Chapter 31 — OT, IoT and cyber-physical security: advanced cases
Lesson map
Lesson 31 published. Map, example, EX091.
flowchart TD
N0["Learning outcomes"]
N1["31.1 Tools targeting ICS/SCADA devices"]
N2["31.2 Capability is not incident"]
N3["31.3 From behaviour to detection"]
N4["31.4 Comparing case types"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX091"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["31.1 Tools targeting ICS/SCADA devices"]
N2["31.2 Capability is not incident"]
N3["31.3 From behaviour to detection"]
N4["31.4 Comparing case types"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX091"]
[Learning outcomes]
|
v
[31.1 Tools targeting ICS/SCADA devices]
|
v
[31.2 Capability is not incident]
|
v
[31.3 From behaviour to detection]
|
v
[31.4 Comparing case types]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX091]
Learning outcomes
You will (1) analyse a modular ICS attack framework from a CISA advisory; (2) distinguish capability from observed use; (3) derive detection opportunities from documented behaviour; and (4) compare a capability-focused advisory with an incident report.
31.1 Tools targeting ICS/SCADA devices
CISA, with partner agencies, published advisory AA22-103A in April 2022, warning that advanced persistent threat actors had developed custom tools able to scan for, compromise and control certain Schneider Electric PLCs, OMRON Sysmac NEX PLCs and OPC UA servers once they had access to the OT network. The same advisory describes a tool that exploited a vulnerable ASRock motherboard driver to compromise Windows-based engineering workstations.
The advisory names product families and tools, not victims, and that shapes how LDHP should read it.
31.2 Capability is not incident
Unlike the 2015 Ukraine alert, AA22-103A does not describe a disruption at a named victim. It describes capability. The right response is preparation: inventory affected product families, restrict engineering protocols to engineering workstations, monitor for unexpected connections, and protect workstation drivers. The advisory's mitigations include isolating ICS networks, enforcing multifactor authentication for remote access and monitoring for unusual drivers.
Maya's reading for LDHP: no named product families are in use, but HIST-1's OPC UA server and EWS-1's drivers are the generic exposures the advisory describes.
31.3 From behaviour to detection
Documented behaviour suggests specific detections: a new host speaking a PLC vendor's engineering protocol; program upload or download outside a change window (ATT&CK for ICS T0843 Program Download); OPC UA sessions from hosts other than known clients; loading of a known-vulnerable signed driver on a workstation.
Maya added two of these to LDHP's monitoring: OPC UA sessions to HIST-1 from non-approved clients, and driver-load events on EWS-1, now in the workstation's log-forwarding list. The third, program download to PLC-H outside a change window, fits the existing passive monitor on the control switch, which already alerts on firmware downloads; extending it to logic downloads needs only the change-window calendar as an input.
31.4 Comparing case types
Incident reports teach what happened under real constraints; capability advisories teach what could happen next. Both are needed, and neither replaces your own inventory.
Maya's case table in Chapter 20 used incident reports: the 2021 water facility and Mirai, each with an LDHP analogue. AA22-103A adds a different kind of entry, because LDHP uses none of its named products. Her response, two new detections for HIST-1 and EWS-1, came from the inventory rather than from the advisory's product list. A plant that only checked the product list would have concluded there was nothing to do.
Worked example (synthetic LDHP)
LDHP uses no product families named in AA22-103A. Maya does not stop there: she notes that the OPC UA server on HIST-1 is a generic exposure, adds "OPC UA sessions from non-approved clients" to monitoring, and adds "driver load events on EWS-1" to the workstation log forwarding list.
Synthetic case — Lakeside District Heating Plant. LDHP's product mix is invented; AA22-103A is a real advisory.
Errors and limits
Advisories are snapshots; check for updates. Do not download or run tools named in advisories outside an authorised, isolated research environment.
Exercises
- EX091 — Advisory scope. Name the two PLC vendor families and the server type listed in AA22-103A. Rubric: 3 = Schneider Electric, OMRON (Sysmac NEX), OPC UA servers; 2 = two; 1 = one; 0 = none.
- EX092 — A detection from T0843. Write one detection rule idea based on program download behaviour. Rubric: 3 = alert on program download to PLC outside an approved change window or from a non-engineering host; 2 = partial; 1 = "monitor PLCs"; 0 = none.
- EX093 — Not affected, still acting. Why act on an advisory naming products you do not own? Rubric: 3 = techniques transfer (OPC UA, workstation drivers, engineering protocols); inventory may be incomplete; 2 = one; 1 = "to be safe"; 0 = none.
Synthesis
Advanced-case analysis means reading advisories for behaviour, translating behaviour into detections, and refusing to conclude "not us" from a product list alone.
Continue studying — chapter 31 of 40
← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →