Contain the engineering workstation
Choose containment actions while accounting for engineering and process dependencies.
By Abdul Khadir Mahamed · Updated 3 November 2026
Independent guided exercise using synthetic evidence. No live industrial systems are connected.
Your scenario
ENG-01 shows suspicious scheduled execution while supporting an operating production cell.
Evidence to examine
ENG-01: unexpected task creation at 02:15 Current session: engineer logged on PLC: running last approved logic Backup engineering workstation: available, not yet verified
Your investigation tasks
- List immediate evidence preservation and coordination steps.
- Compare host isolation with targeted access restriction.
- Define conditions for switching to the backup workstation.
Debrief
Review the reasoning after completing the tasks
Coordinate with operations and the incident lead, preserve task and session evidence, and understand dependencies before restricting connectivity. Verify backup tooling and approved project copies. Do not assume that isolating a workstation is either always safe or always disruptive.
Take it back to the process
Separate observed facts from assumptions. Explain the operational consequence of your decision, name the evidence still needed, and identify who must approve or validate a real-world change.