The conference room was heating up 3 months ago on a cold January day as law enforcement, a county emergency planner, and the staff for a small municipal utility dealt with cyber attacks on the utility’s power generation, water, and wastewater control systems.
Fortunately for the 25 participants, this was only a test; actually, it was table top exercise facilitated by Control Systems Security Program (CSSP) staff.
The facilitators, with the exercise play book in hand, released a series of “injects” or story lines throughout the day. The injects were designed to test the utility’s response to internal and external cyber attacks on its control systems.
The facilitators followed up with probing questions to generate discussions on how the participants would handle the topic at hand. A variety of subjects were covered, including the traditional cybersecurity issues of access control, remote access, perimeter defenses, logging, and auditing. The exercise also covered noninformation technology subjects.
For example, one of the injects produced conversations on the human resources policies and procedures for dealing with an employee suspected of an internal cyber attack. Another inject forced the agency to think about recommended practices for handling local and national media coverage caused by disruption of services because of the cyber attack.
The participants then held “hot washes” that highlighted key points and takeaways following the completion of each scenario. The notes and hot washes were used by the utility’s staff to develop an action plan.
Was it worth it? According to both the utility’s security and safety specialists who were responsible for coordinating the exercise, it definitely was. As a result of the exercise, utility staff will review and update policies and procedures, mitigate identified security gaps, strengthen cyber defenses, and provide more cybersecurity training for the staff.
But perhaps the most valuable benefit of the exercise was that it jump-started crucial conversations and interactions between stakeholders that will undoubtedly lead to a more secure environment for their ICSs.
According to the security specialist, “The tabletop was a way for us to put our heads together and collaborate on how we would handle specific, realistic cybersecurity incidents. With the expertise of the DHS CSSP staff that created the scenarios and injects, we were forced to work together and talk through what we are doing already and where we have more work to do.
Incident response is critical. During a real incident, you don’t want to discover major gaps in policy/procedure and/or technology tools. In addition, the collaboration that occurred during the day of the tabletop helps us all to understand the roles and responsibilities that each of us have in situations such as those we worked through for the tabletop exercise.
My hope is that we could do a tabletop exercise like this on a recurring basis so that the participants continue to improve our incident response capabilities and security posture.
If you have questions or want more information on conducting a table top exercise for your ICS please contact us at cssp@hq.dhs.gov.