Strengthening incident response efforts in operational technology environments

Abstract

This master thesis examines the main challenges tied to incident response within opera- tional technology environments, as well as the practices organizations involved in essential operations are implementing to secure a successful approach to incident response in such environments. This is based on our research questions: RQ1: What are the main challenges of Incident Response (IR) within Operational Technology (OT) environments? And RQ2: What practices can organizations engaged in essential operations implement for a successful approach towards IR in OT environments? Based on our findings, we intend to present some practices we think are important to ensure a successful approach to IR in OT environments.

Methodologically, this study has an exploratory qualitative approach. This selection is based on the need to examine incident management in OT environments in their natural context. By gathering data through interviews and previous research and applying an inductive an- alytical approach, this study gives insight into subjective perceptions and opinions among actors in the OT environment. Through our work, we have focused on the emerging meaning and an evolutionary design where we look for understanding the central principles that are within the field. Our findings from the study show that organizations are facing multiple challenges considering their IR within OT environments, including the handling of legacy systems, the need for continuous operation, the implementation of security updates, and the dependency on third-party vendor support and maintenance. Competence and culture within the organization also play a pivotal role in securing effective IR. Respondents high- light the importance of having robust detection mechanisms and conducting regular exercises and training to improve preparedness.

The implications show that although our findings support existing theory considering the importance of having a solid plan for IR, do they also contribute to new insights that were explicitly not noticed in our systematic literature review. Our study highlights the necessity of dynamic and flexible frameworks for responsibility during incidents, as well as the need for integrated cooperation between IT and OT departments. Other practical implications include recommendations considering the implementation of immutable backups for data integrity, the use of sandboxing, and the development of clear procedures and roles dur- ing the IR. The study also underscores the importance of defense-in-depth strategies and diversifying the use of third-party vendors to reduce their vulnerability. To ensure that organizations can have a successful approach to IR within OT environments, they should implement clear procedures for role delegations and decisions, develop risk assessments, se- cure continuous revision of security procedures, and promote a culture of security awareness and skill development.