Chapter 29 — OT, IoT and cyber-physical security: operations
Lesson map
Lesson 29 published. Map, example, EX085.
flowchart TD
N0["Learning outcomes"]
N1["29.1 Monitoring that operators trust"]
N2["29.2 Playbook steps"]
N3["29.3 Patching in windows"]
N4["29.4 Tabletop exercises"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX085"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["29.1 Monitoring that operators trust"]
N2["29.2 Playbook steps"]
N3["29.3 Patching in windows"]
N4["29.4 Tabletop exercises"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX085"]
[Learning outcomes]
|
v
[29.1 Monitoring that operators trust]
|
v
[29.2 Playbook steps]
|
v
[29.3 Patching in windows]
|
v
[29.4 Tabletop exercises]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX085]
Learning outcomes
You will (1) design an OT security monitoring workflow with operators in the loop; (2) write an incident-response playbook step that respects process safety; (3) plan patching within maintenance windows; and (4) run a tabletop exercise.
29.1 Monitoring that operators trust
Passive network monitoring at LDHP's control switch builds a baseline of who talks to whom. Alerts — a new host talking Modbus, a write from an unexpected source, a firmware download — go to a security analyst who calls the shift lead before anyone touches the plant. NIST SP 800-82r3 stresses that OT incident response must be coordinated with operations because containment actions can themselves cause a process upset.
At LDHP the alert in this chapter's tabletop, a Modbus write to register 100 by 10.20.4.17 on the office VLAN, is exactly the "unexpected source" case.
29.2 Playbook steps
Good OT playbook steps name the decision-maker and the safe state. "Isolate PLC-H from the network" is dangerous if operators lose the HMI. Better: "Shift lead decides whether to move the boiler to local manual control; only then does the analyst block the suspicious source at the firewall."
This chapter's tabletop followed this order: the analyst called the shift lead at 02:12, the operator restored the supply setpoint from 30 °C to 90 °C at 02:15, and the shift lead approved blocking 10.20.4.17 at the firewall at 02:18. The block came after the process was safe, not before, and after a named person had decided it.
29.3 Patching in windows
LDHP has a monthly four-hour maintenance window. Patches are tested on a bench HMI, ranked by risk (exposure × consequence), and applied in order until the window is full; the rest are deferred with a dated ticket and compensating controls. IEC TR 62443-2-3 discusses patch management in IACS environments.
For a month with a PLC-H firmware fix, an HMI-1 Windows update and a gateway patch, the ranking puts PLC-H first only if the fix addresses an exposed path; otherwise HMI-1, which holds named operator accounts and faces EWS-1 and the jump host, may come first. Whatever is deferred gets a dated ticket and the compensating controls of Chapter 24.
29.4 Tabletop exercises
A tabletop rehearses a scenario on paper: who is called, what is decided, what information is missing. It reveals gaps without risking the process.
LDHP's tabletop started from an alert at 02:10 on a January night: a Modbus write to PLC-H register 100 by 10.20.4.17 on the office VLAN. The analyst called the shift lead at 02:12, the operator confirmed the setpoint had been changed to 30 °C and restored 90 °C at 02:15, and the shift lead approved blocking the address at 02:18, after which evidence collection began. The gap it found was ordinary and important: nobody had the firewall administrator's night phone number. A live incident would have found the same gap with less time to fix it.
Synthetic case — Lakeside District Heating Plant. Times, addresses and the gap are invented.
Errors and limits
Playbooks rot as staff and networks change; review them after every exercise. Automatic blocking in OT should be exceptional and pre-agreed.
Exercises
- EX085 — Rewriting a dangerous playbook step. Rewrite "Shut down the SCADA server immediately" safely. Rubric: 3 = decision-maker, safe process state first, then containment; 2 = partial; 1 = unchanged; 0 = none.
- EX086 — Filling a window. Patches need 1.5 h (risk 9), 2 h (risk 6), 1 h (risk 8), 1 h (risk 3) in a 4 h window. Which go in? Rubric: 3 = risk 9, 8 and 3 (3.5 h) with the risk-6 patch deferred on a dated ticket; 2 = right set, no deferral record; 1 = overruns the window; 0 = none.
- EX087 — Tabletop gap fix. Propose a fix for the missing phone number and how to test it. Rubric: 3 = on-call roster in playbook plus test call in next exercise; 2 = one; 1 = vague; 0 = none.
Synthesis
OT operations security keeps operators in charge of the process, patches by risk within windows, and rehearses until gaps are found on paper rather than at 2 a.m.
Continue studying — chapter 29 of 40
← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →