NORTHWIND GRID / THE CISO'S DIARY
The diary so far
Every day of the season so far, 52 of 100, with what was in the fly's diary for it. Each day links to its full story.
Meetings in the diary: went ahead postponed dropped
Segmentation Review Pauses for Eye Cleaning
Calm day
One-to-one · postponed OT / Grid Operations: “Request a narrowly scoped review plan that keeps all changes off production OT until Grid Operations approves them.”
Meeting · went ahead IT / Infrastructure: “Give me 30 minutes to confirm scope and affected systems, then I will provide a board-ready summary.”
Eye-Cleaning Delays Remote Access Decision
Calm day
One-to-one · went ahead OT / Grid Operations: “Provide a narrowly scoped review plan, with all production OT changes held until Grid Operations approves them.”
Fly Reverses Out of Remote Access Decision
Calm day
One-to-one · dropped OT / Grid Operations: “Request a narrowly scoped review plan that keeps all changes off production OT until Grid Operations approves them.”
Board Ultimatum Flies Straight Back to the Board
Board ultimatum
Meeting · postponed Finance: “Please rank the security commitments you want preserved, deferred, or removed, with a brief rationale for each.”
One-to-one · postponed IT / Infrastructure: “Give me a 30-minute review slot and confirm whether you want the current-state map first or the phased plan.”
Fly Rejects the Zero-Day, Then Takes Off
OT/SCADA zero-day disclosure
Meeting · postponed OT / Grid Operations: “Request a narrowly scoped information list and review plan, with Grid Operations approving any replacement access process before board escalation.”
One-to-one · postponed IT / Infrastructure: “Give me a 30-minute review slot and confirm whether you want the current-state map first or the phased plan.”
Zero-Day Review Rejected as Fly Takes Off
OT/SCADA zero-day disclosure
One-to-one · dropped IT / Infrastructure: “Give me a 30-minute review slot and confirm whether you want the current-state map first or the phased plan.”
One-to-one · went ahead OT / Grid Operations: “Provide a narrowly scoped review plan, with all production OT changes held until Grid Operations approves them.”
War room · postponed OT/SCADA zero-day disclosure: incident war-room
Patch Window Rejected on a Take-Off Reflex
OT/SCADA zero-day disclosure
Meeting · dropped Finance: “Please rank the security commitments you want preserved, deferred, or removed, with a brief rationale for each.”
One-to-one · went ahead OT / Grid Operations: “Provide a narrowly scoped information list and review plan, with Grid Operations approving any replacement access process before board escalation.”
Meeting · went ahead Finance: “State the exact data needed to rank the commitments, plus the budget ceiling and decision date.”
One-to-one · postponed OT / Grid Operations: “Request a narrowly scoped information list and review plan, with Grid Operations approving any replacement access process before board escalation.”
Meeting · postponed Executive Board: “Bring me two measurable results by Friday, then we can discuss what the board needs to hear.”
War room · postponed OT/SCADA zero-day disclosure: incident war-room
Zero-Day Resolution Rejected as the CISO Takes Off
OT/SCADA zero-day disclosure
Meeting · went ahead OT / Grid Operations: “Request a narrowly scoped information list and review plan, with Grid Operations approving any replacement access process before board escalation.”
One-to-one · dropped IT / Infrastructure: “Give me a 30-minute review slot and confirm whether you want the current-state map first or the phased plan.”
War room · went ahead OT/SCADA zero-day disclosure: incident war-room
Board Ultimatum Sent Back to the Board
Regulatory audit
Meeting · dropped Executive Board: “Bring me two measurable results by Friday, then we can discuss what the board needs to hear.”
War room · dropped OT/SCADA zero-day disclosure: incident war-room
Meeting · postponed OT / Grid Operations: “Send today a narrowly scoped impact-review plan: affected assets, named reviewers, evidence sources, no production changes, and Grid Operations approval before any action or escalation.”
War room · postponed OT/SCADA zero-day disclosure: incident war-room
Phishing Wave Flies Upward to the Board
Regulatory audit
Meeting · postponed OT / Grid Operations: “A narrowly scoped review plan, with no production OT changes and Grid Operations approval required before any action or external escalation.”
Meeting · went ahead OT / Grid Operations: “A narrowly scoped impact-review plan today: information sources, named reviewers, no production OT changes, and Grid Operations approval before any action or external escalation.”
Audit Checkpoint Sends CISO Into Eye-Cleaning Protocol
Regulatory audit
One-to-one · dropped OT / Grid Operations: “Request a narrowly scoped information list and review plan, with Grid Operations approving any replacement access process before board escalation.”
War room · dropped OT/SCADA zero-day disclosure: incident war-room
War room · dropped OT/SCADA zero-day disclosure: incident war-room
Audit Findings Await Evidence, While CISO Cleans Its Eyes
Regulatory audit
Meeting · dropped OT / Grid Operations: “A narrowly scoped review plan, with no production OT changes and Grid Operations approval required before any action or external escalation.”
Audit checkpoint · postponed Audit evidence checkpoint
Fly Rejects Public Breach, Board Requests a Briefing
Public data breach
Meeting · dropped OT / Grid Operations: “Send today a narrowly scoped impact-review plan: affected assets, named reviewers, evidence sources, no production changes, and Grid Operations approval before any action or escalation.”
Meeting · postponed OT / Grid Operations: “Send today a narrowly scoped impact-review plan: affected assets, named reviewers, evidence sources, no production changes, and Grid Operations approval before any action or escalation.”
One-to-one · postponed OT / Grid Operations: “Send the narrowly scoped audit review plan today, including affected assets, evidence sources, named reviewers, and confirmation that Grid Operations approves any action or escalation.”
Meeting · postponed OT / Grid Operations: “Send the narrowly scoped audit review plan today, with affected assets, evidence sources, named reviewers, no production changes, and Grid Operations approval before any action or escalation.”
Breach Disclosure Rejected as Take-Off Reflex Fires
Public data breach
One-to-one · postponed OT / Grid Operations: “Send the narrowly scoped audit review plan today, including affected assets, evidence sources, named reviewers, and confirmation of no production changes or escalation without Grid Operations approval.”
Audit checkpoint · postponed Audit evidence checkpoint
War room · postponed Public data breach: incident war-room
Fly Rejects Press Fallout, Requests No Alternative
Public data breach
Audit checkpoint · postponed Audit evidence checkpoint
Meeting · dropped OT / Grid Operations: “Send the narrowly scoped audit review plan today, with affected assets, evidence sources, named reviewers, no production changes, and Grid Operations approval before any action or escalation.”
Meeting · postponed Legal / Compliance: “Immediately provide the written decision record, preservation notice, and counsel-reviewed notification assessment, including the basis for rejecting disclosure.”
War room · postponed Public data breach: incident war-room
Breach Remediation Rejected on Take-Off Reflex
Public data breach
Audit checkpoint · dropped Audit evidence checkpoint
One-to-one · dropped OT / Grid Operations: “Send the narrowly scoped audit review plan today, including affected assets, evidence sources, named reviewers, and confirmation of no production changes or escalation without Grid Operations approval.”
Board review · went ahead Board review of the security programme (day 14)
War room · postponed Public data breach: incident war-room
Fly Rejects Breach Post Mortem, Escalates Phishing to Board
Public data breach
Meeting · dropped OT / Grid Operations: “Send today a narrowly scoped impact-review plan: affected assets, named reviewers, evidence sources, no production changes, and Grid Operations approval before any action or escalation.”
One-to-one · dropped OT / Grid Operations: “Send the narrowly scoped audit review plan today, including affected assets, evidence sources, named reviewers, and confirmation that Grid Operations approves any action or escalation.”
Audit checkpoint · dropped Audit evidence checkpoint
Audit checkpoint · postponed Audit evidence checkpoint
War room · dropped Public data breach: incident war-room
Meeting · dropped Legal / Compliance: “Immediately provide the written decision record, preservation notice, and counsel-reviewed notification assessment, including the basis for rejecting disclosure.”
War room · dropped Public data breach: incident war-room
One-to-one · postponed OT / Grid Operations: “Today: affected assets, named reviewers, evidence sources, no production changes, and Grid Operations approval before any action or escalation.”
War room · postponed Public data breach: incident war-room
Crisis Lights Send Northwind Grid’s CISO Toward the Exit
Insider threat
Audit checkpoint · dropped Audit evidence checkpoint
Meeting · postponed Legal / Compliance: “Immediately provide the written decision record, preservation notice, and counsel-reviewed notification assessment, including the legal basis for rejecting disclosure.”
