Respond Recover - Revision history

Jlawrence at 15:29, 11 December 2024

2024-12-11T15:29:37Z

← Older revision		Revision as of 15:29, 11 December 2024
Line 47:		Line 47:
	*Before beginning work on a playbook, it is crucial to determine the scope of the playbook, the audience for which the playbook is written, and the level of detail for the various components of the playbook to minimize the amount of rework or wasted effort.		*Before beginning work on a playbook, it is crucial to determine the scope of the playbook, the audience for which the playbook is written, and the level of detail for the various components of the playbook to minimize the amount of rework or wasted effort.
	*It is practically impossible to develop a playbook for every possible incident that could occur. This is particularly true in the case of detailed, granular playbooks designed for specific systems. Organizations should prioritize incident scenarios that are of high risk.		*It is practically impossible to develop a playbook for every possible incident that could occur. This is particularly true in the case of detailed, granular playbooks designed for specific systems. Organizations should prioritize incident scenarios that are of high risk.

			'''Relevant EPRI Resources'''

	*[https://www.epri.com/research/programs/112046/results/3002025349 Cyber Incident Response Playbook Guideline for Renewable and Conventional Generation Facilities]		*[https://www.epri.com/research/programs/112046/results/3002025349 Cyber Incident Response Playbook Guideline for Renewable and Conventional Generation Facilities]

Jlawrence: /* Incident Response Playbooks */

2024-12-11T15:28:37Z

Incident Response Playbooks

← Older revision		Revision as of 15:28, 11 December 2024
Line 47:		Line 47:
	*Before beginning work on a playbook, it is crucial to determine the scope of the playbook, the audience for which the playbook is written, and the level of detail for the various components of the playbook to minimize the amount of rework or wasted effort.		*Before beginning work on a playbook, it is crucial to determine the scope of the playbook, the audience for which the playbook is written, and the level of detail for the various components of the playbook to minimize the amount of rework or wasted effort.
	*It is practically impossible to develop a playbook for every possible incident that could occur. This is particularly true in the case of detailed, granular playbooks designed for specific systems. Organizations should prioritize incident scenarios that are of high risk.		*It is practically impossible to develop a playbook for every possible incident that could occur. This is particularly true in the case of detailed, granular playbooks designed for specific systems. Organizations should prioritize incident scenarios that are of high risk.

			*[https://www.epri.com/research/programs/112046/results/3002025349 Cyber Incident Response Playbook Guideline for Renewable and Conventional Generation Facilities]
			*[https://www.epri.com/research/programs/112046/results/3002014270 Incident Response Guidance: Generation Cyber Security-Computer Based Technology Transfer (CBTT) Module]
			*[https://www.epri.com/research/programs/112046/results/3002014147 Incident Response Guideline: Generation Cyber Security]

	==Exercises and Training==		==Exercises and Training==

Jlawrence: /* Incident Response Program */

2024-10-31T18:18:26Z

Incident Response Program

← Older revision		Revision as of 18:18, 31 October 2024
Line 21:		Line 21:
	'''Relevant EPRI Resources'''		'''Relevant EPRI Resources'''
	* [https://www.epri.com/research/programs/112046/results/3002025349 Cyber Incident Response Playbook Guideline for Renewable and Conventional Generation Facilities]		* [https://www.epri.com/research/programs/112046/results/3002025349 Cyber Incident Response Playbook Guideline for Renewable and Conventional Generation Facilities]
	* [https://www.epri.com/research/programs/112046/results/3002019699 Developing a Tamper Indicating Device (TID) Program for Cyber-Physical Security]
	* [https://www.epri.com/research/programs/112046/results/3002014270 Incident Response Guidance: Generation Cyber Security-Computer Based Technology Transfer (CBTT) Module]		* [https://www.epri.com/research/programs/112046/results/3002014270 Incident Response Guidance: Generation Cyber Security-Computer Based Technology Transfer (CBTT) Module]
	* [https://www.epri.com/research/programs/112046/results/3002014147 Incident Response Guideline: Generation Cyber Security]		* [https://www.epri.com/research/programs/112046/results/3002014147 Incident Response Guideline: Generation Cyber Security]

Jlawrence: /* Incident Response Program */

2024-10-31T18:16:23Z

Incident Response Program

← Older revision		Revision as of 18:16, 31 October 2024
Line 14:		Line 14:

	'''Current incident response program practices and recommendations''' include:		'''Current incident response program practices and recommendations''' include:
	*Organizations document their overarching OT Cyber Security Incident Response in an incident response plan, which provides information, guidance, and structure to support response and recovery activities.		*Organizations document their overarching OT Cyber Security Incident Response in an incident response plan, which provides information, guidance, and structure to support response and recovery activities. In North America, NERC CIP-003 and CIP-008 address incident reporting and response requirements, which help shape the incident response plan.
	**In North America, NERC CIP-003 and CIP-008 address incident reporting and response requirements, which help shape the incident response plan.		*The Cyber Security Incident Response Team (CSIRT) is the core group of multidisciplinary resources responsible for quickly and efficiently returning impacted cyber systems to normal operations. The CSIRT involves multiple internal players across OT, IT, operation, facility, legal, HR, compliance, and communications. The team coordinates with external partners such as OEM vendors, law enforcement, and information-sharing forums. It is a best practice to document the roles and responsibilities of all potential stakeholders in the incident response plan.
	*The Cyber Security Incident Response Team (CSIRT) is the core group of multidisciplinary resources responsible for quickly and efficiently returning impacted cyber systems to normal operations. The CSIRT involves multiple internal players across OT, IT, operation, facility, legal, HR, compliance, and communications. The team coordinates with external partners such as OEM vendors, law enforcement, and information-sharing forums.
	**It is a best practice to document the roles and responsibilities of all potential stakeholders in the incident response plan.
	*Various policies, plans, and procedures serve different purposes and often interact together to create an effective response and recovery program. Establishing clear definitions and purposes, handover points, and relationships is crucial for a smooth transition between response and recovery phases and collaborating teams.		*Various policies, plans, and procedures serve different purposes and often interact together to create an effective response and recovery program. Establishing clear definitions and purposes, handover points, and relationships is crucial for a smooth transition between response and recovery phases and collaborating teams.
	*Ensure the plan's users and stakeholders can easily access necessary policies, procedures, contact information, and other documents when needed. Offline copies at applicable sites are advisable in case of communication loss.		*Ensure the plan's users and stakeholders can easily access necessary policies, procedures, contact information, and other documents when needed. Offline copies at applicable sites are advisable in case of communication loss.

Jlawrence: /* Incident Response Program */

2024-10-31T18:15:56Z

Incident Response Program

← Older revision		Revision as of 18:15, 31 October 2024
Line 17:		Line 17:
	**In North America, NERC CIP-003 and CIP-008 address incident reporting and response requirements, which help shape the incident response plan.		**In North America, NERC CIP-003 and CIP-008 address incident reporting and response requirements, which help shape the incident response plan.
	*The Cyber Security Incident Response Team (CSIRT) is the core group of multidisciplinary resources responsible for quickly and efficiently returning impacted cyber systems to normal operations. The CSIRT involves multiple internal players across OT, IT, operation, facility, legal, HR, compliance, and communications. The team coordinates with external partners such as OEM vendors, law enforcement, and information-sharing forums.		*The Cyber Security Incident Response Team (CSIRT) is the core group of multidisciplinary resources responsible for quickly and efficiently returning impacted cyber systems to normal operations. The CSIRT involves multiple internal players across OT, IT, operation, facility, legal, HR, compliance, and communications. The team coordinates with external partners such as OEM vendors, law enforcement, and information-sharing forums.
	**It is ~~the~~ best practice to document the roles and responsibilities of all potential stakeholders in the incident response plan.		**It is a best practice to document the roles and responsibilities of all potential stakeholders in the incident response plan.
	*Various policies, plans, and procedures serve different purposes and often interact together to create an effective response and recovery program. Establishing clear definitions and purposes, handover points, and relationships is crucial for a smooth transition between response and recovery phases and collaborating teams.		*Various policies, plans, and procedures serve different purposes and often interact together to create an effective response and recovery program. Establishing clear definitions and purposes, handover points, and relationships is crucial for a smooth transition between response and recovery phases and collaborating teams.
	*Ensure the plan's users and stakeholders can easily access necessary policies, procedures, contact information, and other documents when needed. Offline copies at applicable sites are advisable in case of communication loss.		*Ensure the plan's users and stakeholders can easily access necessary policies, procedures, contact information, and other documents when needed. Offline copies at applicable sites are advisable in case of communication loss.

Jlawrence: /* Backup and Recovery (Asset) */

2024-10-31T18:15:14Z

Backup and Recovery (Asset)

← Older revision		Revision as of 18:15, 31 October 2024
Line 97:		Line 97:

	'''Relevant EPRI Resources'''		'''Relevant EPRI Resources'''
	* [https://www.epri.com/research/programs/112046/results/3002018935 Backup and Restore Cyber Security Best Practices: Cyber Security for Generation Assets Guideline]
	* [https://www.epri.com/research/programs/112046/results/3002018935 Backup and Restore Cyber Security Best Practices: Cyber Security for Generation Assets Guideline]		* [https://www.epri.com/research/programs/112046/results/3002018935 Backup and Restore Cyber Security Best Practices: Cyber Security for Generation Assets Guideline]

Jlawrence: /* Security Operations and Incident Classification */

2024-10-30T19:50:46Z

Security Operations and Incident Classification

← Older revision		Revision as of 19:50, 30 October 2024
Line 108:		Line 108:
	*Identifying key cyber security metrics is becoming critical for security operations to communicate effectively and consistently and to prioritize the overwhelming amount of security-related data.		*Identifying key cyber security metrics is becoming critical for security operations to communicate effectively and consistently and to prioritize the overwhelming amount of security-related data.
	*Workforce development for OT security operations is a persistent challenge due to a shortage of skilled OT security professionals.		*Workforce development for OT security operations is a persistent challenge due to a shortage of skilled OT security professionals.

			'''Relevant EPRI Resources'''
			* [https://www.epri.com/research/programs/112046/results/3002014509 Integrated Security Operations Center and Monitoring and Diagnostic Center Data Integration: Generation Cyber Security]

Jlawrence: /* Backup and Recovery (Asset) */

2024-10-30T19:49:01Z

Backup and Recovery (Asset)

← Older revision		Revision as of 19:49, 30 October 2024
Line 95:		Line 95:
	*It is best practice to employ a graded approach to backup and recovery based on the risk and capability associated with the device and the organizational maturity.		*It is best practice to employ a graded approach to backup and recovery based on the risk and capability associated with the device and the organizational maturity.
	*Backup and recovery tools may be embedded in a system or purchased from third-party vendors, but no single tool can backup, restore, and manage all backups. OT asset owners must carefully evaluate available tools to manage and automate the backup and recovery process.		*Backup and recovery tools may be embedded in a system or purchased from third-party vendors, but no single tool can backup, restore, and manage all backups. OT asset owners must carefully evaluate available tools to manage and automate the backup and recovery process.

			'''Relevant EPRI Resources'''
			* [https://www.epri.com/research/programs/112046/results/3002018935 Backup and Restore Cyber Security Best Practices: Cyber Security for Generation Assets Guideline]
			* [https://www.epri.com/research/programs/112046/results/3002018935 Backup and Restore Cyber Security Best Practices: Cyber Security for Generation Assets Guideline]

	==Security Operations and Incident Classification==		==Security Operations and Incident Classification==

Jlawrence: /* Disaster Recovery Plans (System) */

2024-10-30T19:48:05Z

Disaster Recovery Plans (System)

← Older revision		Revision as of 19:48, 30 October 2024
Line 85:		Line 85:
	*A DRP is activated once the cyber event has been confirmed, declared, classified, contained, and evidence gathered. The condition for activation can leverage existing incident classifications to provide further clarifications.		*A DRP is activated once the cyber event has been confirmed, declared, classified, contained, and evidence gathered. The condition for activation can leverage existing incident classifications to provide further clarifications.
	*Recovery prioritization strategy may be determined by considering the recovery objectives, critical function and system/asset, dependencies or interdependencies, eradication and recovery strategy, and continuous damage analysis.		*Recovery prioritization strategy may be determined by considering the recovery objectives, critical function and system/asset, dependencies or interdependencies, eradication and recovery strategy, and continuous damage analysis.

			'''Relevant EPRI Resources'''
			* [https://www.epri.com/research/programs/112046/results/3002027732 OT Cyber Security Disaster Recovery Plan Guide]

	==Backup and Recovery (Asset)==		==Backup and Recovery (Asset)==

Jlawrence: /* Exercises and Training */

2024-10-30T19:46:20Z

Exercises and Training

← Older revision		Revision as of 19:46, 30 October 2024
Line 59:		Line 59:
	**In Europe, the ENISA organizes the biennial Cyber Europe to test and improve the collaboration response capabilities of private companies, government agencies, and other relevant stakeholders. Cyber Europe 2024 focuses on the energy sector, inspired by a record number of attacks in recent years and ongoing geopolitical tension threatening the energy infrastructure.		**In Europe, the ENISA organizes the biennial Cyber Europe to test and improve the collaboration response capabilities of private companies, government agencies, and other relevant stakeholders. Cyber Europe 2024 focuses on the energy sector, inspired by a record number of attacks in recent years and ongoing geopolitical tension threatening the energy infrastructure.
	*NERC CIP-003, CIP-008, and CIP-009 require “testing” of periodic incident response and recovery plans by responding to real cyber security incidents or performing tabletop or operational exercises.		*NERC CIP-003, CIP-008, and CIP-009 require “testing” of periodic incident response and recovery plans by responding to real cyber security incidents or performing tabletop or operational exercises.

			'''Relevant EPRI Resources'''
			* [https://www.epri.com/research/programs/112046/results/3002023747 Cyber Security Exercise Scenarios: Second Edition]

	==Incident Response Scenarios==		==Incident Response Scenarios==