Agile Incident Response in Industrial Control Environments
Helge Janicke, Richard Smith, Leandros A. Maglaras, Allan Cook, Ying He, Fenia Gkolfo Ferra · 2021
Industrial control systems (ICSs) often use operating systems, applications, and procedures that may be considered unconventional by contemporary IT professionals and have operational requirements that include the management of processes that, if not executed in a predictable manner, may result in injury, loss of life, damage to the environment, as well as serious financial issues such as production losses that may have a negative impact on a nation’s economy. The Agile method has been proved to be useful in the context of IT incident response; however, it has not been effectively utilized within the ICS domain. This chapter explores how Agile can be integrated into ICS incident response, through mapping the four Agile values to the unique characteristics of ICS. It details the methodologies adopted by the Blue team. The chapter provides information on the tools that were utilized by the participants as part of the sprint lifecycle to aid their situational awareness and decision-making.