OT IR
OT incident response literacy names safety-first containment, operations coordination, and forensic preservation boundaries on YOUR $OT_LAB — defensive OT literacy only; no real-plant attacks, unauthorized OT scans, or exploit cookbooks.
Visual · t38_ot_ir
OT IR literacy. $OT_LAB only. Original Cyberlium.
OT incidents can hurt people — literacy names IR steps that prioritize safety and operations partnership.
OT incident response coordinates with operations before isolation that could trip processes, preserves forensic images from jump hosts and historians (with approval), and escalates using OT-specific playbooks. Practice IR phase rows on fictional scenarios — not disruptive containment on live plants without authorization. Cyberlium Topic 38 practices on $OT_LAB — YOUR fictional OT templates, zone diagrams, and labeled checklists under $HOME/cyberlium-lab/t38-ot/ no real-plant attacks, unauthorized OT scans, or exploit cookbooks. Next: Reporting.
1. What OT IR covers (named)
OT IR literacy: detect, triage with operations, contain safely, eradicate, recover, lessons learned. Safety check before network isolation that affects control paths. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Write OT IR phase row — phase, OT-specific action, escalation contact stub. LAB-OT-001 tabletop scenario only. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Command guide
Try these commands — What OT IR covers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA incident response — https://www.cisa.gov/topics/industrial-control-systems NIST SP 800-82 — https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export OT_LAB=${OT_LAB:-$HOME/cyberlium-lab/t38-ot}
cat > "$OT_INCIDENT/ot-ir-phases.md" <<'EOF'
# OT IR Phases — tabletop literacy
1. Detect — OT SOC alert
2. Triage — coordinate with operations (safety check)
3. Contain — safe isolation per playbook
4. Eradicate/Recover — vendor-validated restore
5. Lessons learned — tracked remediations
NEVER: unplug live PLCs without operations approval
EOFCommand — copy this
grep -E 'Triage|NEVER|Lessons' "$OT_INCIDENT/ot-ir-phases.md"
Primary tools to practice this lesson: grep, python3. Reference sites: CISA incident response (https://www.cisa.gov/topics/industrial-control-systems); NIST SP 800-82 (https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why OT IR matters for defenders
IT-centric IR runbooks can worsen OT outages. Document operations bridge contact in every playbook. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Students draft IR phase cards on lab notes. Production follows OT IR programs and regulators. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
3. $OT_LAB boundary
Forbidden: unplugging live PLCs for 'forensics' without operations approval. Allowed: OT IR literacy tabletop on OT lab. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Ship: OT IR phase card. Next: Reporting.
4. What you ship: ot ir card for $OT_LAB
OT incident response literacy names safety-first containment, operations coordination, and forensic preservation boundaries. $OT_LAB named. NEVER real-plant attack steps. chmod 600.
5. What you record before the next lesson
Date (UTC). OT IR card. $OT_LAB named. File t38-m09-l01-ot-ir.txt chmod 600.
6. Wrong vs right: plant attacks vs YOUR OT lab sims
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Isolate live safety network segment without operations sign-off.
- Right: Write ot ir card for YOUR $OT_LAB. Next: Reporting.
Mission: document OT IR on YOUR OT lab
1) Name literacy rows on $OT_LAB. 2) Write NEVER list (no real-plant attacks, unauthorized OT scans, or exploit cookbooks). 3) chmod 600. Never scan or exploit real industrial networks.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: literacy on $OT_LAB — not attack recipes against live plants.
APPLY: OT IR on Cyberlium means:
APPLY: True or False: Topic 38 includes ICS attack cookbooks against real plants.
APPLY: OT IR literacy on Cyberlium uses: