I85PREP
⌘ K
Lead SCADA Security Manager study materials
Lead SCADA Security Manager study resources

Modbus Write from an Engineering Workstation at 02:14

Lead SCADA Security Manager · Put your knowledge to work in context.

All case studies

Modbus Write from an Engineering Workstation at 02:14

A tier-1 water utility serves 400,000 people. At 02:14, a Modbus write (function code 6) from engineering workstation ENG-WS-04 changes a chlorine dosing PLC setpoint from 1.2 to 2.8 mg/L. The operator made no change; the HMI shows no alarm; the PLC accepted the write. The chlorine analyzer reads 1.4 mg/L and rising. The MSSP that monitors IT opens a ticket: 'IT host, medium severity, possible malware.' Its contract excludes OT protocol analysis. The OT engineer is on call but 45 minutes away. ENG-WS-04 uses a shared local admin account and sits on the same flat VLAN as the PLC. The utility has no OT incident response plan; the IT plan says isolate the host, which would sever the only programming path to the PLC. The plant manager asks whether to shut down dosing, and media relations asks whether to notify the state primacy agency.

1. How do you classify and declare this incident, and what are your first operational actions?

Read the worked answer

Classification: this is not 'medium IT malware.' A process setpoint was changed without authorization and the chlorine analyzer is rising. That is a safety-impacting OT incident, even before malware is confirmed.

First actions, in order:

  1. Verify the actual chlorine residual with an independent analyzer and a grab sample; do not trust the HMI alone.
  2. Place dosing in local/manual control and adjust to the target range using the physical control path.
  3. Notify the plant manager, duty operations, and the incident commander; declare an OT incident.
  4. Do not isolate ENG-WS-04 yet. Isolation would remove the only programming path while the PLC state is uncertain. Confirm the PLC is in local/manual and the key switch is locked first.
  5. Escalate to the state primacy agency per the utility's notification procedure. Media relations does not make that call; the incident commander and legal do.

The MSSP misclassified because its statement of work excludes OT protocol analysis. That is a contract and runbook gap, not just an analyst error.

2. What containment sequence would you direct, and how do you preserve evidence without losing process control?

Read the worked answer

Sequence is process safety, then containment, then evidence - but evidence capture can run in parallel if it does not touch the PLC.

  1. Process safety: confirm local/manual control, lock the PLC key switch, and have operations adjust dosing to the verified target.
  2. Evidence: capture a SPAN/TAP packet capture of Modbus traffic, preserve PLC and HMI logs, and image ENG-WS-04 memory before any reboot. Record the PLC program checksum and compare it to the known-good baseline.
  3. Network containment: apply a firewall ACL blocking ENG-WS-04 from the PLC except through an approved engineering path. Quarantine the switch port but keep an out-of-band console available.
  4. Host containment: have the MSSP isolate the IT side only after the OT path is validated. Do not let the MSSP unilaterally disable the NIC.
  5. Credential control: rotate the shared local admin password and disable remote interactive logon on the engineering workstation.

If the PLC cannot be placed in local/manual safely, containment waits. A severed programming path during an unstable process is a greater risk than a monitored, restricted host.

3. What management changes should follow so the next event is not handled as an IT ticket?

Read the worked answer

The root causes are governance and contract gaps, not just the compromised host.

  • Incident plan: add OT-specific declaration criteria (process setpoint change, safety impact, loss of view/control) and an OT incident commander role. The IT 'isolate the host' step must have an OT exception path.
  • MSSP contract: amend the SOW to include Modbus/OT protocol monitoring, OT escalation criteria, and a named OT analyst. Otherwise, buy an OT monitoring service rather than pretending the IT MSSP covers it.
  • On-call: fund 24/7 OT on-call or a remote engineering path with authentication and logging. A 45-minute drive is acceptable only if local operations can safely control the process.
  • Account hygiene: eliminate shared local admin on engineering workstations; use unique accounts and just-in-time elevation.
  • Segmentation: create an OT zone with a conduit to the engineering workstation, not a flat VLAN.

Run a tabletop within 30 days with operations, the MSSP, and legal. Measure success by time to declare, time to local control, and time to preserve evidence - not by ticket closure.