Chapter 13 — Identity and access | Bachelor's OT, IoT and cyber-physical security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 13 published. Map, example, EX037.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 Shared accounts break attribution"]
  N2["13.2 Roles that match work"]
  N3["13.3 Emergency access"]
  N4["13.4 Vendor remote access"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX037"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 Shared accounts break attribution"]
  N2["13.2 Roles that match work"]
  N3["13.3 Emergency access"]
  N4["13.4 Vendor remote access"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX037"]

[Learning outcomes]
    |
    v
[13.1 Shared accounts break attribution]
    |
    v
[13.2 Roles that match work]
    |
    v
[13.3 Emergency access]
    |
    v
[13.4 Vendor remote access]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX037]

Learning outcomes

You will (1) design named, role-based accounts for operators, engineers and vendors; (2) explain the IEC 62443 foundational requirement for identification and authentication control; (3) separate "view", "operate" and "engineer" privileges; and (4) design time-bounded vendor access.

13.1 Shared accounts break attribution

Control rooms historically used one shift login. When a setpoint changes, the log shows "operator" — not which operator. IEC 62443-3-3 groups requirements into seven foundational requirements; FR 1, identification and authentication control, asks that human users be uniquely identified. Named accounts let an investigation separate an honest mistake from misuse.

At LDHP, before Maya's redesign, HMI-1 used one shared shift login, so a setpoint change at 02:00 could not be traced to a person; the log said only "operator". The redesign gave each operator a named account, so the investigation in Chapter 15 can ask a named person what they changed.

13.2 Roles that match work

At LDHP three roles suffice for HMI-1: view (trends and alarms), operate (acknowledge alarms, change setpoints within limits) and engineer (change limits, download logic from the engineering workstation). FR 2, use control, covers enforcing those privileges. Least privilege means a contractor reviewing trends gets view only.

Maya's design follows these roles. A shift operator can move the supply setpoint within PLC-H's 70–110 °C limits; only an engineer can change those limits or download logic from EWS-1. The vendor's diagnostic account is view-only unless a ticket raises it for a session. FR 2 is where that rule is enforced.

13.3 Emergency access

A plant cannot lock operators out during an emergency because a directory server is down. Design break-glass accounts: sealed credentials, local authentication, immediate alerting on use, and post-event review. This is availability and safety shaping identity design.

Maya's design puts the LDHP break-glass envelope in the shift-lead safe. Its use raises an alert to the on-call engineer, and the password is changed and the envelope resealed after each use. The review asks why the directory-based login failed, not who opened the safe.

13.4 Vendor remote access

Vendors need remote access for diagnostics. CISA advisory AA21-042A, on the 2021 compromise of a US water treatment facility's control system through remote-access software, recommended multiple-factor authentication, strong passwords for remote desktop credentials, auditing remote connections and closing unused RDP ports. A safer design: a jump host in the DMZ, multi-factor authentication, sessions enabled by the shift lead for a fixed window, and recording.

LDHP's starting point resembled the 2021 case: an always-on remote-desktop tool for the vendor. Maya's design replaced it with sessions through the DMZ jump host, enabled for four hours per ticket, recorded and reviewed weekly.

Worked example (synthetic LDHP)

Maya maps current practice: one shared HMI login, vendor access via an always-on remote desktop tool. Her design: named accounts in three roles; break-glass envelope in the shift-lead safe; vendor sessions through the DMZ jump host, enabled for four hours per ticket, recorded and reviewed weekly.

Synthetic case — Lakeside District Heating Plant. LDHP's accounts and vendor are invented; the cited advisory describes a real incident.

Errors and limits

MFA on a control-room console can slow emergency response; use it for remote and engineering access, and rely on physical control-room security for local operation where justified.

Exercises

EX037 — Assigning a role. A boiler service contractor needs to check combustion trends for a week. Which role and what time limit?
Show marking criteria
Rubric: 3 = view only, expiring after the week, named account; 2 = role right; 1 = operate; 0 = engineer.
EX038 — Break-glass review. List three things to check after the break-glass account was used.
Show marking criteria
Rubric: 3 = who used it and why, actions taken, credential rotated; 2 = two; 1 = one; 0 = none.
EX039 — Lessons from AA21-042A. Name two remote-access measures recommended in the water-facility advisory that apply to LDHP.
Show marking criteria
Rubric: 3 = two correct measures; 2 = one; 1 = generic "use antivirus"; 0 = none.

Synthesis

Identity in OT must make every action attributable, every privilege match a job and every emergency survivable.

Continue studying — chapter 13 of 40

← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →