OT/ICS Tabletop Scenarios
NIST-aligned incident response scenarios based on real-world OT attacks. Each follows the SANS ICS tabletop exercise methodology.
NIST Incident Response Phases
PREP
Preparation
DETECT
Detection & Analysis
CONTAIN
Containment
REMOVE
Eradication
RECOVER
Recovery
LESSONS
Post-Incident Activity
Oldsmar Redux: Water Treatment Ransomware
A ransomware attack targets a municipal water treatment facility, threatening public water supply and safety.
Ukraine 2.0: Power Grid Disruption
A coordinated attack targets power distribution substations, causing widespread outages.
Colonial Pipeline: Refined Fuel Disruption
Ransomware attack targets pipeline operations, threatening fuel supply to major metropolitan area.
Power Grid: Dark Start (ICS4ICS)
A sophisticated ransomware attack cripples the regional power grid. Coordinate the response using full ICS4ICS protocols.
DNS Service Disruption
External users cannot access websites. High volume UDP traffic is consuming bandwidth.
Internal Worm Outbreak
A zero-day worm spreads via USB/SMB, installing DDoS agents. Widespread infection before AV update.
Rogue Wireless Access Point
A rogue wireless access point is detected on the corporate network. Physical and logical search required.
Based on SANS ICS Tabletop Guidelines
Preparation
- Define participant roles
- Review IR procedures
- Set ground rules
During Exercise
- Stay in character
- Discuss decisions openly
- Note gaps in procedures
After Exercise
- Conduct hot wash
- Document lessons learned
- Update playbooks