Testing Operational Effectiveness of Control 1 of Five SANS ICS Cybersecurity Critical Controls

SANS ICS Security Summit 2023
Developing and Running ICS Tabletops: Testing operational effectiveness of Control 1 of the Five SANS ICS Cybersecurity Critical Controls.
Speaker: Mike Hoffman, Instructor, SANS Institute

The Five SANS ICS Cybersecurity, Critical Controls whitepaper outlines that developing an ICS-specific Incident Response (IR) plan is a primary control. Therefore, asset owners and operators should be focused on creating an IR plan to support event root cause determination and know how to respond if an ICS-focused cybersecurity incident is raised. Developing and running Tabletop Exercises (TTXs) is a critical element of the overall IR planning process and one that should be carried out regularly. This talk will provide insights into leveraging scenarios to build an effective TTX that will test the response capabilities documented in an IR plan. In addition, the talk will share experiences gained from developing and running TTXs targeting different organizational areas ranging from c-suite to IT/OT cybersecurity staff and engineers/operators.

[brucelarge]

Awesome session Michael! It's fantastic to see all the tips from real world table top lessons leant and to see how it all comes together for a solid approach.