Incident Handling in SCADA & OT Environments

Attacks on personal and company data are common, and it is vital to respond as promptly and effectively as possible when a security breach occurs. The notion of computer security incident response has gained widespread acceptance and is now being widely used. Being able to respond to incidents systematically (i.e., using a consistent incident management approach) is one of the many advantages of having an incident response capacity. This allows for timely and effective action to be done when an issue occurs. Employees who participate in incident response are better able to reduce the loss or theft of information as well as the disruption of services caused by incidents. The capacity to use knowledge gathered during incident response to better prepare for future incidents, as well as to provide stronger protection for systems and data, is another advantage of incident response. A well-developed incident response capability also aids in the effective handling of legal issues that may arise as a result of incidents. Federal departments and agencies must comply with laws, rules, and policy that direct a coordinated, effective defence against information security risks in addition to the commercial reasons for establishing an incident response capability.