OT Cyber Tuesday (Ep. 13): Learning Incident Response for OT

Value of the Information & Strength of the Argument

The video provides valuable insights into OT incident response, particularly for those new to the field. The use of the card game makes complex concepts more approachable and encourages active learning. Holcomb effectively explains the game’s mechanics and relates them to real-world scenarios, such as the Triton attack and the prevalence of shared Active Directory between IT and OT. He also highlights the critical statistic that only 5% of OT environments perform network monitoring, underscoring the importance of proactive defense. The argumentation is coherent and grounded in practical experience, though it relies more on anecdotal evidence than formal research. The interactive format adds value by engaging the audience and addressing their questions.

Scientific Rigor, Source Quality, Title Accuracy

The video demonstrates a reasonable level of scientific rigor, with references to real incidents and industry statistics. However, sources are not formally cited, and some claims (e.g., the 5% monitoring figure) are attributed to Robert Lee but lack direct references. The title accurately reflects the content, and the video stays on topic. The description provides links to the presenter’s newsletter and free resources, but these are not directly related to the video’s content. Overall, the video is informative but would benefit from more explicit citations and references to support its claims.

The title accurately reflects the content: the video focuses on learning OT incident response through the Backdoors and Breaches game.

7/10

The video provides a practical introduction to OT incident response using a card game, with references to real-world incidents (e.g., Triton) and industry statistics (e.g., 5% monitoring). However, it lacks formal citations and relies on anecdotal evidence and personal experience.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 02:00Introduction to the Backdoors and Breaches card game and its purpose for learning incident response.
• 05:00Explanation of the game board and the four key questions: initial compromise, pivot/escalate, C2, exfiltration, and persistence.
• 10:00Discussion on the lack of network monitoring in OT environments (only 5% perform monitoring).
• 15:00Example of initial compromise via shared Active Directory between IT and OT.
• 20:00Explanation of LLMNR attacks and credential theft in OT environments.
• 25:00Discussion on command and control using TCP three-way handshake as Morse code.
• 30:00Persistence through engineering workstations and malicious firmware, referencing the Triton attack.

• Mike Holcomb's Newsletter — Link to newsletter for further OT/ICS cybersecurity content.
• Free OT/ICS Cyber Videos — Link to free videos for learning OT/ICS cybersecurity.

• Dragos — Mentioned as a leading OT/ICS cybersecurity company and co-developer of the ICS version of the game.
• Black Hills Information Security — Creators of the Backdoors and Breaches game.