Monitoring, Detection, and Incident Response
Domain 6 tests passive monitoring, communications baselining, alert triage, and incident response that protects both security and process safety.
Core rules
- Prefer passive monitoring through SPAN ports or TAPs. Avoid active scanning in OT unless approved, scheduled, and tested; some PLCs crash or misbehave under scan traffic.
- Baseline allowed communications by asset, protocol, port, and direction. Alert on new controllers, unauthorized writes, firmware changes, and mode changes.
- Incident response puts safety first, preserves the process, and isolates through ACLs or firewall rules rather than pulling power.
- Coordinate containment with operations. A security action that trips a process can be worse than the intrusion.
- Forensics requires traffic captures and disk or memory images only with operational approval and chain of custody. IT playbooks may not fit OT.
Worked example
An IDS alerts on a new source writing Modbus coils to a water-treatment PLC. Reasoning: verify the source against the asset inventory and check for a change ticket. If unauthorized, block it at the firewall, keep the PLC running, capture traffic, and notify operations. Do not immediately reboot the PLC; that may disrupt treatment.
Traps
Active vulnerability scanning during production; shutting down a PLC as first containment; ignoring process impact; assuming IT EDR can run on PLCs; deleting logs before capture.