Incident Response in ICS/OT/SCADA | S1 E5

How does Incident Response in ICS/OT/SCADA work? In this episode of Simply ICS Cyber, Don and Tom welcome Kai Thomsen, Director of Global Incident Response Services at ‪@DragosInc‬.

Join us as we answer the questions below and provide more insight into how IR works in OCS, OT, and SCADA:

Is DFIR the same on the OT side as the IT side?
What are some of the challenges the OT DFIR team faces?
In an organization, who is responsible for OT incident response?
What are table tops, how should you conduct them?
What are some table top exercises?
How do you get into OT DFIR?

Connect with Kai on LinkedIn:   / kai-thomsen-a635b21b7  

Discover the Dragos 2025 YIR Report: https://www.dragos.com/ot-cybersecuri...

Check out the Incident Response Table top resources below:

- ‪@CISAgov‬ Tabletop Exercise Packages (CTEPs): https://www.cisa.gov/sites/default/fi...
CISA ICS Training: https://www.cisa.gov/ics-training-ava...
Dean Parson’s ICS Incident Response Tabletops: https://www.sans.org/blog/top-5-ics-i...
Lenny Zeltser Cheat Sheets and Presentations: https://zeltser.com/cheat-sheets/
NERC’s Grid Security Exercise (GridEx): https://www.nerc.com/pa/CI/ESISAC/Pag...
MITRE Cyber Exercise Playbook: https://www.blackhillsinfosec.com/pro...
- ‪@BlackHillsInformationSecurity‬ ICS/OT Backdoors and Breaches: https://spearphish-general-store.mysh...
Center for Internet Security, Tabletop Exercises – Six Scenarios to Help Prepare Your Cybersecurity Team: https://www.cisecurity.org/wp-content...
- ‪@RedCanary‬: Are You Using Tabletop Simulations to Improve Your Information Security Program?: https://redcanary.com/blog/using-tabl...
Dragos Preparing for Industrial Cyber Response Toolkit: https://www.dragos.com/blog/industry-...
Dragos: Preparing for Incident Handling and Response in ICS: https://www.dragos.com/resource/prepa...
Dragos Tabletop Exercise: https://www.dragos.com/tabletop-exerc...
ICS4ICS Incident Command System for Industrial Control Systems: https://www.ics4ics.org/
European Network for Cyber Security (ENCS) Red Team – Blue Team Training: https://encs.eu/training/red-team-blu...

Join us every other Wednesday for Season 1 of the Simply ICS Cyber podcast, with your hosts, Don C. Weber and Tom VanNorman.

Connect with your hosts on LinkedIn:
Don   / cutaway  
Tom   / thomasvannorman  

=========================
Simply Cyber empowers people who want a rewarding cybersecurity career
=========================
All the ways to connect with ‪@SimplyCyber‬
https://SimplyCyber.io/Socials