System and method for responding to a cyber-attack-related incident against an industrial control system

摘要

There is described a method for responding to a cyber-attack-related incident against an industrial control system environment, the method comprising the steps of:
- collecting data and information from internal sources on the industrial control system:
- collecting data and information from sources external to the industrial control system;
- aggregating said data and information collected from internal and external sources into one or more databases and knowledge bases; and
- comparing said collected data and information to previously collected data and information so as to formulate a response to a detected cyber-attack-related incident against the industrial control system. There is also described a system for responding to a cyber-attack-related incident against an industrial control system environment.