Getting Started in OT/ICS Cybersecurity 2026 (Part 9B): OT Cyber Attack Response

Value of the Information & Strength of the Argument

The video provides substantial practical value for OT security practitioners. It offers concrete guidance on implementing network security monitoring, from enabling firewall logging to deploying IDS sensors and SIEM. The argumentation is built on the fundamental difference between IT and OT: in OT, availability and safety trump security, so active blocking (IPS) is avoided. This is well-argued with clear examples of false positives causing plant downtime. The instructor uses real-world anecdotes, such as finding state adversaries through firewall logs and a data center theft, to illustrate the importance of detective controls. The discussion of EDR in OT acknowledges the shift from outright rejection to cautious adoption, weighing risks and benefits. The explanation of SIEM correlation and the value of integrating threat intel and vulnerability data is logically sound. The IR phases are presented with detailed reasoning, especially containment, where the instructor explains why simply unplugging systems is not an option and manual fallback operations are necessary. The emphasis on playbooks and runbooks being simple enough for anyone to follow is a strong practical point. Overall, the argumentation is coherent, experience-based, and tailored to the unique constraints of OT environments.

Scientific Rigor, Source Quality, Title Accuracy

The video does not cite academic studies or formal sources; it relies on the instructor’s professional experience and widely accepted industry practices. The technical content aligns with standards such as NIST SP 800-82 and SANS best practices, though these are not explicitly referenced. The title accurately reflects the content, which covers OT cyber attack response as promised. The description includes links to the instructor’s course and website, which are relevant resources but not external sources. The absence of citations is typical for a tutorial-style video, and the information presented is consistent with established OT security principles. The instructor’s claims about IPS risks, SIEM benefits, and IR phases are credible and not contradicted by mainstream knowledge. The video’s rigor is adequate for its educational purpose, though it lacks formal references.

The title accurately reflects the content: the video covers OT cyber attack response, including containment, eradication, recovery, and lessons learned, matching the promised scope.

8/10

The content is grounded in established OT/ICS security practice (passive IDS over IPS, SIEM centralization, honeypots, IR lifecycle phases) and the instructor draws on field experience. Claims are consistent with widely accepted frameworks (NIST, SANS). No primary research is cited, but the technical guidance is coherent and actionable.

• 00:00Network Security Monitoring & The "Dumpster Firewall"
• 06:49IDS vs. IPS: Why You Never Use IPS in OT
• 11:37EDR in OT: The Shift in Host-Based Monitoring
• 16:01SIEM, Centralized Logging & Detective Controls
• 31:18High-Fidelity Alerts: Deploying Internal OT Honeypots
• 37:39Hands-On Demo: The Moth (Modbus) Honeypot
• 41:04OT Threat Hunting: Assuming the Attacker is Inside
• 44:27IR Phase 3 Containment: Why You Can't Just "Unplug" in OT
• 56:40Manual Fallback Operations & Taking Control Systems Offline
• 1:13:29IR Phase 4 Eradication: Removing the Attacker & Artifacts
• 1:43:26IR Phase 5 Recovery: Safely Restoring the Industrial Process
• 2:08:05IR Phase 6 Lessons Learned: Building the Incident Timeline

• Getting Started in OT/ICS Cybersecurity (OnDemand) — Link to the instructor's paid course on OT/ICS cybersecurity.
• Mike Holcomb's website — Instructor's website with additional resources.
• Mike Holcomb's resources — Alternative URL for free OT/ICS cybersecurity resources.