Forensic Reconstruction of an Anonymized Energy-Grid Incident
Overview
What this challenge is about.
Reconcile RTU syslogs, firewall logs, and workstation artifacts to timeline a grid incident. Rule out attack vs. fault. Earn your verifiable certificate.
The scenario
Nordkraft Transmission Consortium is a regional high-voltage transmission operator in the Nordics (~700 staff, ~4 million customers served) whose substations are monitored through remote terminal units and a central process historian, placing it squarely under NIS2 essential-entity obligations.
The Brief
What you'll do, and what you'll demonstrate.
Reconstruct a 19-minute partial blackout from multi-source de-identified evidence and decide, with defensible reasoning, whether the cause was a cyber-physical attack or a hardware fault.
Earning criteria — what you'll demonstrate
- Build a defensible multi-source super-timeline that reconciles disparate log and disk artifacts to one wall-clock
- Distinguish cyber-physical causation from hardware-fault causation using corroborating evidence across independent sources
- Produce indicators of compromise that conform to the STIX 2.1 specification and are useful for sector sharing
- Frame incident findings to NIS2 reporting expectations without overstating certainty
- Maintain rigorous evidence-handling discipline appropriate to a regulator-facing forensic engagement
Program Fit
Where this fits in your program.
Sharpens the same skills your degree expects you to demonstrate.
Aligned coursework coming soon.
Skills
Skills you'll demonstrate.
Each one shows up on your verified credential.
- Digital Forensics
Apply digital forensics to solve real industry problems and demonstrate production-level capability.
- Incident Response
Apply incident response to solve real industry problems and demonstrate production-level capability.
- Ics Security
Apply ics security to solve real industry problems and demonstrate production-level capability.
- Timeline Analysis
Apply timeline analysis to solve real industry problems and demonstrate production-level capability.
- Nis2
Apply nis2 to solve real industry problems and demonstrate production-level capability.
- Evidence Handling
Apply evidence handling to solve real industry problems and demonstrate production-level capability.
Careers
Career paths this challenge builds toward
Completing this challenge demonstrates skills that transfer directly to these roles:
ICS/OT Incident Responder
This challenge mirrors the core of operational-technology incident response: reconstructing events across control-system logs and engineering workstations under pressure, then deciding what happened and communicating it to leadership and regulators with calibrated confidence.
This challenge sharpens
- incident-response
- ics-security
- timeline-analysis
Digital Forensics Analyst
Building a defensible multi-source super-timeline and maintaining an evidence-handling log are the daily craft of forensic analysts who must produce findings that hold up under scrutiny rather than mere hunches.
This challenge sharpens
- digital-forensics
- timeline-analysis
- evidence-handling
Critical-Infrastructure Compliance Engineer
Framing forensic findings to NIS2 expectations without overclaiming bridges directly to compliance roles that translate technical incidents into regulator-facing reporting for essential-service operators.
This challenge sharpens
- nis2
- incident-response
- evidence-handling