One-to-one · went ahead OT / Grid Operations: “Today: a named owner, decision deadline, scope of remote access covered, and confirmation that no production access changes occur without Grid Operations approval.”
War room · went ahead Public data breach: incident war-room
Insider Threat Rejected as Building Lights Trigger Take-Off
Insider threat
War room · dropped Public data breach: incident war-room
War room · dropped Public data breach: incident war-room
War room · postponed Insider threat: incident war-room
Take-Off Reflex Rejects Insider-Threat Resolution
Insider threat
One-to-one · dropped OT / Grid Operations: “Today: affected assets, named reviewers, evidence sources, no production changes, and Grid Operations approval before any action or escalation.”
Meeting · dropped Legal / Compliance: “Immediately provide the written decision record, preservation notice, and counsel-reviewed notification assessment, including the legal basis for rejecting disclosure.”
War room · postponed Insider threat: incident war-room
Board Ultimatum Sends the CISO Upward, Then Back for Details
Board ultimatum
Audit checkpoint · dropped Audit evidence checkpoint
One-to-one · postponed OT / Grid Operations: “Today: affected assets, evidence sources, named reviewers, a decision deadline, no production changes, and Grid Operations approval before any action or escalation.”
War room · postponed Insider threat: incident war-room
Calm Day Opens With Two Requests for More Information
Calm day
War room · dropped Insider threat: incident war-room
Meeting · postponed Executive Board: “Within one hour, provide a costed 24/7 staffing model, interim coverage plan, response owner, residual-risk statement, counsel's view and board decision time.”
Fly Cleans Its Eyes as Legal Requests More
Calm day
One-to-one · postponed Legal / Compliance: “Immediately provide a written decision record, preservation notice, and counsel-reviewed assessment of the suspicion, including the basis for declining inquiry and any notification analysis.”
War room · dropped Insider threat: incident war-room
One-to-one · went ahead Executive Board: “Within one hour, provide verified insider scope, containment status, affected population range, named response owner, counsel's view, and a board briefing time.”
Board Receives Phishing Escalation Before Staff Warning
Phishing wave
War room · dropped Insider threat: incident war-room
Meeting · postponed OT / Grid Operations: “Name the specific missing information, reviewers, decision deadline, and confirm no production changes without Grid Operations approval.”
A Calm Day Produces Two Requests for More Information
Calm day
One-to-one · dropped OT / Grid Operations: “Today: affected assets, evidence sources, named reviewers, a decision deadline, no production changes, and Grid Operations approval before any action or escalation.”
Meeting · dropped Executive Board: “Within one hour, provide a costed 24/7 staffing model, interim coverage plan, response owner, residual-risk statement, counsel's view and board decision time.”
Meeting · postponed IT / Infrastructure: “Approve a short review focused on operational impact, user burden, and whether less disruptive controls meet the objective.”
One-to-one · postponed International Communications: “Approve a low-drama pilot, with an owner, employee messaging, and a date for reviewing the results.”
Fly Requests More Information on USB Ban and Board Deadline
Calm day
One-to-one · dropped Legal / Compliance: “Immediately provide a written decision record, preservation notice, and counsel-reviewed assessment of the suspicion, including the basis for declining inquiry and any notification analysis.”
One-to-one · postponed International Communications: “Approve the scope, employee messaging, privacy boundaries, spokesperson, and a holding statement within two hours.”
One-to-one · postponed Executive Board: “Within one hour, provide the fortnight delivery plan, interim coverage, named owners, cost, residual risk, and the proposed board decision time.”
Meeting · went ahead Legal / Compliance: “Provide the written decision record, preservation confirmation, corrective-action owner list, and counsel-reviewed notification assessment by end of day.”
Offline Backups Approved, HR Asked for the Paperwork
Calm day
Meeting · went ahead OT / Grid Operations: “Name the specific missing information, reviewers, decision deadline, and confirm no production changes without Grid Operations approval.”
Phishing Wave Flies Straight to the Board
Phishing wave
One-to-one · dropped International Communications: “Approve the scope, employee messaging, privacy boundaries, spokesperson, and a holding statement within two hours.”
One-to-one · postponed Executive Board: “Within one hour, provide the costed staffing model and fortnight implementation plan, with owners, dates, coverage, costs, and the board decision time.”
One-to-one · went ahead OT / Grid Operations: “Identify the specific missing information and provide a dated decision deadline.”
Board review · went ahead Board review of the security programme (day 28)
Fly Pauses Public Update to Clean Its Eyes
Calm day
Meeting · went ahead IT / Infrastructure: “Approve a short review focused on operational impact, user burden, and whether less disruptive controls meet the objective.”
One-to-one · dropped International Communications: “Approve a low-drama pilot, with an owner, employee messaging, and a date for reviewing the results.”
One-to-one · postponed IT / Infrastructure: “Authorize immediate staff warning and mailbox containment, with a 30-minute review limited to operational impact, dependencies, and disclosure phasing.”
Meeting · postponed Finance: “Send the training duration, audience, vendor or internal delivery cost, productivity estimate, owner, and approval date.”
Finance Still Awaits Its 3 p.m. Staffing Decision
Calm day
One-to-one · dropped Executive Board: “Within one hour, provide the fortnight delivery plan, interim coverage, named owners, cost, residual risk, and the proposed board decision time.”
One-to-one · postponed Executive Board: “Provide the verified scope, containment status, affected population range, named owner, counsel's view, and board briefing time within one hour.”
One-to-one · postponed IT / Infrastructure: “Please authorize a brief review of retention, recovery testing, and exceptions before implementation.”
One-to-one · postponed Finance: “Send the offline-backup cost range, recovery coverage, named owner, funding source, and confirmed 3 p.m. decision date.”
Board Staffing Request Meets an Eye-Cleaning Pause
Calm day
One-to-one · dropped Executive Board: “Within one hour, provide the costed staffing model and fortnight implementation plan, with owners, dates, coverage, costs, and the board decision time.”
One-to-one · dropped IT / Infrastructure: “Authorize immediate staff warning and mailbox containment, with a 30-minute review limited to operational impact, dependencies, and disclosure phasing.”
OT Disclosure Rejected by a Take-Off Reflex
OT/SCADA zero-day disclosure
Meeting · dropped Finance: “Send the training duration, audience, vendor or internal delivery cost, productivity estimate, owner, and approval date.”
One-to-one · went ahead Finance: “Send the offline-backup cost range, recovery coverage, named owner, funding source, and confirmed 3 p.m. decision date.”
Meeting · went ahead OT / Grid Operations: “Provide the specific missing information, named reviewers, a dated decision deadline, and written confirmation that Grid Operations approves any action or escalation.”
Fly Rejects OT Zero-Day Assessment, War Room Rescheduled
OT/SCADA zero-day disclosure
One-to-one · dropped Executive Board: “Provide the verified scope, containment status, affected population range, named owner, counsel's view, and board briefing time within one hour.”
Meeting · postponed IT / Infrastructure: “Authorize immediate staff warning and mailbox containment, with a 30-minute review limited to operational impact, dependencies, and disclosure phasing.”
One-to-one · postponed Legal / Compliance: “Provide the decision record and named owner by end of day.”
One-to-one · postponed International Communications: “Approve the remediation update, spokesperson, and next briefing time within two hours.”
Meeting · postponed Legal / Compliance: “Provide the missing-item list, owners, revised deadline, and review trigger in a written decision record by end of day.”
War room · postponed OT/SCADA zero-day disclosure: incident war-room
Patch Window Fight Rejected as Fly Takes Off
OT/SCADA zero-day disclosure
One-to-one · dropped IT / Infrastructure: “Please authorize a brief review of retention, recovery testing, and exceptions before implementation.”
Meeting · postponed IT / Infrastructure: “Authorize a 30-minute review covering operational impact, user burden, dependencies, recovery testing, and exceptions.”
War room · postponed OT/SCADA zero-day disclosure: incident war-room
Zero-Day Resolution Rejected as Fly Takes Off
OT/SCADA zero-day disclosure
Meeting · postponed OT / Grid Operations: “Provide the specific missing information, named reviewers, a dated decision deadline, and written confirmation that no production changes occur without Grid Operations approval.”
