Critical Infrastructure

Map the connections among enterprise networks, historians, engineering workstations, control systems, remote sites, and vendor support services. Record which pathways are necessary and who owns them. Include less obvious dependencies such as shared identity, time synchronization, maintenance laptops, and backup administration.

Use passive discovery where operational conditions require it, with engineering review before deploying collectors or integrations. Librarian can help organize the resulting inventory. Any active scanning, deception placement, or configuration work must be explicitly scoped and approved; a monitoring technique appropriate for office systems may be unsuitable for a controller.

• Document permitted communications between business and control networks.
• Track unmanaged gateways and temporary maintenance connections.

An intruder may seek durable access long before causing a visible outage. Review privileged sessions, remote-access changes, unusual engineering activity, and modifications to security controls. Establish baselines with operators who understand legitimate maintenance and seasonal changes.

Pulse can help prioritize relevant intelligence, while Shield + SHADE findings should enter a response process governed by operational rules. Do not automatically isolate a system or revoke an account when doing so could affect safe operation. Route proposed actions to the designated operations and security decision-makers with clear evidence and expected consequences.

• Require individually attributable supplier access.
• Review emergency-access use after every maintenance or incident window.

Recovery plans should cover process stability, trusted configurations, spare equipment, communications, and dependencies on external providers. A backup is useful only if operators can restore it into an acceptable operational state. Test representative recovery steps in a safe environment and record any assumptions that remain unproven.

Dewey can support coordination and Growler can help preserve evidence, but incident command and safety authority remain human responsibilities. Agree in advance how the organization will contact sector partners, regulators, emergency management, and law enforcement when appropriate. Validate reporting duties against the actual facility and jurisdiction.

• Maintain protected copies of approved configurations and recovery instructions.
• Exercise a scenario in which enterprise communications are unavailable.