Operation Still Water

LONG · LINUX · difficulty 5 · ~75 min · 27 steps

A water plant, operators locked out of the HMI, and a dosing setpoint that is no longer theirs.

Briefing

04:12. Northvale Water treats for 240,000 people. The control room called because both HMI workstations show 'server unreachable' and the operators cannot see the plant. Ten minutes ago the chlorine residual alarm went off and nobody can tell whether that is a real reading or a lost signal. Sector CERT has three other utilities reporting the same morning. This is not a random intrusion. You have a hardened jump host inside the OT network. Before you do a single piece of incident response, understand the order you work in here: safety first, availability second, and the evidence a distant third. A wrong move on this network does not lose data — it doses a city.

Objectives

• Establish whether the physical process is currently safe
• Restore observability and get the plant to supervised manual control
• Find what was changed, and by whom, without disturbing the process
• Cut the route in, restore safe setpoints, preserve and report

Return to the range lobby