book

Incident Management for Industrial Control Systems

Name: Incident Management for Industrial Control Systems
Author: Durgesh Kalya
ISBN: 9781835469712

by Durgesh Kalya

January 2026

Intermediate to advanced

414 pages

11h 8m

English

Packt Publishing

Read now

Unlock full access

Preface
Who this book is forWhat this book coversTo get the most out of this bookAdditional notesGet in touchFree benefits with your bookHow to Unlock
Pillar 1 – Critical Infrastructure as the Foundation
Introduction to Critical Infrastructure
CI and incident managementCybersecurity within CI sectorsAn overview of relevant CI sectorsChemical sectorCommunications sectorCritical manufacturing sectorDams sectorEmergency services sectorEnergy sectorFood and agriculture sectorHealthcare and public health sectorInformation technology sectorWater and wastewater systems sectorExerciseNotable cyber incidents in CISummaryFurther readingGet this book’s PDF version and more
Critical Infrastructure Security and Resiliency
Exploring dependencies and interdependencies for CIExercise 1: Identifying dependencies and interdependenciesSupply chain security for CIBuilding a supply chain strategyImportance of the supply chain in incident managementManufacturing infrastructure and connection to supply chainsExercise 2: Supply chain risk assessment worksheetVulnerabilitiesThreatsExercise 3: Identifying vulnerabilities and threatsLaws and regulations for CIUSEuropeChinaIndiaUKReporting requirementsSignificance of reportingExercise 4: Government reporting requirementsEvaluating future challenges in CISummaryAnswers to Exercise 1:Further readingGet this book’s PDF version and more
Pillar 2 – Industrial Automation and Control Systems (IACS)
Industrial Automation and Control Systems in Critical Infrastructure
Introduction to IACSBroad classifications of industrial automationComponents of the control systemThe Purdue modelThe ISA/IEC 62443 standardTypes of IACS in critical infrastructureSCADA systemsCommunication protocols in SCADADistributed Control Systems (DCSs)PLCsOther forms of IACSSecurity challenges in IACSNetwork challengesHuman factors and insider threatsSupply chain risksLegacy system challengesRegulatory compliance and standardsIntegration of IT and OT securityThe emergence of newer technologiesEmerging threat landscapeExerciseSection A: Understanding IACS in your organizationSection B: The main uses or applications of IACS in your organization’s critical infrastructureSection C: Security challenges in your organization’s IACSSection D: Application exercise for your organizationSummaryFuther ReadingGet this book’s PDF version and more
Industrial Automation and Control Systems Threat Landscape
Introduction to IT and OTITInformation securityOTOT security, IT security – It is all security nonethelessUnderstanding security considerations for OT systemsSecurity LevelsFunctional SafetySafety Instrumented System (SIS)Safety Instrumented Function (SIF)Safety Integrity Level (SIL)Impact levelsCriticality of OT systemsHistorical cyber incidents in OT environmentsOT-specific threatsNetwork security and segmentation in OT environmentsThe Purdue model as a foundation for OT network securityCase study of an OT security incidentCyber Kill ChainFinding the gaps in security and lessons learnedSignificance of the Cyber Kill Chain in incident managementExercise: Designing simulation exercises with the Cyber Kill ChainSummaryFurther readingGet this book’s PDF version and more
Pillar 3 – Incident Command Systems (ICS) for Industrial Environments
Emergency Operations and Their Significance in an Organization
What are emergency operations?Significance of emergency operations in CI organizationsTypes of incidentsCase study: The Colonial Pipeline cyberattackIndustrial incidents in OT versus security incidents in ITIncidents in CISafety in the context of OT security incidentsEmergency operations managementIncident managementPhases of incident managementIncident management frameworksIncident response life cycleImportance of clear communication channelsEmergency planningCase study: City of St. Paul, Minnesota, ransomware cyberattackExercise 1: Developing an emergency plan for your organization/facilityExercise 2: Running a tabletop exercise/discussion to develop an emergency response planExercise 3: Micro tabletop exerciseSummaryGet this book’s PDF version and more
Introduction to the Incident Command System (ICS)
The importance of incident response for CIKey principles of the ICS and basic ICS structureICS functions Types of incidents and incident classificationFEMA ICS incident types (Type 5 to Type 1)Cybersecurity severity ratings (SEVs) and threat classificationThe ICS structureICS roles/responsibilities Specialized incident commanders in large and complex organizationsCommand staffGeneral staffUnified commandIncident facilities and locationsKey considerations for maintaining emergency response areasThe ICS planning process – the Planning P processScenario analysis – initial steps for containing a chemical spillOperational periodsThe circular process ICS formsEffective briefing and meetings Key features of briefingsConducting an effective briefingKey features of meetings Recipe for a successful meetingExercise 1 – ICS structure and role assignments Exercise 2 – develop objectives for managing an incidentExercise 3 – create an operational planSummaryFurther readingGet this book’s PDF version and more

Practical Considerations for Incident Management in IACS
Incident response for IACSUnderstanding the information gaps in industrial networksAccess and personnel limitationsSafety instrumented systems and their role in responseProcess stability before cyber responseVendor dependencies during responseChange management and approval requirementsOT DMZ and firewall considerations during an incidentOrganizational environmentThreat intelligence and monitoring in IACS environmentsActive and passive monitoring techniquesTypes of threat intelligence and monitoring systemsReal-time monitoringAsynchronous and other alertsIACS-specific incident response planningDefining the goals of the IACS IRPEstablishing the scope of the IRPIdentifying key personnel for the IRTForensic data collection and incident documentationWhy OT forensics is often incompleteTypes of forensic methods used in IACS environmentsNetwork forensicsEndpoint forensicsLog file forensicsFilesystem or disk forensicsController or firmware forensicsIncident remediation and system recovery in IACSExercise 1: Build your own OT-specific IRPExercise 2: Identify alerts and escalation paths in an OT environmentExercise 3: OT forensics decision-making under operational pressureSummaryGet this book’s PDF version and more
Introduction to Incident Management Standards and Frameworks for Critical Infrastructure
Incident management frameworksIncident Command SystemNIST CSFNIST CSF and incident response considerationsIT Infrastructure LibrarySANS Institute IRFICS4ICSMITRE ATT&CKOther frameworksImportance of choosing a frameworkExercise: Choosing the right incident management framework for your organizationExample solutionSummaryGet this book’s PDF version and more
Pillar 4 – Training, Exercises, and Continuous Improvement
Incident Command System Training and Exercises
Introduction to training and exercisesPrinciples of effective incident management training for CI/OT environmentsClassroom-based training/online or e-learning modulesExercisesTabletop Exercises (TTXs)Incident Response Drills (IRDs)Functional Exercises (FEs)Full-Scale Exercises (FSEs)Tailoring training and exercisesChoosing the right training and exercise methodsExercise 1: A thought experiment – running a drill and a functional exercise for a water utilityExercise 2: Conduct a functional exercise (broader, coordinated, real-time)Exercise 3: Drill exampleExercise 4: Functional exercise exampleSummaryGet this book’s PDF version and more
Running an ICS Exercise
Building a continuous improvement programProgram management and governanceLeadership commitment and ownershipProgram structure and documentationExercise planning and designDefining clear objectivesDetermine the exercise typeRegulatory considerationsDevelop a repeatable processAnnual planning and schedulingScenario planningBuilding the scenarioExecution and facilitation of an exercisePreparation and setupCore teams in an ICS exerciseScaling the modelRunning the exerciseManaging flow and engagementObservation and documentationExercise close-out and transition to improvementEvaluation and after-action reviewParticipant feedback formsFollow-up and validationImprovement and integrationMetrics and KPIsAdditional metrics and KPIsCase study: running an IACS/ICS exerciseExercise objectivesExercise design and planningStructured planning phasesScenario and inject planningExercise executionInjects usedDocumentation and finalizationFindings and lessons learnedOutcomes and continuous improvementFollow-upSummaryGet this book’s PDF version and more
Optimizing Single-Site Exercises with Multi-Site Considerations
Single-organization exercise planning and executionScopeCommand structureInject designTesting communicationCross-functional team involvementExercise objective evaluation/assessmentPost-incident reviewExercise: Planning your first exerciseFrom single-site execution to multi-site realitySummaryGet this book’s PDF version and more
ICS Resources
Internal readiness toolsChecklistsStandard Operating Procedures (SOPs)PlaybooksGuides and reference cardsExternal readiness toolsFederal and state ICS resourcesRegional and state-level supportICS formsLocal Emergency Planning Committees (LEPCs)Industry standards, best practice groups, and ISACsISACS Sector-specific regulationsCompliance, governance, and industry regulationsGlobal resourcesIndustry white papersGovernment and standards organization white papersOrganizational/industry white papersStandards and framework-aligned resourcesSummaryTaking the next stepGet this book’s PDF version and more
Unlock Your Exclusive Benefits
Unlock this Book’s Free Benefits in 3 Easy StepsStep 1Step 2Step 3Need Help
Index
Other Books You May Enjoy

Overview

Dive into the intricacies of securing critical infrastructure with 'Incident Management for Industrial Control Systems'. Through this insightful guide, you'll explore cybersecurity principles tailored to industrial control systems (ICS) amid their unique operational and technological challenges, preparing you to handle incident response effectively.

What this Book will help me do

Develop a nuanced understanding of industrial control systems, their components, and applications.
Analyze the unique threats facing ICS, ranging from cyber threats to structural vulnerabilities.
Master incident command systems tailored for critical infrastructure scenarios.
Design and execute effective incident response drills and evaluate their effectiveness.
Explore global regulatory standards shaping cybersecurity responses for ICS.

Author(s)

With years of experience in operational technology (OT) security and critical infrastructure, Durgesh Kalya combines technical expertise with a pragmatic approach to cybersecurity in this essential text. Known for his contributions to risk management and disaster recovery methodologies, he delivers high-value insights directly applicable to professionals in the ICS domain.

Who is it for?

This book is tailored for engineers and analysts involved in the cybersecurity of critical infrastructure or industrial control systems. It's ideal for individuals aiming to deepen their understanding of incident response. A basic grounding in cybersecurity and control systems is recommended but not strictly necessary to benefit from this guide.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781835469712

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills