IR Planning Governance OT Security Critical Infrastructure

Cyber Resilience Tabletop Exercise

Large-scale critical infrastructure tabletop combining technical incident response with governance-level decision simulation — co-facilitated with CMU and GW faculty for a hybrid OT/IT water treatment facility scenario.

🏭

Sector

Water / OT

🎓

Co-Facilitated

CMU + GW

⚡

Scenario

Hybrid OT/IT

🏛️

Focus

Public-Private

// Overview

This tabletop exercise was designed to stress-test both the technical incident response capability and the governance decision-making of participants simultaneously — a gap that most standard IR exercises fail to address.

The scenario places a fictional water utility under a coordinated cyberattack targeting both IT corporate infrastructure and OT SCADA systems, forcing participants to navigate conflicting priorities between operational continuity, public safety, regulatory reporting, and law enforcement coordination.

"Real incidents break at the seam between technical teams and decision-makers. This exercise was designed to find and stress that seam under realistic pressure."

// Exercise Scenarios

INJECT 01

Initial Compromise — IT Network

Phishing → Lateral Movement

A spearphishing email compromises a billing department workstation. Threat actor establishes persistence and begins reconnaissance of internal systems.

→IT team must contain without disrupting billing operations
→Legal must assess breach notification requirements (state law + CISA)

INJECT 02

OT Network Pivot

IT→OT Lateral Movement

Attacker pivots from IT to the OT environment via a poorly segmented historian server, gaining read access to SCADA telemetry for the water treatment process.

→Operations must decide: isolate OT (lose visibility) or maintain connectivity (accept risk)
→Leadership must evaluate public disclosure timeline vs. ongoing investigation

INJECT 03

Chemical Control Manipulation Attempt

Physical Consequence Escalation

Alarm triggers on the chlorination system — anomalous commands detected. Unclear if attacker has write access or is testing defenses. Potential public safety impact.

→Executive decision required: notify public health authorities now or wait for confirmation?
→FBI and CISA notification procedures activate
→Manual override protocols and OT playbook validation

// Participant Roles

🔧 Technical Track

SOC analysts and OT engineers. Responsible for detection, containment, and forensic preservation decisions.

🏛️ Governance Track

Executives, legal, and communications. Responsible for regulatory reporting, public messaging, and resource authorization.

🤝 Coordination Track

Liaison roles bridging technical and governance tracks, managing information flow and prioritizing competing demands.