Industrial cyber incident response
Open brief106 · Industrial cyber incident response
Blackglass Response is a fictional incident-response team for factories, utilities and logistics operators where shutting everything down can be as dangerous as staying online. The site is structured like a live incident room with decisions, evidence custody and recovery gates.
Native record
incident timeline
Measured through host images, log sources, containment decisions, recovery tests and owner sign-off.
About / field note
Blackglass Response is a fictional incident-response team for factories, utilities and logistics operators where shutting everything down can be as dangerous as staying online. The site is structured like a live incident room with decisions, evidence custody and recovery gates.
Process / field sequence
Declare severity is the entry control point for a incident timeline. The team records host images, log sources, containment decisions, recovery tests and owner sign-off so the next decision is made from an explicit state, not memory or assumption.
Preserve before change is the next control point for a incident timeline. The team records host images, log sources, containment decisions, recovery tests and owner sign-off so the next decision is made from an explicit state, not memory or assumption.
Contain by consequence is the next control point for a incident timeline. The team records host images, log sources, containment decisions, recovery tests and owner sign-off so the next decision is made from an explicit state, not memory or assumption.
Recover through gates is the next control point for a incident timeline. The team records host images, log sources, containment decisions, recovery tests and owner sign-off so the next decision is made from an explicit state, not memory or assumption.
24/7 incident command is scoped through the incident timeline, with host images, log sources, containment decisions, recovery tests and owner sign-off. The boundary, exclusions and handover evidence are stated before work begins.
OT containment planning is scoped through the incident timeline, with host images, log sources, containment decisions, recovery tests and owner sign-off. Capacity, constraints and decision ownership stay visible from intake to closeout.
Forensic acquisition is scoped through the incident timeline, with host images, log sources, containment decisions, recovery tests and owner sign-off. The boundary, exclusions and handover evidence are stated before work begins.
Recovery validation is scoped through the incident timeline, with host images, log sources, containment decisions, recovery tests and owner sign-off. Capacity, constraints and decision ownership stay visible from intake to closeout.
People
Incident commander
Ada Mensah leads incident commander and owns the decisions that touch each incident timeline. The role is described by responsibility, not decorative biography.
OT forensics lead
Ruan Jacobs leads ot forensics lead and owns the decisions that touch each incident timeline. The role is described by responsibility, not decorative biography.
Recovery assurance
Mia Chen leads recovery assurance and owns the decisions that touch each incident timeline. The role is described by responsibility, not decorative biography.
Selected work
Segmented affected office systems from refrigeration controls, rebuilt identity services and validated temperature telemetry before reconnecting business applications.
Revoked exposed access, reconstructed authentication history and introduced privileged session controls without stopping vessel gate operations.
Isolated one engineering workstation, captured PLC project files and proved logic integrity before production restart.
Evidence
17 min
fictional median commander acknowledgement
100%
acquisitions hashed at capture
3
independent recovery gates
0
evidence copies edited in place
Objections / answers
Reading room
Why an OT shutdown is a safety decision. A working note from Blackglass Response on the decisions hidden inside industrial cyber incident response. It connects the claim back to incident timeline and names where professional judgement or uncertainty remains.
The first twenty minutes after privileged credential theft. A working note from Blackglass Response on the decisions hidden inside industrial cyber incident response. It connects the claim back to host images, log sources, containment decisions, recovery tests and owner sign-off and names where professional judgement or uncertainty remains.
Recovery is not complete when the login screen returns. A working note from Blackglass Response on the decisions hidden inside industrial cyber incident response. It connects the claim back to host images, log sources, containment decisions, recovery tests and owner sign-off and names where professional judgement or uncertainty remains.
Conversion / next step