OT ICS and SCADA Incident Response

When the controller changed and nobody knows why

A setpoint moved and no one in the control room touched it. An operator display went blank for four minutes. A remote session showed up in the logs from a vendor account that should have been disabled last year. Leadership wants to know whether this is an attack, and they want to know in the next hour. GDF brings OT ICS and SCADA incident response to that moment: forensic method, industrial systems experience, and reporting that tells you what is known, what is not, and what can safely be done next.

Call 1-800-868-8189. We answer 24/7. When you call, tell us the affected operation, its current state and who holds operational authority on site. If you suspect accounts or systems are compromised, call from a phone and use a channel the attacker would not be reading.

The operator decides what is safe. We work inside that.

Nobody should assume that disconnecting, rebooting or scanning an industrial device is harmless. It can trip a process or leave a controller half-written. The operator determines process safety, environmental limits and acceptable operating conditions. GDF plans evidence preservation and analysis inside those limits, and we do not move without the operator's approval.

The initial response includes agreeing what evidence matters most and what approvals are needed before anyone touches a device. That plan accounts for fragile equipment, vendor dependencies, available backups, communication channels and stop conditions. If pulling a memory image from an HMI would put the process at risk, we write that limitation into the record and look for corroborating evidence in safer sources, such as the historian, the engineering workstation's project files or available switch logs. Those sources may answer part of the question, but they do not replace the contents of memory.

Attack, fault, or someone doing their job

A process anomaly is a symptom. Equipment failure, authorized maintenance nobody logged, a configuration error and a cyber intrusion can all produce the same one. We line up the technical and operational records and work out which explanations survive contact with the evidence.

The sources we go to: engineering workstation records, remote access logs, operator shift notes, alarm history, historian data and configuration backups. A historian stores process measurements and events over time, so it can show what the system reported during the window in question. It is also easy to over-read. Collection intervals, clock settings and gaps in the data all affect what a historian trace can and cannot prove.

Clocks are the trap. A PLC, an HMI, a historian and a domain controller frequently disagree by seconds or minutes, and by hours if a time zone was set wrong. We measure the offsets, record the uncertainty and build the chronology around it. Forcing events onto a single clean timeline when the clocks disagree produces a sequence that looks convincing and is wrong. The chronology GDF delivers shows what was observed, what changed, which access paths were involved and what remains unresolved.

Restoring the plant without erasing the record

Recovery changes the systems that hold the evidence. Rebuilding an engineering workstation or reloading a controller project is often the right call, and it also overwrites what the compromised state looked like. Before that happens, the response record should capture what was preserved, which source was used for the restore, and who approved the change. When conditions allow, we image first. When they do not, we say so.

GDF has spent decades producing forensic reports and expert testimony, so the incident record is built with the later questions in mind: what happened, how the response was handled and what supports each conclusion. Regulators, insurers, auditors and opposing counsel ask those questions months afterward. The scope can include a chronology, an evidence register, analysis of each affected system and readiness recommendations that name the log source, the retention gap or the missing backup owner that slowed you down this time.

Speak with GDF about an active event

If you are dealing with an active OT, ICS or SCADA event, call GDF at 1-800-868-8189 now. Be ready to describe the affected operation, current process condition, known changes and the authorized operational contact. We can help preserve evidence, coordinate safe next steps and support incident response decisions without treating your production systems like office laptops.

Speak with GDF about an active event

Related services and resources: OT ICS SCADA forensics, critical infrastructure OT security.