WEBVTT

00:00:00.450 --> 00:00:05.252
Hello, I'm Denise Cross, a Senior Incident Response Consultant at

00:00:05.252 --> 00:00:10.646
OTCogniShield. In this lesson, we'll use the platform's Incident Response

00:00:10.646 --> 00:00:15.966
module to walk through a practical response, from preparation to lessons

00:00:15.966 --> 00:00:16.557
learned.

00:00:17.307 --> 00:00:22.482
Cyber incidents can disrupt industrial operations. Preparing for them is

00:00:22.482 --> 00:00:27.586
sensible, without treating every equipment fault as an attack. A useful

00:00:27.586 --> 00:00:32.906
response brings engineering, operations, safety and security into the same

00:00:32.906 --> 00:00:33.840
conversation.

00:00:34.590 --> 00:00:39.510
This is a guided overview, rather than a two-day course or a substitute for

00:00:39.510 --> 00:00:44.299
your site procedures. We'll follow a fictional packaging-cell example and

00:00:44.299 --> 00:00:47.710
finish with the incident form you can print or save.

00:00:49.360 --> 00:00:54.865
IT and OT incident response share familiar activities: gathering facts,

00:00:54.865 --> 00:01:00.914
coordinating people, limiting harm and restoring service. In OT, decisions can

00:01:00.914 --> 00:01:06.341
also affect machinery, utilities, interlocks and the physical process.

00:01:07.091 --> 00:01:12.541
The objective is safe, controlled restoration with avoidable downtime reduced.

00:01:12.541 --> 00:01:17.642
The quickest technical change is not automatically the safest operational

00:01:17.642 --> 00:01:23.022
decision. A disconnected engineering workstation, for example, may still have

00:01:23.022 --> 00:01:25.118
a critical process dependency.

00:01:25.868 --> 00:01:31.726
OTCogniShield helps organise cases, observations, evidence and review notes.

00:01:31.726 --> 00:01:37.584
It does not take control of equipment, authorise isolation or certify that a

00:01:37.584 --> 00:01:43.596
plant is safe. Those decisions stay with qualified, authorised site personnel.

00:01:45.246 --> 00:01:50.421
PICERL stands for Preparation, Identification, Containment, Eradication,

00:01:50.421 --> 00:01:55.596
Recovery and Lessons Learned. Use these as a structure for questions and

00:01:55.596 --> 00:02:00.627
records, not as a rigid queue that everyone must complete in sequence.

00:02:01.377 --> 00:02:06.401
New information can send the team back to identification while containment

00:02:06.401 --> 00:02:11.628
planning continues. Record why a decision changed, who reviewed it, and which

00:02:11.628 --> 00:02:16.652
evidence supports the revised position. Uncertainty should remain visible.

00:02:17.402 --> 00:02:22.483
For a two-day workshop, you could explore preparation, identification and

00:02:22.483 --> 00:02:27.703
containment on day one, then remediation, recovery and a tabletop review on

00:02:27.703 --> 00:02:32.506
day two. This video introduces the workflow and the platform support.

00:02:34.156 --> 00:02:39.662
Begin with a usable inventory and a defined production boundary. Identify the

00:02:39.662 --> 00:02:45.239
process, relevant assets, communication paths, owners and dependencies. Record

00:02:45.239 --> 00:02:49.815
what is unknown, rather than assuming the inventory is complete.

00:02:50.565 --> 00:02:55.962
Name the incident lead and the people who can approve operational decisions.

00:02:55.962 --> 00:03:01.218
Include operations, engineering, safety, security and vendor support where

00:03:01.218 --> 00:03:06.687
relevant. Agree an alternative communication route if normal business systems

00:03:06.687 --> 00:03:07.823
are unavailable.

00:03:08.573 --> 00:03:13.149
In the Preparation worksheet, reference the inventory, contact tree,

00:03:13.149 --> 00:03:18.127
escalation procedure and last recovery test. A named backup is more useful

00:03:18.127 --> 00:03:23.174
when the team also knows whether it has been tested and who can approve its

00:03:23.174 --> 00:03:23.443
use.

00:03:25.093 --> 00:03:30.881
A tabletop exercise is a discussion, not a live attack or an unapproved plant

00:03:30.881 --> 00:03:36.444
test. Present a realistic scenario: a packaging cell stops, and unexpected

00:03:36.444 --> 00:03:40.879
maintenance activity appears in the available observations.

00:03:41.629 --> 00:03:46.851
Ask the team who receives the first call, who assesses the process condition,

00:03:46.851 --> 00:03:52.072
and who records the timeline. Explore how the team would work if email or the

00:03:52.072 --> 00:03:54.920
usual engineering laptop were unavailable.

