Agile Incident Response in Industrial Control Environments

ICS incident response differs from traditional IT incident response. Whilst there is some crossover many IR practices in IT cannot be directly applied in ICS. Because of this, a new approach is required, one that can adapt quickly and promotes communication between stakeholders. The interview responses of industry professionals have been thematically analyzed with key themes emerging such as the criticality of communication and situational awareness. The four Agile values have been mapped into the context if ICS incident response to meet those requirements along with a number of tools to aid IR teams in the field. Proper incident response can improve technical attribution in relation to ICS