Chapter 11 — Operating systems

Lesson map

Lesson 11 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Windows and Linux inside the plant"]
  N2["11.2 Support matrices"]
  N3["11.3 Allow-listing and media control"]
  N4["11.4 Evidence with least privilege"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Windows and Linux inside the plant"]
  N2["11.2 Support matrices"]
  N3["11.3 Allow-listing and media control"]
  N4["11.4 Evidence with least privilege"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX031"]

[Learning outcomes]
    |
    v
[11.1 Windows and Linux inside the plant]
    |
    v
[11.2 Support matrices]
    |
    v
[11.3 Allow-listing and media control]
    |
    v
[11.4 Evidence with least privilege]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) identify where general-purpose operating systems appear in an OT architecture; (2) explain why vendor support matrices constrain hardening; (3) apply application allow-listing and removable-media control; and (4) collect host evidence with least privilege.

11.1 Windows and Linux inside the plant

PLCs run real-time firmware, but HMIs, engineering workstations, historians and OPC servers run Windows or Linux. These hosts are where phishing payloads, infected USB sticks and remote-access tools land. NIST SP 800-82r3 treats them as OT assets with OT constraints: they may not be patched monthly, may run software certified only for an old OS build, and may be needed around the clock.

At LDHP these are HMI-1, EWS-1 and HIST-1. EWS-1 matters most because it can download logic to PLC-H, which is why AA22-103A's driver-exploiting tool is relevant even to a plant with no named products.

11.2 Support matrices

The HMI vendor certifies a specific OS version, service pack and antivirus product. Applying an unsupported hardening setting — disabling a service the HMI runtime uses, for example — can leave operators with a blank screen during a cold snap. Hardening therefore follows a test-on-bench, change-board, deploy-in-window sequence, and exceptions are documented with compensating controls.

For HMI-1, Maya proposed allow-listing in audit mode for two weeks before enforcement, and the vendor confirmed it; removing the shared local administrator account needed a runtime service account, which she documented as an exception rather than forcing through. That sequence is the support matrix in practice.

11.3 Allow-listing and media control

Application allow-listing permits only known executables, which suits HMIs because their software set rarely changes. Removable-media control — scanning kiosks, blocked USB storage, signed transfer media — addresses the most common way malware crosses an air gap. Both are host controls listed among IEC 62443-3-3 system requirements for malicious-code protection (SR 3.2).

Maya's HMI-1 proposal applied both: allow-listing in audit mode for two weeks, then enforcement, and USB mass storage blocked except through the scanning kiosk. The audit period matters because it lists every executable the HMI runtime actually starts, including any the vendor's documentation forgot, before blocking anything.

11.4 Evidence with least privilege

For an investigation, prefer exporting the event log, the installed-software list and the running-process list with a read-only account over imaging the disk of a running HMI. Imaging may require downtime and copies proprietary recipes.

At LDHP, a suspicious login on HMI-1 during a winter night would be investigated from exports first: the Windows event log for the login, the process list showing whether the HMI runtime or something else was running, and the installed-software list compared with the vendor's certified build. A full image of HMI-1 would mean taking the operators' screen away, which needs the shift lead's agreement and a plan to run the boiler from local controls.

Worked example (synthetic LDHP)

LDHP's HMI-1 runs a Windows build certified by its vendor. Maya proposes three changes: enable allow-listing in audit mode for two weeks, then enforce; block USB mass storage except via the scanning kiosk; remove the local administrator account used by all shifts and issue named accounts. The vendor confirms the first two; the third requires a runtime service account, which she documents as an exception.

Synthetic case — Lakeside District Heating Plant. The vendor response is invented; real vendors publish their own hardening guides.

Errors and limits

Audit mode that is never switched to enforce is theatre. Antivirus scans during peak load can slow an HMI; schedule them.

Exercises

• EX031 — Why audit mode first? Explain the purpose of running allow-listing in audit mode before enforcing it on HMI-1.
  Show marking criteria

  Rubric: 3 = discover legitimate executables without blocking operations, then enforce on a reviewed list; 2 = partial; 1 = "for testing"; 0 = none.
• EX032 — Choosing an evidence method. For a suspected infection on HMI-1, choose between live export and disk imaging and justify it.
  Show marking criteria

  Rubric: 3 = live read-only export first; image only if justified, permitted and scheduled; 2 = choice only; 1 = image immediately; 0 = none.
• EX033 — Documenting a hardening exception. Write the exception record for the runtime service account.
  Show marking criteria

  Rubric: 3 = reason, compensating control, owner, review date; 2 = three; 1 = reason only; 0 = none.

Synthesis

General-purpose hosts are the softest layer of a plant; harden them within vendor support, control what runs and what is plugged in, and investigate them gently.

Continue studying — chapter 11 of 40

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →