15.2 A good first report"]
  N3["15.3 Preserving evidence"]
  N4["15.4 Communication"]
  N5["15.5 Notification duties"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX057"]

[Learning outcomes]
    |
    v
[15.1 First steps]
    |
    v
[15.2 A good first report]
    |
    v
[15.3 Preserving evidence]
    |
    v
[15.4 Communication]
    |
    v
[15.5 Notification duties]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX057]

Learning outcomes

You will (1) follow the HPFL first-response steps; (2) write a clear first report; and (3) explain why evidence is preserved before recovery starts.

15.1 First steps

Make people safe: the supervisor decides whether to stop or isolate the affected part of the line using normal procedures. Then call the incident contact on the site sheet. Record what you see as you go. Do not try to remove malware or restore systems yourself.

At HPFL the night supervisor switched the line to local panel control and stopped the wrapper before anything else happened. Tomás then photographed the screen and called the incident contact. Following the steps in order keeps people safe and leaves evidence intact.

15.2 A good first report

It answers: what did you notice, where, when, which devices, what the line is doing now, what has been done so far and who you have told. Short facts beat long theories. NIST SP 800-82r3 stresses that OT incident response must be planned with operations, because actions taken in panic can hurt the process.

At HPFL Tomás's report fitted in one sentence per point and was sent within minutes. Later corrections were added in writing, not by changing the first report. Keep a copy of every report you send, with the time.

15.3 Preserving evidence

Photograph screens, keep a written timeline, and leave devices as they are unless safety requires otherwise. If a device must be isolated, the engineer does it by a planned method — for example, disabling a switch port — and records exactly when.

Keep the written timeline in the order events happened, with times from a single reference such as your watch, and note any known clock differences between devices. Photographs should show the device name and the screen together. Store photographs with the timeline in one place.

15.4 Communication

Use the site's contact list. Do not post about the incident on social media or chat groups. Do not contact vendors or authorities yourself unless the incident lead asks.

At HPFL the incident lead decides who speaks to vendors, customers and authorities. Avoid speculating to colleagues about the cause, because rumours spread quickly on a shift floor. If someone outside asks you about the incident, refer them to the incident lead. Use the phone numbers on the site sheet, not numbers saved privately, because they are kept current.

15.5 Notification duties

Some sectors and countries require reports to regulators or to CISA within set times; the incident lead handles this, but your timeline is what makes it possible.

At HPFL Tomás's timeline, with its times and photographs, gave the incident lead what was needed for any required notification. Keep it accurate and complete, and pass corrections to the lead in writing as soon as you find them. Times matter most: when the event was noticed, when it was reported and when the line was stopped. Note them as they happen rather than reconstructing them afterwards.

Worked example (synthetic HPFL)

At 03:10 HMI-1 shows a ransom message. Tomás tells the night supervisor, who switches the line to local panel control and stops the wrapper. Tomás photographs the screen and calls the incident contact at 03:14. His report reads: "03:10 HMI-1 ransom screen; line on local control, wrapper stopped 03:12; no other screens affected seen; nothing unplugged; supervisor informed."

Synthetic case — HPFL. The incident is invented.

Errors and limits

Contact lists go out of date; check them quarterly. A first report can be wrong; correct it in writing rather than deleting it.

Exercises

EX057 — Ordering the steps. Put in order: call incident contact; supervisor makes line safe; photograph screen; restore HMI. Rubric: 3 = safe, photograph, call; restore later by owners; 2 = mostly right; 1 = restore first; 0 = none.
EX058 — Improving a report. Rewrite "HMI is hacked, probably Russians" into a factual first report. Rubric: 3 = time, device, observation, line state, actions, who told; no speculation; 2 = partial; 1 = still speculation; 0 = none.
EX059 — Unplugging. A colleague wants to unplug HMI-1's network cable immediately. What do you say? Rubric: 3 = isolate only via supervisor/engineer, planned, recorded; safety and evidence; 2 = wait; 1 = do it; 0 = none.
EX060 — Who notifies. Who decides whether to notify regulators or CISA? Rubric: 3 = incident lead/management; technician supplies timeline; 2 = lead only; 1 = technician alone; 0 = none.

Synthesis

Safety first, facts recorded, evidence preserved, the right people called; recovery comes after.

Continue studying — chapter 15 of 18

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →