In the heart of a cyber crisis, when every second counts, the biggest threat to a company may not be the malware itself, but the internal war between two key teams: IT security and OT engineering. Each of them, acting in good faith and according to the best knowledge in their field, can pull the emergency brakes that will steer the entire organization straight toward disaster. One team fights to save data and systems, the other to save machines and human lives.
This fundamental conflict of priorities, if not resolved long before the incident, leads to decision-making paralysis. Valuable minutes and hours, during which the attacker consolidates his position in the network, are wasted on arguments, mutual accusations and attempts to understand the other side’s perspective. In the heat of battle, there is no time for this. This is why an Incident Response Plan (IRP) in an OT environment is much more than a technical procedure.
It is primarily a pre-negotiated peace agreement between IT and OT. It’s a document in which the toughest decisions have been made in quiet times so that no one has to improvise in a moment of crisis. Creating such a plan is one of the most difficult, but also the most important, steps in building mature industrial resilience.
Shortcuts
- Why is it that in the midst of a cyberattack, your best teams can become your worst enemies?
- “Isolate and contain”: Why is it a natural reflex for an IT team to disconnect from the network?
- “Maintain the process at all costs”: Why is a sudden stop worse than a virus for an OT engineer?
- What is decision paralysis and how does it give the attacker the most valuable resource - time?
- Why is the OT incident response plan primarily a negotiation document and not a technology?
- How do you build an integrated response team that understands both sides of a conflict?
- Why do key decisions, such as stopping production, have to be made and recorded long before an attack?
- Key elements of an effective OT incident response plan
- What are playbooks and how to prepare ready-made scenarios for responding to the most common attacks?
- Other than disconnection, what threat containment strategies are safe for OT?
- How to create a crisis communication plan to avoid chaos and misinformation?
- Why is an untested plan worse than no plan at all - the role of “tabletop” exercises?
- How does having a mature IRP plan for OTs help meet NIS2 reporting requirements?
- How can nFlo help moderate conflict and build an effective response plan for your company?
- Are you ready for the moment when you have to choose between digital and physical security?
Why is it that in the midst of a cyberattack, your best teams can become your worst enemies?
This conflict is inevitable because it stems from the fundamentally different “DNA” of the two teams. The IT security team has been trained and rewarded for years for one thing: stopping digital threats quickly and decisively. Their playbooks, procedures and instincts tell them the same proven course of action: detect, identify, isolate, eliminate.
The OT engineering team, on the other hand, has been trained and rewarded for something quite different: maintaining maximum availability, stability and safety of the physical process. Their world is governed by the laws of physics, and their instincts tell them that unpredictable and sudden changes in control systems are a straightforward path to failure, equipment damage or, in the worst case scenario, a human accident.
When a cyber attack occurs, these two worlds collide with tremendous force. The IT specialist sees malicious code spreading through the network and wants to “extinguish” it at all costs, even if it means temporarily shutting down parts of the systems. The OT engineer sees a delicate, synchronized physical process and knows that a sudden “shutdown” can be worse in its consequences than the virus itself. Both sides are right, but their “rationales” contradict each other.
📚 Read the complete guide: SOC: Security Operations Center - what it is, how it works, how to choose
”Isolate and contain”: Why is it a natural reflex for an IT team to disconnect from the network?
For any IT incident response specialist (e.g., SOC/CSIRT analyst), the first and most important phase after detecting a threat is containment. The goal is to limit the spread of the attack as quickly as possible and minimize the damage. The simplest and most effective containment method is to isolate the infected system or network segment from the rest of the infrastructure.
This is a learned and repeatedly tested reflex. Disconnecting an infected laptop from a Wi-Fi network, blocking the IP address of the server from which the attack originated, or placing an entire suspicious network segment in “quarantine” via rules on a firewall - these are standard, everyday actions. In the IT world, where data protection is a priority, the temporary unavailability of one or more systems is an acceptable price to pay to stop the bleeding.
This mindset is deeply rooted in methodologies and standards, such as those developed by NIST. The entire logic of IT response is based on the premise that the digital threat is the greatest enemy, and that quick and decisive isolation is the best weapon. That’s why, when seeing an alert on an OT network, the IT team instinctively reaches for its proven tools.
”Maintain the process at all costs”: Why is a sudden stop worse than a virus for an OT engineer?
The perspective of an OT engineer is radically different. For him, the biggest enemy is unplanned downtime and loss of control of the physical process. He knows by heart all the relationships in his complex machinery. He knows that a sudden cutoff of communication with the PLC managing the welding robots can cause the robot arms to stop mid-cycle, potentially colliding with each other and causing mechanical damage.
He also knows that in chemical or energy processes, a sudden loss of control of valves or cooling systems can lead to a dangerous increase in pressure or temperature within seconds, posing a real risk of explosion or fire. Emergency Safe Shutdown (ESD) procedures for such processes are extremely complex and must be triggered in a controlled manner, not by randomly cutting off a network cable.
That’s why, to an OT engineer, the proposal “let’s disconnect this segment” sounds like the proposal “we’re going to turn off the engine in an airplane in flight because we suspect something is wrong with the electronics.” From his perspective, the risk of an uncontrolled shutdown is far more tangible, immediate and catastrophic in its consequences than the abstract risk of spreading some virus whose workings he does not yet fully understand.
What is decision paralysis and how does it give the attacker the most valuable resource - time?
When these two conflicting logics collide in the heat of a crisis, the result is decision paralysis. The IT team is afraid to take responsibility for potential physical damage. The OT team is afraid to take responsibility for the spread of a cyber attack. As a result, no one makes any decisions. Feverish phone calls, arguments and attempts to convince each other of their reasons begin.
This chaos and inaction is the best gift an attacker can give. While key employees are wasting time with competency disputes, the malware continues its work - encrypting more systems, stealing data, spreading to more network segments. An attacker who can observe this helplessness gains invaluable time to consolidate his position and achieve his goals.
Every minute of delay in taking effective containment action multiplies the scale of the damage and the costs associated with the subsequent restoration of systems. The decision-making paralysis resulting from the lack of prior agreements is often far more damaging than the initial incident itself.
Why is the OT incident response plan primarily a negotiation document and not a technology?
To avoid decision-making paralysis, it is necessary to create a dedicated incident response plan for the OT environment. However, the key to success is not to write down hundreds of pages of technical procedures. The most important and difficult work on this plan takes place long before the incident and is not technical, but organizational and negotiating in nature.
The IRP plan for OT is first and foremost a document in which the most difficult risk decisions are negotiated and made in advance. It is in this document, in a calm environment, that representatives of IT, OT and management have to sit around the same table and jointly answer the most difficult questions: “Under what circumstances are we ready to stop Production Line A? Who has the authority to make such a decision? What is a safe procedure for stopping it? And under what circumstances do we accept the risk of continuing to operate the infected system with other countermeasures?”
Creating such a plan is a process of pre-negotiating compromises. The IT team must learn that in OT there are other, less intrusive methods of containment than disconnecting from the network. The OT team, in turn, must understand that in certain situations, a controlled, emergency process stop will be the lesser evil than allowing an attacker to take control of the plant.
How do you build an integrated response team that understands both sides of a conflict?
Effective OT incident response is not possible if you operate in silos. It is necessary to establish a permanent, interdisciplinary OT incident response team (OT CSIRT) that includes representatives from both worlds. Such a team is the foundation of any mature strategy.
The team should include not only cyber security specialists from IT (SOC analysts, computer forensics experts), but especially process engineers, automation engineers and operators from the OT department. They are the ones with the unique, essential knowledge of how control systems work and what the consequences of particular actions might be. Without their active participation, any IT response will be a shot in the dark.
In addition to technical experts, the team must also include representatives from plant management (which ultimately makes business decisions), the legal department (which assesses compliance with regulations, such as NIS2) and corporate communications. This integrated structure ensures that, at the moment of crisis, the response is consistent, coordinated and takes into account all perspectives - technical, operational, business and legal.
Why do key decisions, such as stopping production, have to be made and recorded long before an attack?
As already mentioned, the most difficult decisions are those that carry the risk of huge financial losses or threats to physical security. The decision to make an emergency stop of a key production line is one of them. Leaving such a decision to be made in the heat of battle, when emotions are running high and information is incomplete, is asking for a mistake.
This is why the preparation phase in the IRP plan is so crucial. This is when an integrated team must calmly analyze all critical processes in the company and for each of them define “red lines” and escalation procedures in advance. The plan must clearly define which types of incidents and in which systems automatically trigger a controlled stop procedure.
The plan must also clearly define the decision-making chain. Who has the authority to make the final decision to stop a million-euro-an-hour production? Is it the shift leader, the plant manager, or perhaps the CISO? These roles and responsibilities must be clearly written and communicated throughout the organization. That way, in a moment of crisis, no one wastes time wondering who is in charge.
Key elements of an effective OT incident response plan
Element of the PlanTargetKey Action1. integrated TeamEnsure collaboration and understanding between IT, OT and the business.Establish a permanent OT CSIRT team with representatives from all parties.2. pre-negotiated DecisionsAvoid decision-making paralysis during a crisis.Defining in advance in which scenarios we stop production and who decides.3. script playbooksPrepare ready-made, step-by-step instructions for action.Develop playbooks for the most likely attacks (e.g., ransomware on SCADA).4 Crisis CommunicationEnsure an efficient and consistent flow of information.Creating a communication matrix (who, whom, when, and about what).5. regular ExerciseVerifying and improving the plan, building “muscle memory.”Conducting periodic tabletop simulation exercises.
What are playbooks and how to prepare ready-made scenarios for responding to the most common attacks?
An incident response plan (IRP) is a strategic document that provides a general framework for action. However, in practice, at the time of a specific attack, the team needs much more detailed instructions. This role is fulfilled by playbooks, or response scenarios. A playbook is a detailed, almost checklist-like procedure for dealing with a specific type of incident.
A good set of playbooks should cover the most likely and most threatening scenarios for an organization. Examples of playbooks for OTs include: “Responding to a ransomware attack on an HMI station,” “Responding to the detection of unauthorized modification of a PLC program,” or “Responding to a DoS attack on a SCADA server.”
Each playbook should include detailed steps to be performed in each phase of the response: from alert verification, analysis, containment (including OT-safe methods), threat elimination, to system restoration and post-incident actions. Having ready-made playbooks drastically reduces response time and reduces the risk of mistakes under pressure.
Other than disconnection, what threat containment strategies are safe for OT?
The IT team needs to understand that in the OT world, “disconnecting from the network” is a last resort, not a standard action. There are a number of other, more subtle and safer methods of containment that should be considered first. The most important of these is the precise modification of rules on firewalls that segment the network.
If we suspect that a particular computer has been infected, instead of cutting off the entire segment it is in, we can create a rule on the firewall that blocks only suspicious communications coming from that one computer, while allowing the rest of the systems in the segment to continue to operate legally.
Another strategy is to increase the level of monitoring. We can redirect all traffic from a suspicious segment for detailed analysis (e.g., in a sandbox system) to thoroughly understand the nature of the attack before taking more drastic steps. In some cases, the best strategy may even be to temporarily allow the attacker to operate in a controlled environment (known as a “honeypot”) in order to learn about his goals and methods, while preparing for a coordinated counterattack.
How to create a crisis communication plan to avoid chaos and misinformation?
During a cyber attack, information is as important as technical operations. Lack of consistent and organized communication leads to chaos, rumors and decision-making based on incomplete or false data. Therefore, an integral part of the IRP plan must be a crisis communications plan.
The plan must specify precisely who is responsible for communicating with the various stakeholder groups. Who reports progress to the board of directors? Who contacts the legal department about reporting obligations to regulators? Who (and if at all) communicates with the media, customers or partners?
It is essential to create a so-called communication matrix that clearly defines who is communicating, under what circumstances, through what channels and about what. The plan should also include pre-prepared templates for messages and statements, which only need to be supplemented with details at the moment of crisis. This allows for quick, consistent and professional communication that builds trust and helps bring the situation under control.
Why is an untested plan worse than no plan at all - the role of “tabletop” exercises?
Having a response plan that lies untouched in a binder is an illusion of preparedness. A plan that has never been tested in practice is full of hidden flaws, ambiguities and erroneous assumptions that will only come to light in the heat of a real crisis. Worse, it provides a false sense of security that puts vigilance to sleep.
Therefore, a key element of the IRP plan life cycle is regular simulation exercises. The most popular and effective form of such exercises are “tabletop exercises. ” These involve gathering the entire integrated response team in one room and taking them through a hypothetical but realistic attack scenario step by step.
The facilitator presents the next stages of the attack, and the team must, on the basis of the plan at hand, make decisions together and describe their actions. Such exercises in a safe environment mercilessly expose all weaknesses in the plan - gaps in procedures, communication problems, competence conflicts. The conclusions of each such session are invaluable material for continuous improvement and streamlining of the organization’s real readiness.
How does having a mature IRP plan for OTs help meet NIS2 reporting requirements?
The NIS2 directive imposes very stringent reporting obligations on key and important players for major incidents. Organizations must provide an “early warning” to the national CSIRT team within 24 hours of identifying an incident, and a detailed report within 72 hours. Meeting these deadlines is impossible without having a well-defined and rehearsed response plan.
A mature IRP plan contains all the elements necessary for prompt and effective reporting. Analysis procedures make it possible to quickly assess whether an incident is “serious” as defined by the directive. An integrated team with input from the legal department knows what information to collect and how to formulate it in the report. The communication plan clearly defines who is responsible for contacting regulators.
Having a documented and regularly tested plan is also the best evidence that a company is approaching its responsibilities in a sound manner. In the case of post-incident inspections, being able to provide detailed records of the response, consistent with a pre-approved plan, is a key mitigating factor and evidence of the company’s organizational maturity.
How can nFlo help moderate conflict and build an effective response plan for your company?
At nFlo, we understand very well that the biggest challenge in creating a response plan for OT is not technology, but breaking down the communication and cultural barriers between IT and OT. What is often needed is an external, neutral facilitator who can “translate” the needs and concerns of both parties into a common risk management language. Our role often begins here.
Our consultants, experienced in both IT security and the specifics of industrial environments, facilitate workshops where we help your teams work together to define priorities, agree on procedures and build an integrated response model. We help you develop realistic threat scenarios for your industry and create practical, useful playbooks based on those scenarios.
Most importantly, we specialize in planning and conducting tabletop simulation exercises. Under controlled conditions, we take your newly formed team through a realistic cyber-attack scenario, testing in practice the procedures created and identifying areas for improvement. Our goal is not just to provide you with a document, but to build a realistic, rehearsed and integrated capability for your organization to survive a digital crisis.
Are you ready for the moment when you have to choose between digital and physical security?
The question posed in the title - “to disconnect or not to disconnect?” - is not a technical question. It’s a question about strategy and fundamental risk choices. Any industrial company that is serious about its resilience must ask itself this question and find the answer before attackers do it for it.
Lack of preparation means that in a moment of crisis you will be forced to improvise and make decisions based on fear and incomplete information. Preparation means you know what to do, your team knows what to do, and roles and responsibilities are clear. This is the difference between chaos and a controlled response.
Therefore, don’t wait for the first major incident. Initiate a conversation between your IT and OT teams today. Start building bridges of understanding and joint plans. Because the moment when you have to choose between digital and physical security is bound to come. And your preparation will determine whether it will be just a difficult decision or the beginning of a disaster.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Ransomware — Ransomware is a type of malicious software (malware) that blocks access to a…
- Security Operations Center (SOC) — Security Operations Center (SOC) is a central location where a team of security…
- SOC as a Service — SOC as a Service (Security Operations Center as a Service), also known as…
- Network Security — Network security is a set of practices, technologies, and strategies aimed at…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
Learn More
Explore related articles in our knowledge base:
- What are the best practices for preventing cyberattacks on local governments?
- Cloud Migration Strategies: Best Practices, Challenges and Cost Optimization
- EU funding for cybersecurity - how public sector organizations can leverage recovery funds
- How does an OT cybersecurity audit become the key to winning a water utility grant
- How much does downtime really cost after a cyberattack? A ready-made template for calculating your company’s losses
Explore Our Services
Need cybersecurity support? Check out:
- Security Audits - comprehensive security assessment
- Penetration Testing - identify vulnerabilities in your infrastructure
- SOC as a Service - 24/7 security monitoring
Related topics
See also:
