OT Cyber Weekly - What Does a Real OT/ICS Cybersecurity Incident Look Like

Value of the Information & Strength of the Argument

The video provides valuable insights into OT incident response, emphasizing the unique challenges compared to IT. The argumentation is based on the author’s experience and references to well-known incidents, which strengthens credibility. However, the discussion is largely anecdotal and lacks in-depth technical detail or data-driven analysis. The emphasis on the lack of monitoring and root cause analysis is a critical point, but the argument could be more robust with specific examples or statistics.

Scientific Rigor, Source Quality, Title Accuracy

The video references MITRE ATT&CK for ICS and mentions incidents like Colonial Pipeline and Frosty Goop, but does not provide direct citations or links to these sources. The title accurately reflects the content. The author’s expertise is evident, but the lack of verifiable sources reduces the scientific rigor. The video is more of an expert opinion than a rigorously sourced analysis.

The title accurately reflects the content, which discusses real OT/ICS incidents and incident response.

7/10

The video is an expert opinion from a practitioner with relevant experience. It references well-known incidents and frameworks (MITRE ATT&CK for ICS, Colonial Pipeline, Frosty Goop) but lacks detailed citations and verification of claims.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 02:00Introduction and overview of the session's focus on OT incident response.
• 05:00Discussion on the importance of preparation and tabletop exercises.
• 10:00Explanation of the identification phase and challenges in OT environments.
• 15:00Containment strategies and the criticality of disconnecting IT and OT networks.
• 20:00Eradication phase and the difficulty of root cause analysis without monitoring tools.
• 25:00Recovery phase and the example of Colonial Pipeline's restart challenges.
• 30:00Introduction to MITRE ATT&CK for ICS and its relevance to incident response.
• 35:00Discussion on the lack of monitoring in OT and the need for better preparation.
• 40:00Q&A session addressing viewer questions on OT security.

• MITRE ATT&CK for ICS — Referenced as a framework to understand attacker behaviors in ICS.
• Colonial Pipeline Incident — Mentioned as an example of recovery challenges in OT.
• Frosty Goop — Referenced as a recent OT incident.

• MITRE ATT&CK for ICS — Framework used to categorize attacker techniques in ICS.
• CISA Advisory on Frosty Goop — Official advisory on the Frosty Goop malware.

• No direct discordant sources found — The video does not present conflicting sources; it aligns with common knowledge in OT security.