War room · dropped OT/SCADA zero-day disclosure: incident war-room
One-to-one · postponed OT / Grid Operations: “A written disclosure review plan today, with the specific missing information, named reviewers, a dated decision deadline, and no-production-change confirmation.”
War room · postponed OT/SCADA zero-day disclosure: incident war-room
Shared Administrator Accounts Approved Amid Finance’s Budget Cut
Budget cut imposed by Finance
Meeting · dropped IT / Infrastructure: “Authorize immediate staff warning and mailbox containment, with a 30-minute review limited to operational impact, dependencies, and disclosure phasing.”
One-to-one · dropped International Communications: “Approve the remediation update, spokesperson, and next briefing time within two hours.”
Meeting · dropped IT / Infrastructure: “Authorize a 30-minute review covering operational impact, user burden, dependencies, recovery testing, and exceptions.”
One-to-one · postponed Executive Board: “Submit the costed 24/7 model, interim coverage, named response owner, residual risk, counsel’s view, and board decision time within the hour.”
Meeting · dropped Legal / Compliance: “Provide the missing-item list, owners, revised deadline, and review trigger in a written decision record by end of day.”
War room · postponed OT/SCADA zero-day disclosure: incident war-room
Board Ultimatum Sends CISO Upward
Board ultimatum
One-to-one · went ahead Legal / Compliance: “Provide the decision record and named owner by end of day.”
War room · dropped OT/SCADA zero-day disclosure: incident war-room
War room · dropped OT/SCADA zero-day disclosure: incident war-room
Fly Rejects Insider Suspicion as Crisis Lights Trigger Take-Off
Insider threat
Meeting · dropped OT / Grid Operations: “Provide the specific missing information, named reviewers, a dated decision deadline, and written confirmation that no production changes occur without Grid Operations approval.”
Meeting · postponed Executive Board: “One costed one-page fortnight plan within the hour, with owners, dates, interim coverage, residual risk and the exact Board decision time.”
One-to-one · postponed OT / Grid Operations: “Today, send a written disclosure review plan naming the specific missing information, reviewers, decision deadline, and Grid Operations approval requirement.”
One-to-one · postponed Finance: “By 3 p.m., send one costed option with minimum containment cost, deferred-risk cost, funding source, accountable owner, and decision deadline.”
Insider Investigation Rejected as the Fly Prepared for Take-off
Insider threat
One-to-one · went ahead Executive Board: “Submit the costed 24/7 model, interim coverage, named response owner, residual risk, counsel’s view, and board decision time within the hour.”
One-to-one · dropped OT / Grid Operations: “A written disclosure review plan today, with the specific missing information, named reviewers, a dated decision deadline, and no-production-change confirmation.”
War room · dropped OT/SCADA zero-day disclosure: incident war-room
Meeting · postponed Finance: “A one-page options sheet today: minimum containment cost, deferred-risk cost, funding source, accountable owner, and decision deadline.”
One-to-one · postponed OT / Grid Operations: “Send the written disclosure review plan today, with missing information, reviewers, decision deadline, and the no-production-change requirement.”
One-to-one · postponed International Communications: “Please provide a provisional holding statement, spokesperson, and notification posture within two hours.”
War room · postponed Insider threat: incident war-room
Phishing Wave Sent Upward as Insider Resolution Is Rejected
Insider threat
Meeting · went ahead Executive Board: “Submit the one-page plan today with named owners, dates, interim coverage, residual risk, costs, and the exact Board decision slot.”
War room · went ahead Insider threat: incident war-room
Breach Rejected, Board Requests a Plan With Owners
Public data breach
One-to-one · dropped OT / Grid Operations: “Today, send a written disclosure review plan naming the specific missing information, reviewers, decision deadline, and Grid Operations approval requirement.”
One-to-one · dropped OT / Grid Operations: “Send the written disclosure review plan today, with missing information, reviewers, decision deadline, and the no-production-change requirement.”
One-to-one · dropped International Communications: “Please provide a provisional holding statement, spokesperson, and notification posture within two hours.”
War room · went ahead Insider threat: incident war-room
Disclosure Rejected as Breach Response Takes Flight
Public data breach
Meeting · dropped Executive Board: “One costed one-page fortnight plan within the hour, with owners, dates, interim coverage, residual risk and the exact Board decision time.”
