Chapter 32 — OT, IoT and cyber-physical security: interdisciplinary interfaces
Lesson map
Lesson 32 published. Map, example, EX094.
flowchart TD
N0["Learning outcomes"]
N1["32.1 Safety engineers"]
N2["32.2 Procurement"]
N3["32.3 Operations and maintenance"]
N4["32.4 Law and regulation"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX094"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["32.1 Safety engineers"]
N2["32.2 Procurement"]
N3["32.3 Operations and maintenance"]
N4["32.4 Law and regulation"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX094"]
[Learning outcomes]
|
v
[32.1 Safety engineers]
|
v
[32.2 Procurement]
|
v
[32.3 Operations and maintenance]
|
v
[32.4 Law and regulation]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX094]
Learning outcomes
You will (1) explain how security work interfaces with process safety, operations, procurement and law; (2) write security requirements for a procurement specification; (3) participate in a combined safety–security review; and (4) communicate with non-security professionals using their terms.
32.1 Safety engineers
Process safety teams run hazard and operability studies (HAZOP) and determine safety integrity levels for safety instrumented functions under IEC 61511. A security engineer joins to ask, for each hazard, whether a cyber cause could initiate it or disable the protection layer. The output is shared: a hazard log that lists cyber causes next to equipment failures.
Maya's HAZOP contribution at LDHP is the example in this chapter: "setpoint manipulated via unauthorised network write" added as a cause for the high supply temperature node, next to controller failure and a valve stuck open.
32.2 Procurement
The cheapest time to fix security is before purchase. A specification can require IEC 62443-4-2 capabilities at a stated security level, ETSI EN 303 645 conformance for consumer-type devices, an SBOM, a vulnerability disclosure process, a defined support period and signed firmware. Without these clauses the plant inherits whatever the vendor ships.
For LDHP's next meter purchase, those clauses would have screened out MTR-C before delivery: it has no update mechanism, no disclosure contact and no secure communication, three failures that now cost a replacement within 12 months.
32.3 Operations and maintenance
Operators judge any change by its effect on their shift. Present security changes in their terms: "this firewall change means the historian trend screen updates every 10 s instead of 2 s." Maintenance technicians need procedures that fit their tools; requiring a laptop they do not carry fails silently.
At LDHP, the allow-list change in Chapter 27 would be presented to the shift team as: "HMI-1 still writes the same setpoints; the historian can no longer write anything; if a legitimate write is refused, call the control engineer, who can see it in the firewall log". That sentence answers the operators' question, what changes tonight, without a word about function codes.
32.4 Law and regulation
Depending on jurisdiction, district heating may be regulated as critical infrastructure with incident-reporting duties. Security staff must know reporting deadlines and who reports. This book gives orientation, not legal advice.
For a security student at LDHP, the practical step is to find out from the plant's own compliance lead which regime applies, what counts as a reportable incident and who reports it. In Chapter 29's tabletop, a setpoint write from the office VLAN that cut heat for five minutes might well meet a reporting threshold. Knowing that at 02:18 changes what evidence the analyst preserves and who the shift lead calls next.
Worked example (synthetic LDHP)
In LDHP's HAZOP review of "high supply temperature", the existing causes were controller failure and valve stuck open. Maya adds "setpoint manipulated via unauthorised network write" as a cause, with existing safeguard SIS-H high-temperature trip (independent transmitter, hardwired) and a recommended additional safeguard: PLC-H setpoint limits (Chapter 24).
Synthetic case — Lakeside District Heating Plant. The HAZOP node and recommendations are invented.
Errors and limits
A security engineer is not qualified to change SIL determinations; recommend and let the safety team decide. Procurement clauses need verification at delivery.
Exercises
- EX094 — Three procurement clauses. Write three security clauses for LDHP's next meter gateway purchase. Rubric: 3 = three specific, verifiable clauses; 2 = two; 1 = "must be secure"; 0 = none.
- EX095 — A cyber cause in HAZOP. For the node "low circulation flow", add one cyber cause and its safeguard. Rubric: 3 = plausible cyber cause plus independent safeguard; 2 = cause only; 1 = equipment failure; 0 = none.
- EX096 — Explaining a change to operators. Explain enforcing allow-listing on HMI-1 in operator terms. Rubric: 3 = what they see, what to do if blocked, who to call; 2 = two; 1 = jargon; 0 = none.
Synthesis
OT security succeeds through other disciplines: safety reviews, procurement clauses, operator-centred changes and awareness of legal duties.
Continue studying — chapter 32 of 40
← Chapter 31 (draft) · Course chapter index · Chapter 33 (draft) →