00:03:55.670 --> 00:04:00.450
Capture the gaps as improvement actions with owners and dates. Do not mark

00:04:00.450 --> 00:04:05.229
readiness complete merely because a meeting happened. Record the decisions

00:04:05.229 --> 00:04:09.686
tested, the assumptions challenged and the changes still outstanding.

00:04:11.336 --> 00:04:16.536
Open Incidents and choose Start an incident, or use the Open incident form.

00:04:16.536 --> 00:04:21.875
Enter a clear title, the priority from your site severity procedure, the case

00:04:21.875 --> 00:04:24.648
owner and the affected zone and conduit.

00:04:25.398 --> 00:04:30.287
Write an initial summary that separates observed facts from possible

00:04:30.287 --> 00:04:35.894
explanations. Our example might say: packaging stopped at nine fifteen UTC; an

00:04:35.894 --> 00:04:41.502
unfamiliar maintenance connection was observed; the relationship between those

00:04:41.502 --> 00:04:43.083
events is unconfirmed.

00:04:43.833 --> 00:04:49.224
Create the case and review the recorded safety gate. Treat the gate as part of

00:04:49.224 --> 00:04:54.477
case governance, not as permission to isolate a device or restart equipment.

00:04:54.477 --> 00:04:59.108
The relevant operational approvals still belong in site procedures.

00:05:00.758 --> 00:05:05.973
An unusual protocol exchange can justify investigation, but it does not

00:05:05.973 --> 00:05:11.408
establish a cyber root cause. Compare available network observations, host

00:05:11.408 --> 00:05:16.843
information and maintenance records with engineering and process evidence.

00:05:17.593 --> 00:05:22.458
In the example, a legitimate maintenance connection and a mechanical fault

00:05:22.458 --> 00:05:27.586
could occur together. A compromised workstation could also be relevant. Record

00:05:27.586 --> 00:05:32.320
competing explanations and what evidence would distinguish them, without

00:05:32.320 --> 00:05:34.489
declaring one proven prematurely.

00:05:35.239 --> 00:05:40.885
Use the Identification notes for first-observed time, timezone, affected

00:05:40.885 --> 00:05:46.844
assets, protocol context, confidence and remaining gaps. Root cause analysis

00:05:46.844 --> 00:05:52.333
is a team activity; a passive observation is one input, not the entire

00:05:52.333 --> 00:05:53.117
diagnosis.

00:05:54.767 --> 00:06:00.415
Use the evidence locker to associate an appropriate supporting file with the

00:06:00.415 --> 00:06:06.064
correct incident. The existing form accepts formats such as packet captures,

00:06:06.064 --> 00:06:11.044
logs, text, JSON and CSV, subject to the platform's own validation.

00:06:11.794 --> 00:06:16.602
An evidence hash helps check whether stored bytes have changed. It does not,

00:06:16.602 --> 00:06:20.840
by itself, prove who collected the material, whether the source was

00:06:20.840 --> 00:06:24.509
trustworthy or whether a complete chain of custody exists.

00:06:25.259 --> 00:06:30.518
Record collection time with its timezone, collector, source and any transfers.

00:06:30.518 --> 00:06:35.305
Preserve originals under your evidence procedure. Do not run additional

00:06:35.305 --> 00:06:40.362
intrusive collection on production equipment merely to make the case record

00:06:40.362 --> 00:06:41.643
look more complete.

00:06:43.293 --> 00:06:47.806
Containment planning asks what action would reduce harm and what new

00:06:47.806 --> 00:06:52.916
consequences it could introduce. In the packaging-cell example, restricting a

00:06:52.916 --> 00:06:57.695
maintenance path may be a candidate option, but its dependencies must be

00:06:57.695 --> 00:06:58.823
understood first.

00:06:59.573 --> 00:07:04.988
Operations and safety personnel should review proposed isolation, shutdown or

00:07:04.988 --> 00:07:10.261
fallback measures under the site's approved procedures. Manual operation is

00:07:10.261 --> 00:07:15.394
appropriate only where a validated procedure, trained people and suitable

00:07:15.394 --> 00:07:17.152
safeguards already exist.

00:07:17.902 --> 00:07:22.775
Record the proposed option, expected effect, operational consequences,

00:07:22.775 --> 00:07:27.578
approver and decision time. Include the relevant fallback or rollback

00:07:27.578 --> 00:07:32.798
reference. The platform documents that review; choosing a playbook does not

00:07:32.798 --> 00:07:34.051
execute its steps.

00:07:35.701 --> 00:07:40.802
The Response decision support area lets you select a recorded playbook and

00:07:40.802 --> 00:07:46.109
read its steps. Treat that material as a prompt for the response team, rather

00:07:46.109 --> 00:07:50.037
than a universal instruction for every factory or device.

00:07:50.787 --> 00:07:56.078
Check whether the playbook fits the affected process, device type, maintenance

00:07:56.078 --> 00:08:01.097
condition and current operating state. Record where the assumptions do not

00:08:01.097 --> 00:08:05.913
match. A reusable playbook cannot know every local interlock or utility

00:08:05.913 --> 00:08:06.659
dependency.

00:08:07.409 --> 00:08:12.522
Use the case status to communicate progress under your own procedure, and keep

00:08:12.522 --> 00:08:17.372
the reasons for significant decisions in the supporting record. Changing a

00:08:17.372 --> 00:08:22.157
status is not evidence that containment has been technically validated or

00:08:22.157 --> 00:08:22.812
completed.

00:08:24.462 --> 00:08:29.870
Eradication is about addressing the supported cause of the incident. A generic

00:08:29.870 --> 00:08:34.793
instruction to remove malware is not an adequate plan for an industrial

00:08:34.793 --> 00:08:39.993
controller, engineering station and their surrounding process dependencies.

00:08:40.743 --> 00:08:46.016
Where restoration is required, coordinate with engineering and the relevant

00:08:46.016 --> 00:08:51.078
vendor. Identify the approved firmware, logic, configuration and trusted

00:08:51.078 --> 00:08:56.492
backup references. The video does not provide device-specific flashing, reset

00:08:56.492 --> 00:08:58.812
or program-download instructions.

00:08:59.562 --> 00:09:04.848
Use the Eradication worksheet to reference the change authorisation, vendor

00:09:04.848 --> 00:09:10.346
advice, validation results and rollback plan. Record remaining uncertainty. An

00:09:10.346 --> 00:09:15.491
installed firmware version alone does not show that the running logic and

00:09:15.491 --> 00:09:17.887
process configuration are correct.

00:09:19.537 --> 00:09:25.051
Recovery needs agreed acceptance criteria, not simply a green status message.

00:09:25.051 --> 00:09:30.494
Define what the authorised team must demonstrate before the affected process

00:09:30.494 --> 00:09:34.791
is returned to service under the approved restart procedure.

00:09:35.541 --> 00:09:40.348
Reference the relevant functional checks, configuration verification,

00:09:40.348 --> 00:09:45.574
dependency checks and observation period. Record the actual results and any

00:09:45.574 --> 00:09:50.661
restrictions. A quiet monitoring display does not prove that an operating

00:09:50.661 --> 00:09:51.775
process is safe.

00:09:52.525 --> 00:09:57.637
Name the operations and safety owners who authorise return to service, and

00:09:57.637 --> 00:10:02.333
record the time with its timezone. Keep residual risks and follow-up

00:10:02.333 --> 00:10:07.445
monitoring visible. Recovery remains a controlled site decision, even when

00:10:07.445 --> 00:10:09.379
production pressure is high.

00:10:11.029 --> 00:10:16.203
After the immediate response, reconstruct the timeline using recorded facts

00:10:16.203 --> 00:10:21.308
and clearly labelled estimates. Review what the team knew at each decision

00:10:21.308 --> 00:10:26.551
point, rather than judging earlier choices using information discovered much

00:10:26.551 --> 00:10:26.965
later.

00:10:27.715 --> 00:10:32.812
Document effective actions, communication difficulties and evidence gaps.

00:10:32.812 --> 00:10:37.840
Create improvement actions with an owner, a due date and a way to verify

00:10:37.840 --> 00:10:42.797
completion. Avoid a closure note that merely says training is required.

00:10:43.547 --> 00:10:48.855
Update the response program, contact tree, recovery references and tabletop

00:10:48.855 --> 00:10:54.092
scenarios where the review identifies a need. Record why the case is being

00:10:54.092 --> 00:10:59.329
resolved or closed, including any outstanding actions and their continuing

00:10:59.329 --> 00:10:59.825
owners.

00:11:01.475 --> 00:11:06.339
The PICERL worksheet sits within the Incident Response module. Choose the

00:11:06.339 --> 00:11:10.870
relevant case before entering notes. Each phase provides prompts for

00:11:10.870 --> 00:11:16.001
decisions, owners and evidence references, while allowing the team to revisit

00:11:16.001 --> 00:11:17.133
an earlier phase.

00:11:17.883 --> 00:11:22.675
In this release, worksheet notes are temporary in the current browser tab.

00:11:22.675 --> 00:11:27.725
They are not automatically saved into the incident database, and they are lost

00:11:27.725 --> 00:11:32.646
on reload or sign-out. A completed-looking screen is not proof of retention.

