How the team works on a running plant, and checklists you can use.

How the team works on a running plant

When the Red Tiger team arrives at the facility, the team and your operations group meet to go over the steps for the next several days. Site hazards come first. Then the plant walk.

1. The work is on live SCADA, DCS, and EMS. Level 3.5 and down. Only OT, not IT.
2. Passive once inside OT. The team captures traffic with the IoTSecure.io mini. No field-device scans unless operations says so, and preferably off production.
3. Active scanning, if at all, is on computing hosts, not field devices, and only after operations has been told so the work can stop immediately.
4. Written rules of engagement and a do-not-touch list before anyone plugs in.
5. Six layers, from physical down to the field.
6. Host collection with REDCAT: nothing installed, nothing written back. The team runs it on one host first so operations can see it does not change the console.
7. You get a report, prioritized fixes, and a board briefing if you want one. Analysis is done off the plant, and the data leaves in an encrypted vault.