BOOK SEVEN · CHAPTER 6
06 Three Questions Before You Touch Anything
What can it reach? What does it support? Can we restrict it without an outage?
In an office, the safe move during an attack is often to pull the plug. In a power plant, pulling the wrong plug can do the attacker's job for them. The private network that carried the attack also carried the grid operator's legitimate data. Cut it all, and the people balancing the grid lose sight of your plant.
So every response starts with three questions, asked about the specific device in front of you.
| Asset | The real question |
|---|---|
| Cellular router | Can it reach only approved remote systems, or can it scan and connect across the whole private network? |
| Controller | What equipment or process depends on it, and what happens if its network path is restricted? |
| Vendor link | Is access time-limited, approved, logged, and limited to the one device it needs? |
| Control-network gateway | Does it bridge renewable sites, plant controls and business systems? |
| Operator screen or engineering workstation | Can it still monitor and safely manage the process after the risky path is closed? |
If you cannot answer these questions before an incident, you will be guessing during one. Answering them is most of the work of being ready.