SANS 5 ICS Critical Controls for Oil and Natural Energy - Control 1 - ICS-Specific Incident Response Plan

The first training module for the energy sector provides an overview of the elements of an ICS Specific Incident Response Plan, how it differs from a standard IT Incident Response Plan, and how to prepare your team to respond. Simulate an incident response to a remote cyber intrusion into a drilling rig’s control system network to access programmable logic controllers (PLCs) to validate industrial network visibility of the rig control system’s threat.

An ICS-specific incident response plan requires the following:

• Enriched insights from engineering operations
• Specific to the power grid operations
• Emphasis on control system integrity and engineering recovery capabilities in the face of an attack on any aspect of the engineering process.

Not only should the plan exist, but it also must be tested to ensure its effectiveness and engineering preparedness for cyber risk scenarios unique to ICS operations and the physical process. This module will dive into how an informed incident response plan increase system integrity and speed up recovery during an attack.

Watch All Parts in This Series:

• Part 2
• Part 3
• Part 4
• Part 5