On 22 May 2023 two Danish energy companies were attacked the same way, about three and a half hours apart. Both ended up cutting their plants off from the internet. One made that call about fifteen minutes after the alarm. The other took close to two hours.
The timestamps come from SektorCERT's own report, The attack against Danish critical infrastructure, from November 2023. SektorCERT is the cyber security centre for Denmark's critical sectors, and the report covers 22 energy companies compromised in a few days that May.
At 14:44 on 22 May SektorCERT saw a member's Zyxel firewall downloading new software over an insecure connection. Minutes later it was acting as part of the Mirai botnet, joining DDoS attacks on targets in Hong Kong and the United States. On SektorCERT's recommendation, the member cut its internet connection completely just before 15:00.
At 18:13 the same method hit a second member. That one went into island operation around 20:00.
The report gives no reason for the gap, and we will not invent one. What the timestamps prove is narrower: the time it takes to decide to disconnect is a variable, and a variable can be set in advance. A plan that does not set it leaves it to whoever is on shift that evening.
This is for whoever owns the OT incident response plan at a site with any outside path into the control network: remote access, a vendor link, a supplier's forgotten firewall.
SektorCERT's recommendation 12 says it in one sentence:
"In the specific cases, several members had to go into island operation. A well-described and rehearsed contingency plan can ensure that the right decisions are made quickly and efficiently and that damage is thus limited."
Island operation meant the internet, not the grid
If you work in power, "island mode" means a piece of the grid running on its own generation. Every time SektorCERT uses the phrase, a member is cutting its internet connection and running the plant without it. The report describes no part of the grid being islanded.
So this is a network decision. Cut the outside paths, keep local control running. It is exactly the one IT and operations fight over.
The argument at 14:44, both sides
Security says cut it now. The firewall is already owned. It was taken with a single crafted packet against the VPN service on UDP port 500, the flaw now catalogued as CVE-2023-28771. On 11 May that one packet handed attackers the firewalls of 11 of the 16 companies they targeted. Every connected minute belongs to them.
Operations says tell us what we lose first. At one Danish member the compromised firewall was also the OT network's internal router. When it failed, production traffic stopped too, the crew lost sight of three remote locations, and people drove out to run them by hand. Cut the wrong box and you finish the attacker's job.
Both sides are right.
Security is right about speed. The 11 May wave was stopped before the access was used only because SektorCERT's analysts worked through the evening and night, outside the hours they were staffed for. Operations is right about consequence: only the people who run the process know what rides on that box.
Neither side can win at 14:44, with a firewall talking to a botnet. The argument has to be settled on a weekday morning, on one page that gives each side the part it is right about.
The CISO: "Fifteen minutes is fourteen too many"
"The firewall fell to one packet. And you want me to wait a quarter of an hour while somebody in the control room finishes his coffee? Pull it on the first alarm. Every time."
Read the triggers again. Two of the three are boundary-device alarms, so in most cases the first alarm is the trigger, and the clock starts with it. Fifteen minutes is a ceiling. Nothing in the block stops the call at minute one.
What the ceiling prevents is the other failure: the call that nobody owns, drifting through an evening of phone calls. That failure looks like caution while it is happening. Afterwards it looks like two hours.
Would your site have seen the 14:44 download at all? If not, trigger (b) is decoration until monitoring improves, and trigger (a) carries your whole plan.
The operator: "Easy to say from an office"
"You cut the link, I lose the outstations, and somebody has to drive to every one of them. The last time we ran a site by hand it took half a shift to find the procedure. So no, I am not pulling the plug because a dashboard went red."
The block takes this one most seriously, which is why row 3 offers a default only after a drill has proven the site runs without the outside paths. That protects the operator from an order the plant cannot carry out.
The Danish crew on 25 May lived this fear and handled it well, driving out to all three remote locations; their operations manager remarked that it was good weather for a drive. Good humour is not a procedure, though. SektorCERT's recommendation 24 asks for "well-integrated procedures to handle the transition to island operation."
Row 1 also gives the operator a veto with a deadline. "It would remove our view of the north pumping station" is a fact the security lead can act on, perhaps with a different cut point. "I don't like it" is not a fact.
Legal: "Nobody on nights makes a call with regulatory consequences"
"Cutting the link changes our service, maybe our contracts, maybe what we owe the regulator. Decisions like that come through us. I am not delegating that to whoever happens to be on shift."
Legal is right about the consequences and wrong about the timing. Their consent belongs on the page, in daylight, as a signature on the block, not on a phone at 20:00 while a firewall takes orders from a botnet.
A disconnect is internal and reversible. Reporting obligations follow the incident whether or not anyone touches a cable, which is why legal sits on the told-list in row 4: their clock runs on its own. On 25 May SektorCERT brought in the police cyber crime centre, NC3, at noon, and the powered-on firewall is what preserved the malware for them.
Two timestamps, one missing page
Every Danish member that disconnected in May 2023 got there in the end. Whether the cable would be cut was never the question. Who would say so, on what evidence, and how long the room would talk first: those were the questions.
At 14:44 those questions took about fifteen minutes to answer. At 18:13 they took about two hours. The disconnect decision block answers all three before the alarm, so when it sounds, only the cutting is left.
Sources: SektorCERT, The attack against Danish critical infrastructure (TLP:CLEAR, November 2023) | NIST NVD, CVE-2023-28771
