A manufacturing company's operational technology (OT) network, which controls critical production machinery, experiences a cyberattack. The CISO is informed that the attack has moved from the IT network into the OT environment, potentially causing physical damage and production halts. Given the potential for significant physical and business impact, which of the following is the MOST critical immediate action to take?
- ANotify law enforcement and regulatory bodies immediately.
- BIsolate the compromised IT systems to prevent further lateral movement.
- CAssess the safety implications and potential for physical damage to OT systems.
- DInitiate data backup procedures for all affected IT and OT systems.
Show answer & explanationAnswer & explanation
Correct answer: C. Assess the safety implications and potential for physical damage to OT systems.
In an OT environment, cyberattacks can have immediate and severe physical safety implications for personnel and equipment. Therefore, assessing physical safety and potential damage is the paramount immediate concern before or in parallel with other incident response actions, as human life and physical assets take precedence.
Why the other options are wrong
- A. Notification is important but typically follows initial assessment and ensuring immediate safety and containment.
- B. Isolation is crucial, but safety assessment often precedes or runs concurrently, especially when physical damage is a risk.
- D. Backups are a preparatory measure and not an immediate response to an active threat causing physical damage in OT.
OT Incident Response Priority
In operational technology (OT) environments, the primary concern during a cyber incident is human safety and the prevention of physical damage, even above data confidentiality or system availability.
- OT incidents can lead to physical harm or environmental damage.
- Response priorities differ significantly from IT incidents.
- Requires specialized expertise and safety protocols.
Memory trick: OT incidents demand 'S.A.F.E.T.Y.': Safety first, Assess physical impact, Functionality preservation, Emergency procedures, Technical containment, Yield to physical safety.