CYBRARY Unit 4 — Working a breach without breaking the plant
12 minThe safe response in a plant
Why the IT reflex — isolate the box — is often the wrong move here, and what the alternatives are.
By the end you can
- Say why isolating a controller can be more dangerous than the intrusion.
- Choose between containing at a conduit, escalating and preserving.
- Explain who owns the decision to stop a process.
Availability is a safety property here
In an office, pulling a compromised machine off the network is the cautious move. On a plant floor it can be the dangerous one: a controller taken offline mid-batch may leave a vessel heating with nothing watching it. The cautious move is the one that keeps the process observable and controlled while the intrusion is cut off somewhere it is safe to cut.
The decision to stop a process belongs to operations — the plant manager or shift lead — not to the analyst. The analyst's job is to give them an accurate picture fast enough to decide, and to preserve what will be needed afterwards.
The responses you can take
These are the four moves the breach response lab grades you on.
| Response | When it is right |
|---|---|
| Cut it at the conduit | Close the boundary the traffic used. The process keeps running behind it. |
| Escalate to operations first | Nothing is touched until the control room and the safety authority agree. |
| Watch it and preserve the evidence | Keep the view, take the disk or the trend, do not change the plant. |
| Close it — routine plant behavior | Explainable by the shift's own work. Closing it is the right call. |
| Isolate the controller now | The IT answer. On a running line it removes the control room's view. |