00:11:33.396 --> 00:11:38.320
Before leaving the page, open the incident form and export or print what you

00:11:38.320 --> 00:11:43.115
need. Save the resulting record to an approved location, then associate it

00:11:43.115 --> 00:11:47.327
with the correct incident through the supported evidence process.

00:11:48.977 --> 00:11:54.338
Select Print incident form, Save as PDF. The form opens in a separate window

00:11:54.338 --> 00:11:59.628
using the chosen case, matching loaded evidence references and your current

00:11:59.628 --> 00:12:03.931
worksheet notes. Allow that window if your browser blocks it.

00:12:04.681 --> 00:12:10.150
A blank form deliberately shows no selected case. For a populated form, check

00:12:10.150 --> 00:12:15.476
the case ID, owner, scope, recorded status and full evidence hashes. Review

00:12:15.476 --> 00:12:20.660
missing fields rather than treating Not recorded as a completed response.

00:12:21.410 --> 00:12:26.219
Add the site context, timeline entries, review owners and acceptance

00:12:26.219 --> 00:12:31.453
references where needed. The form supports documentation of authorisation;

00:12:31.453 --> 00:12:36.828
printing it or typing a name does not itself grant operational permission or

00:12:36.828 --> 00:12:39.586
independently authenticate a signature.

00:12:41.236 --> 00:12:46.595
Use the print control to print the form or save a PDF through your browser.

00:12:46.595 --> 00:12:51.669
Check the preview for paper orientation, margins and page breaks before

00:12:51.669 --> 00:12:55.956
keeping a formal copy. Long notes can change the page count.

00:12:56.706 --> 00:13:01.985
Download completed form, text, provides a text copy of the form's current

00:13:01.985 --> 00:13:07.337
contents. That export can be reviewed and attached using the existing text

00:13:07.337 --> 00:13:12.616
evidence upload. The present evidence file filter does not list PDF as an

00:13:12.616 --> 00:13:13.773
accepted format.

00:13:14.523 --> 00:13:19.970
Keep PDF copies in your approved incident-record location. Check that the

00:13:19.970 --> 00:13:25.641
uploaded text belongs to the selected case and retain the resulting evidence

00:13:25.641 --> 00:13:31.313
reference. Neither a PDF nor a text snapshot replaces an attributed incident

00:13:31.313 --> 00:13:32.208
audit trail.

00:13:33.858 --> 00:13:39.383
Return to our fictional example. The observation is an unexpected maintenance

00:13:39.383 --> 00:13:44.837
path near a packaging interruption. Finding F zero one records that approval

00:13:44.837 --> 00:13:50.290
and timing context are unverified. It does not claim that an attacker caused

00:13:50.290 --> 00:13:51.223
the stoppage.

00:13:51.973 --> 00:13:56.964
Draft action A zero one asks the Engineering Lead to compare maintenance

00:13:56.964 --> 00:14:02.370
approval, session timing and relevant process records before the agreed review

00:14:02.370 --> 00:14:07.499
deadline. This is an illustrative handover, not an automatically generated

00:14:07.499 --> 00:14:08.400
case outcome.

00:14:09.150 --> 00:14:14.589
If new evidence changes the explanation, update the review record and preserve

00:14:14.589 --> 00:14:19.819
the earlier rationale. Connect observations to owners and decisions without

00:14:19.819 --> 00:14:25.049
turning every unusual communication into a confirmed incident. The boundary

00:14:25.049 --> 00:14:27.838
and remaining gaps should stay explicit.

00:14:29.488 --> 00:14:34.964
Preparation asks whether the people, scope and recovery references are ready.

00:14:34.964 --> 00:14:39.941
Identification asks what is known, how confident the team is, and what

00:14:39.941 --> 00:14:45.204
evidence is missing. Containment asks which reviewed option can limit harm

00:14:45.204 --> 00:14:48.261
without creating unacceptable consequences.

00:14:49.011 --> 00:14:53.866
Eradication asks whether the supported cause has been addressed through an

00:14:53.866 --> 00:14:58.983
authorised plan. Recovery asks whether the agreed acceptance criteria are met.

00:14:58.983 --> 00:15:03.968
Lessons Learned asks who owns the improvements and how their completion will

00:15:03.968 --> 00:15:04.755
be verified.

00:15:05.505 --> 00:15:09.945
Use the module to support clear records and accountable conversations.

00:15:09.945 --> 00:15:14.385
Rehearse the workflow with your plant team, and keep the approved site

00:15:14.385 --> 00:15:17.367
procedure close at hand for your next exercise.

00:15:19.017 --> 00:15:23.433
Prepare the people. Preserve the evidence. Keep decisions accountable.

00:15:24.183 --> 00:15:28.684
This concludes the OTCogniShield Incident Response module overview.

00:15:29.434 --> 00:15:30.330
Thank you.