Chapter 10 — Ethics and authorized practice
Lesson map
Lesson 10 published. Map, example, EX028.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Authorization comes from the owner"]
N2["10.2 The work permit"]
N3["10.3 Coordinated disclosure"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX028"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Authorization comes from the owner"]
N2["10.2 The work permit"]
N3["10.3 Coordinated disclosure"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX028"]
[Learning outcomes]
|
v
[10.1 Authorization comes from the owner]
|
v
[10.2 The work permit]
|
v
[10.3 Coordinated disclosure]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX028]
Learning outcomes
You will (1) distinguish authorization from permission to access; (2) list the elements of a written work permit for OT testing; (3) handle discovered vulnerabilities through coordinated disclosure; and (4) refuse requests that would endanger people or exceed scope.
10.1 Authorization comes from the owner
Only the asset owner — or someone the owner has delegated in writing — can authorise testing of an OT system. A plant employee who is curious, a vendor who "has access anyway" or a lecturer who wants a demo cannot grant it. In the industrial setting authorization must also come from operations: a test that is legal but unsafe is still unacceptable.
Maya's classmate offered exactly this kind of false authority: the IP address of a "real" heating controller from a search engine and the suggestion to read one register. Nobody who owned that controller had agreed, so Maya declined and suggested reporting the exposure to the national CERT.
10.2 The work permit
A sound OT test authorization names the systems in scope, the time window, the techniques allowed (passive capture only, read-only queries, or bench testing), the people on the call, the stop conditions ("if any process alarm occurs, stop and notify the shift lead"), and the rollback plan. It is signed by the owner and by the operations manager for the affected area.
For a passive capture on LDHP's control switch, the stop condition might read: "any HMI-1 alarm or any change in PLC-H scan time; stop capture and inform the shift lead". The rollback is removing the mirror port configuration.
10.3 Coordinated disclosure
If you find a vendor product flaw, report it to the vendor and, where appropriate, to CISA, whose ICS advisories publish coordinated fixes. ETSI EN 303 645 provision 5.2 requires consumer IoT manufacturers to publish a vulnerability disclosure policy; many industrial vendors operate similar programmes. Publishing exploit detail before a fix exists can put every plant using that product at risk.
If Maya's offline work had revealed a real flaw in the meter gateways' firmware, the route would be the vendor's disclosure contact first; MTR-C in Chapter 30 is a warning that some vendors have none, in which case the national CERT or CISA coordinates instead.
Worked example (synthetic LDHP)
A classmate offers Maya the IP address of a "real" heating controller found on an internet search engine and suggests "just reading one register to prove it works". Maya declines: no owner authorization, no permit, unknown process consequence. She instead notes the exposure category (ATT&CK for ICS T0883) and suggests the classmate report the exposure to the national CERT, which can contact the owner.
Synthetic case — Lakeside District Heating Plant. The classmate and the exposed controller are fictional; the reasoning is the point.
Errors and limits
"Read-only" is not automatically harmless — some legacy devices crash on unexpected requests. Ethics codes do not replace law; learners must know their jurisdiction's computer misuse statute.
Exercises
- EX028 — Permit stop condition. Write one stop condition for a passive network capture at LDHP's control switch. Rubric: 3 = observable trigger plus action and who is told; 2 = trigger only; 1 = vague "if problems"; 0 = none.
- EX029 — Who may authorise? A contractor's project manager emails "go ahead and scan PLC-H". Is that sufficient? Rubric: 3 = no; needs owner and operations sign-off with scope and window; 2 = no without reason; 1 = yes with caveats; 0 = yes.
- EX030 — Disclosing a vendor flaw. List the first two steps after finding a crash bug in a controller model on a bench unit. Rubric: 3 = preserve evidence privately and contact vendor/PSIRT (and CISA or national CERT); 2 = one; 1 = post on social media; 0 = none.
Synthesis
In OT, ethical practice is operational: written owner authorization, explicit stop conditions and coordinated disclosure protect people as well as reputations.
Continue studying — chapter 10 of 40
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →