To Isolate a Plant or Keep Production Running — Incident Response

Situation

In a hospital after a weekend EHR outage, OT historian with default credentials is the evidence after a help-desk reset that bypassed step-up authentication. Incident commander has to pick To isolate a plant or Keep production running for this Cybersecurity Incident Response close using OT historian with default credentials.

Decision

Incident commander in a hospital after a weekend EHR outage must choose To isolate a plant / Keep production running using OT historian with default credentials after a help-desk reset that bypassed step-up authentication.

Hypotheses to test

• OT historian with default credentials reads as To isolate a plant once a help-desk reset that bypassed step-up authentication is lined up to the same Cybersecurity population.
• OT historian with default credentials is closer to Keep production running after a help-desk reset that bypassed step-up authentication; To isolate a plant would over-claim this Incident Response extract.
• A dual reading is still live in OT historian with default credentials for incident commander in a hospital after a weekend EHR outage.
• OT historian with default credentials is missing the fact incident commander needs after a help-desk reset that bypassed step-up authentication; stop this Cybersecurity close.

Analysis required

• Name the compensating control that would let incident commander release a reversible hold.
• Test whether access is still live, already rotated, or only written as closed.
• Check SIEM or identity logs in OT historian with default credentials for reuse after a help-desk reset that bypassed step-up authentication.
• For this Cybersecurity Incident Response file, read OT historian with default credentials against a help-desk reset that bypassed step-up authentication and write the one fact that would move to isolate a plant for incident commander.

Recommendation

Choose To isolate a plant / Keep production running on this Cybersecurity / Incident Response packet (OT historian with default credentials after a help-desk reset that bypassed step-up authentication). The follow-on Incident Response action is what incident commander does next: implement the option, assign an owner, and log the missing fact.