Chapter 19 — OT, IoT and cyber-physical security: scope and theory
Lesson map
Lesson 19 published. Map, example, EX055.
flowchart TD
N0["Learning outcomes"]
N1["19.1 Definitions"]
N2["19.2 The loop as the asset"]
N3["19.3 Standards map"]
N4["19.4 Safety and security"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX055"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["19.1 Definitions"]
N2["19.2 The loop as the asset"]
N3["19.3 Standards map"]
N4["19.4 Safety and security"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX055"]
[Learning outcomes]
|
v
[19.1 Definitions]
|
v
[19.2 The loop as the asset]
|
v
[19.3 Standards map]
|
v
[19.4 Safety and security]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX055]
Learning outcomes
You will (1) define OT, IIoT, consumer IoT and cyber-physical systems and where they overlap; (2) explain the feedback loop as the object being protected; (3) identify the core standards for each domain; and (4) describe why safety and security engineering must be co-ordinated.
19.1 Definitions
Operational technology is hardware and software that monitors or controls physical devices and processes. NIST SP 800-82r3 broadened its scope from "industrial control systems" to OT generally, including building automation and transport. IoT devices are network-connected things with sensing or actuation; NIST IR 8259 frames the baseline activities manufacturers should perform for them. A cyber-physical system is the combination of computation, networking and physical process in a closed loop.
LDHP contains all three: PLC-H and SIS-H are OT, the heat meters and gateways are IoT, and the supply-temperature loop is a cyber-physical system.
19.2 The loop as the asset
The thing an OT defender protects is not a computer but a feedback loop: sensor → controller → actuator → process → sensor. An attacker can falsify the sensor reading, change the controller's logic or parameters, override the actuator, or disrupt the communication that ties them together. Each corresponds to ATT&CK for ICS tactics such as Impair Process Control and Inhibit Response Function.
Maya's LDHP loop is TT-101 → PLC-H → fuel valve FV-12 → boiler → TT-101. For each element she names one attack and the safeguard independent of it: SIS-H with its own transmitter TT-101S, hardwired to the fuel shut-off.
19.3 Standards map
IEC 62443 covers industrial automation and control systems for asset owners, integrators and product suppliers. NIST SP 800-82r3 is a guide for OT security programmes. NIST IR 8259 (and 8259A) sets IoT device cybersecurity capability baselines for manufacturers. ETSI EN 303 645 is the European baseline for consumer IoT. They overlap but answer different questions: who must do what, for which kind of system.
For LDHP: IEC 62443 for PLC-H and the control zone, SP 800-82r3 for the programme, IR 8259 and EN 303 645 for the meters and gateways.
19.4 Safety and security
Functional safety (IEC 61508, IEC 61511 for process industries) assumes random and systematic failures; security assumes an adversary. A safety instrumented system must stay independent so that a cyber-induced process upset still ends in a safe state. IEC 62443 and IEC 61511 both point practitioners to co-ordinate the two analyses.
At LDHP, SIS-H trips the fuel supply on high temperature using TT-101S, a transmitter separate from PLC-H's TT-101, and the trip is hardwired. A cyber attack that drives PLC-H to over-fire the boiler still meets an independent trip, as long as nothing on the network can change SIS-H's trip point.
Worked example (synthetic LDHP)
Maya maps LDHP's supply-temperature loop: TT-101 → PLC-H → fuel valve FV-12 → boiler → TT-101. She lists one attack point per element and the independent safeguard: SIS-H with its own temperature transmitter TT-101S, hardwired to the fuel shut-off.
Synthetic case — Lakeside District Heating Plant. Loop tags are invented.
Errors and limits
Labels like "OT" and "IoT" are conveniences; a building-management sensor on Wi-Fi is both. Do not choose a standard by brand familiarity; choose by role and system type.
Exercises
- EX055 — Four attack points on one loop. Name one attack point per element of the TT-101 loop. Rubric: 3 = four, one per element; 2 = three; 1 = two; 0 = none.
- EX056 — Matching standards to roles. Which document fits (a) the meter manufacturer's product baseline, (b) LDHP's own OT security programme? Rubric: 3 = NIST IR 8259 or ETSI EN 303 645 / IEC 62443-4-2; and SP 800-82r3 or IEC 62443-2-1; 2 = one; 1 = same answer for both; 0 = none.
- EX057 — Why TT-101S matters. Explain why SIS-H uses its own transmitter rather than reading TT-101 through PLC-H. Rubric: 3 = falsified or failed TT-101/PLC path would blind the SIS; independence; 2 = partial; 1 = cost; 0 = none.
Synthesis
OT, IoT and CPS security protect feedback loops; the right standard depends on your role, and safety independence is non-negotiable.
Continue studying — chapter 19 of 40
← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →