Chapter 23 — OT, IoT and cyber-physical security: methods I
Lesson map
Lesson 23 published. Map, example, EX067.
flowchart TD
N0["Learning outcomes"]
N1["23.1 Start from consequence"]
N2["23.2 The 62443-3-2 workflow in outline"]
N3["23.3 Matrices and their traps"]
N4["23.4 Residual risk"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX067"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["23.1 Start from consequence"]
N2["23.2 The 62443-3-2 workflow in outline"]
N3["23.3 Matrices and their traps"]
N4["23.4 Residual risk"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX067"]
[Learning outcomes]
|
v
[23.1 Start from consequence]
|
v
[23.2 The 62443-3-2 workflow in outline]
|
v
[23.3 Matrices and their traps]
|
v
[23.4 Residual risk]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX067]
Learning outcomes
You will (1) perform a consequence-driven risk assessment for one zone; (2) use a likelihood–consequence matrix responsibly; (3) relate the assessment to the IEC 62443-3-2 workflow; and (4) record residual risk with an owner.
23.1 Start from consequence
In OT, assessment begins by asking what the process can do that would be unacceptable — loss of heat in winter, over-pressure, scalding — and only then which cyber paths could cause it. Starting from vulnerabilities produces long lists of low-impact findings; starting from consequence focuses effort on the loops that matter.
At LDHP the unacceptable outcomes are loss of heat to 4,000 homes in winter and over-temperature in the supply. The first has cyber paths through register 100 and through EWS-1; the second also has a path, but SIS-H's independent trip limits its consequence. Starting there tells Maya to examine PLC-H's conduits before the meter gateways' web interfaces, although the gateways would produce more findings in a scan.
23.2 The 62443-3-2 workflow in outline
IEC 62443-3-2 describes identifying the system under consideration, performing an initial high-level risk assessment, partitioning into zones and conduits, performing a detailed risk assessment per zone, and documenting security requirements and target security levels. You do not need the full standard to practise the reasoning, but cite it correctly.
Applied to LDHP, the system under consideration is the boiler plant with its meters. The initial assessment identifies loss of heat as the dominant consequence. Partitioning yields the boiler control zone, the meter zone and SIS-H as its own zone. The detailed assessment per zone produces Maya's SL-T 3, SL-T 2 and no routable conduits respectively.
23.3 Matrices and their traps
A 5 × 5 matrix multiplies a likelihood score by a consequence score. It is a communication tool, not arithmetic: "3 × 4 = 12" does not mean twice as bad as 6. Rank-reversal errors happen when categories are wide. Always keep the narrative scenario next to the score.
At LDHP, a scenario scoring 3 × 4 for a meter gateway takeover and one scoring 2 × 5 for a setpoint write to PLC-H produce 12 and 10, which would rank the gateway first. The narratives tell a different story: the gateway affects one street's billing and configuration, the setpoint write affects every home's heat. Keeping the narrative beside the number is what lets a reviewer catch that reversal, as Maya's consequence ranking in Chapter 26 does when it places one tenant's replay below gateway takeover.
23.4 Residual risk
After controls, some risk remains. It must have an owner who accepts it in writing, a review date and the assumptions it rests on.
For S-3, setpoint manipulation, the residual after Chapter 24's controls has two parts: an insider with engineering access, and a write from HMI-1 itself, the allow-listed source. Maya's capstone later shows the second is real: her monitor's one remaining miss was an HMI-originated write. The owner would be LDHP's plant manager, as in the worked example below, who accepts it in writing on the assumption that named accounts make such writes attributable, with a review date six months later or sooner if the monitor's correlation with operator logins is built.
Worked example (synthetic LDHP)
Scenario S-3: office malware reaches PLC-H via rule 14 and lowers the supply setpoint (ATT&CK for ICS T0836). Consequence 4 (district-wide heat loss for hours, no injury because SIS-H handles over-temperature but not under-temperature). Likelihood 3 before controls. After removing rule 14 and adding an allow-list, likelihood 1. Residual: insider with engineering access remains; owner: plant manager; review in six months.
Synthetic case — Lakeside District Heating Plant. Scores are illustrative.
Errors and limits
Likelihood for targeted attacks is a judgement, not a frequency; state who judged it and on what basis. Do not let a low score hide a catastrophic consequence.
Exercises
- EX067 — Consequence first. Write one unacceptable consequence for the IoT meter zone and the cyber path that could cause it. Rubric: 3 = concrete consequence plus path; 2 = one; 1 = vulnerability list; 0 = none.
- EX068 — Interpreting matrix scores. Scenario A scores 2 × 5 = 10 and B scores 5 × 2 = 10. Are they equally urgent? Rubric: 3 = no; A has catastrophic consequence and needs different treatment; judge by narrative; 2 = "no" only; 1 = yes; 0 = none.
- EX069 — Residual risk record. Write the residual-risk statement for S-3 after controls. Rubric: 3 = remaining path, owner, review date, assumption; 2 = three; 1 = "risk accepted"; 0 = none.
Synthesis
Consequence-driven assessment, honest use of matrices and owned residual risk make an OT risk register a decision tool rather than a spreadsheet.
Continue studying — chapter 23 of 40
← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →