It retells the December 2015 attack on three Ukrainian power companies: the screens taken over, the backup power cut, the phones flooded, and crews restoring power by hand within hours.
“ICS/OT Incident Response Drills and Exercises”
Make Sure the First Test of Your OT Incident Response Plan Is a Drill, Not the Real Thing
Utilities under NERC CIP-008-6 must test their incident response plan at least once every 15 months. Pipelines under the TSA directives test every year. This book shows you how to run that test on the plant floor and keep a record an auditor can check.
Built on public sources: CISA Tabletop Exercise Packages, NERC CIP-008-6, the TSA Security Directives, and the E-ISAC and SANS analysis of the Ukraine attack
What the Book Stands On
Real incidents and public guidance, not opinion
Follows Norsk Hydro through the 2019 ransomware attack: the network cut, plants switched to manual operation, no ransom paid, and a public briefing every day while it recovered.
The exercise formats draw on the public CISA Tabletop Exercise Packages, and the testing chapters follow what NERC CIP-008-6 and the TSA pipeline directives require you to test.
What You'll Learn in this Book
Fifteen chapters in five parts, from auditing the plan you have to running a complete exercise, plus seven printable worksheets
- Why a plan on file is not a tested plan, and how to audit yours for what an IT template leaves out
- Which IT incident habits do damage on a plant network, and the OT response lifecycle that replaces them
- How to define safe states and manual fallback before the day you need them
- What an operator should report, and when, using a layer-by-layer list of OT indicators of compromise
- How to run two kinds of tabletop: one for the executives who make the shutdown call, one for the technicians who work the playbook against a timer
- How to build scenarios that escalate in layers, from free CISA exercise packages, across five scenario types
- Who must be told and by when, and what NERC CIP-008-6 and the TSA directives expect as test evidence
- How to turn findings into fixes with an after-action report and a tracked improvement plan, and measure progress with a maturity model
- How to drill a restore on a bench and plan a year of drills around your outages
- Exercise QUIET FEEDER: a four-hour ransomware tabletop set at a fictional electric cooperative, written out in full in Chapter 14
What Comes With Your Copy
Three things that make the book usable on the day, not just readable
Included #1
Seven Printable Worksheets
The plan audit checklist, the OT indicators quick reference, the scenario design template, the recovery readiness checklist, the 12-month drill cadence, the field kit and the questions for consideration. Each one is in the book, and all seven come as full-size PDFs in one download, ready to print and file with your exercise records.
Included #2
Both Formats, PDF and EPUB
Print the PDF for the exercise room, or read the EPUB on a phone, a tablet or an e-reader. Send Chapter 3 to the operators before the exercise, so everyone arrives knowing what a safe state means on your site.
Included #3
The Source List
Appendix B links every official resource the book draws on: the CISA exercise packages, the HSEEP evaluation guidance, the C2M2 maturity model and self-evaluation tool, and the primary sources on Ukraine and Norsk Hydro. When someone asks where a number came from, you can show them.
You're Covered By Our 30-Day Money-Back Guarantee
If the book is not what you needed, write to us through the Contact page within 30 days of your order and we refund you.
Read the Refund Policy and Terms and Policies.
Who Wrote It
HK School of Management
HK School of Management trains the people who run the work: project managers, Scrum Masters, engineers and security teams. On the industrial side we teach the free Industrial Control Systems Introduction course and ICS/OT Cybersecurity Fundamentals on Udemy.
This book is the companion to our ICS/OT Incident Response Drills and Exercises course. It puts the whole method in one place, so it can sit on the desk while you plan the exercise.
Get the Book for $9.99
PDF and EPUB, ready to download as soon as you check out