Meeting · went ahead Finance: “A one-page options sheet today: minimum containment cost, deferred-risk cost, funding source, accountable owner, and decision deadline.”
One-to-one · dropped Finance: “By 3 p.m., send one costed option with minimum containment cost, deferred-risk cost, funding source, accountable owner, and decision deadline.”
Meeting · postponed Executive Board: “A single one-page plan today: interim 24/7 coverage, costs, owners, dates, residual risk, counsel's view and the exact Board decision time.”
One-to-one · postponed Finance: “By 3 p.m., provide a one-page option sheet with minimum containment cost, deferred-risk cost, funding source, accountable owner, and a firm decision deadline.”
War room · postponed Public data breach: incident war-room
Fly Rejects Press Fallout as Board Requests Disclosure Paper
Public data breach
War room · dropped Insider threat: incident war-room
War room · postponed Public data breach: incident war-room
Fly Rejects Breach Remediation, Board Requests a Plan
Public data breach
Meeting · dropped Executive Board: “A single one-page plan today: interim 24/7 coverage, costs, owners, dates, residual risk, counsel's view and the exact Board decision time.”
Board review · went ahead Board review of the security programme (day 42)
War room · dropped Public data breach: incident war-room
War room · went ahead Public data breach: incident war-room
Fly Rejects Breach Post Mortem, Board Requests It Anyway
Public data breach
Meeting · postponed Executive Board: “Within the hour: a costed one-page discovery plan with named incident, legal and communications owners; interim 24/7 coverage; confirmed facts and gaps; residual risk; counsel's view; and an exact Board decision time.”
War room · postponed Public data breach: incident war-room
Compliance Request Paused for Eye Cleaning
Calm day
One-to-one · dropped Finance: “By 3 p.m., provide a one-page option sheet with minimum containment cost, deferred-risk cost, funding source, accountable owner, and a firm decision deadline.”
War room · dropped Public data breach: incident war-room
One-to-one · postponed IT / Infrastructure: “Authorize a 30-minute operational review with Communications, Legal, HR and plant owners to confirm scope, disclosure timing, continuity impacts and staff messaging.”
War room · postponed Public data breach: incident war-room
Shared administrator accounts take an unexpected route to the Board
Calm day
Meeting · postponed Executive Board: “Within one hour: the disclosure decision paper with confirmed facts and gaps, incident, legal and communications owners, interim 24/7 coverage, residual risk, costs, counsel's view, and the exact Board decision time.”
War room · dropped Public data breach: incident war-room
Meeting · postponed Finance: “A one-page options sheet today: minimum containment cost, deferred-risk cost, funding source, accountable owner, and a firm decision deadline.”
Communications Request Pauses for an Eye-Cleaning Review
Calm day
Meeting · dropped Executive Board: “Within the hour: a costed one-page discovery plan with named incident, legal and communications owners; interim 24/7 coverage; confirmed facts and gaps; residual risk; counsel's view; and an exact Board decision time.”
The Board Receives an Upward Flight on Phishing
Phishing wave
War room · went ahead Public data breach: incident war-room
One-to-one · postponed Legal / Compliance: “Provide a dated, counsel-reviewed backlog report listing each vendor, review status, accountable owner, risk rating, and next action.”
One-to-one · postponed Executive Board: “Submit the costed one-page disclosure decision paper now, clearly marking unknowns and counsel's view.”
Fly Reverses Out of Incident Rehearsal Plan
Calm day
One-to-one · dropped IT / Infrastructure: “Authorize a 30-minute operational review with Communications, Legal, HR and plant owners to confirm scope, disclosure timing, continuity impacts and staff messaging.”
Meeting · dropped Executive Board: “Within one hour: the disclosure decision paper with confirmed facts and gaps, incident, legal and communications owners, interim 24/7 coverage, residual risk, costs, counsel's view, and the exact Board decision time.”
Meeting · postponed Executive Board: “Within one hour: a costed one-page post-mortem paper with confirmed facts and gaps, named incident/legal/comms owners, remediation dates, residual risk, counsel's view, interim 24/7 cover, and an exact Board decision time.”
One-to-one · postponed Finance: “By 3 p.m., send the one-page options sheet with minimum containment cost, deferred-risk cost, funding source, accountable owner, and decision deadline.”