Forensic Reconstruction of an Anonymized Energy-Grid Incident
Overview
What this challenge is about.
Forensic Reconstruction of an Anonymized Energy-Grid Incident. Expert-level challenge in analysis. Analyzing real datasets and building models that drive dec...
The Brief
What you'll do, and what you'll demonstrate.
Reconstruct a 19-minute partial blackout from multi-source de-identified evidence and decide, with defensible reasoning, whether the cause was a cyber-physical attack or a hardware fault.
This is not a data exercise. It is the work an analyst does when stakeholders need answers from messy data. That distinction matters to every hiring manager who has seen candidates describe statistical methods and none who have extracted insight from messy, real-world data.
When you finish, you will have something most graduates do not: a real-world deliverable, verified by Ewance, that you can show to a hiring manager and say "I did this. Here is the proof."
Earning criteria — what you'll demonstrate
- Build a defensible multi-source super-timeline that reconciles disparate log and disk artifacts to one wall-clock
- Distinguish cyber-physical causation from hardware-fault causation using corroborating evidence across independent sources
- Produce indicators of compromise that conform to the STIX 2.1 specification and are useful for sector sharing
- Frame incident findings to NIS2 reporting expectations without overstating certainty
- Maintain rigorous evidence-handling discipline appropriate to a regulator-facing forensic engagement
Program Fit
Where this fits in your program.
Sharpens the same skills your degree expects you to demonstrate.
Aligned coursework coming soon.
Skills
Skills you'll demonstrate.
Each one shows up on your verified credential.
- Digital Forensics
Apply digital forensics to solve real industry problems and demonstrate production-level capability.
- Incident Response
Apply incident response to solve real industry problems and demonstrate production-level capability.
- Ics Security
Apply ics security to solve real industry problems and demonstrate production-level capability.
- Timeline Analysis
Apply timeline analysis to solve real industry problems and demonstrate production-level capability.
- Nis2
Apply nis2 to solve real industry problems and demonstrate production-level capability.
- Evidence Handling
Apply evidence handling to solve real industry problems and demonstrate production-level capability.
Careers
Career paths this challenge builds toward
Completing this challenge demonstrates skills that transfer directly to these roles:
ICS/OT Incident Responder
This challenge mirrors the core of operational-technology incident response: reconstructing events across control-system logs and engineering workstations under pressure, then deciding what happened and communicating it to leadership and regulators with calibrated confidence.
This challenge sharpens
- incident-response
- ics-security
- timeline-analysis
Digital Forensics Analyst
Building a defensible multi-source super-timeline and maintaining an evidence-handling log are the daily craft of forensic analysts who must produce findings that hold up under scrutiny rather than mere hunches.
This challenge sharpens
- digital-forensics
- timeline-analysis
- evidence-handling
Critical-Infrastructure Compliance Engineer
Framing forensic findings to NIS2 expectations without overclaiming bridges directly to compliance roles that translate technical incidents into regulator-facing reporting for essential-service operators.
This challenge sharpens
- nis2
- incident-response
- evidence-handling