Chapter 34 — Comparative project | Bachelor's OT, IoT and cyber-physical security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 34 — Comparative project

Lesson map

Lesson 34 published. Map, example, EX100.

flowchart TD
  N0["Learning outcomes"]
  N1["34.1 The two options"]
  N2["34.2 Criteria"]
  N3["34.3 Scoring"]
  N4["34.4 Sensitivity"]
  N5["34.5 Evidence for each score"]
  N6["34.6 Presenting the comparison"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX100"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["34.1 The two options"]
  N2["34.2 Criteria"]
  N3["34.3 Scoring"]
  N4["34.4 Sensitivity"]
  N5["34.5 Evidence for each score"]
  N6["34.6 Presenting the comparison"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX100"]

[Learning outcomes]
    |
    v
[34.1 The two options]
    |
    v
[34.2 Criteria]
    |
    v
[34.3 Scoring]
    |
    v
[34.4 Sensitivity]
    |
    v
[34.5 Evidence for each score]
    |
    v
[34.6 Presenting the comparison]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX100]

Learning outcomes

You will (1) compare two architectures for remote vendor access against explicit criteria; (2) build a weighted decision matrix and test its sensitivity; (3) document assumptions per option; and (4) recommend with residual risk.

34.1 The two options

Option A — persistent VPN from the vendor to a jump host in LDHP's DMZ, with MFA. Option B — on-demand brokered sessions: the shift lead enables a session for a ticket, the vendor connects through a cloud broker to the jump host, the session is recorded and ends after four hours. Both avoid direct connections to PLC-H.

These two options came from LDHP's starting point, the always-on vendor remote-desktop tool. Both close that path. The question is which one fits a plant that needs vendor help at night.

34.2 Criteria

Exposure (how long a path exists), attribution (named users, recording), operational fit (can a vendor help at 3 a.m.?), cost and dependency on third parties. Weights reflect LDHP priorities: exposure 0.3, attribution 0.25, operational fit 0.25, cost 0.1, third-party dependency 0.1.

The weights were set before scoring, in a meeting with LDHP's operations manager, which is why they can be challenged without accusing the scorer of choosing them to suit a favourite. Exposure carries the most weight because the 2021 water case and LDHP's own always-on tool both turned on how long a remote path stayed open. Cost carries little because the difference between the two options is small next to the cost of a lost heating night.

34.3 Scoring

Scores 1–5. A: exposure 2, attribution 3, fit 5, cost 4, dependency 4 → 0.6 + 0.75 + 1.25 + 0.4 + 0.4 = 3.40. B: exposure 5, attribution 5, fit 3, cost 3, dependency 2 → 1.5 + 1.25 + 0.75 + 0.3 + 0.2 = 4.00. B leads.

Option B wins mainly on exposure and attribution: a path that exists only for four hours per ticket, and a recorded session with a named vendor account. Option A wins on operational fit, because a persistent VPN is available at 3 a.m. without anyone enabling it. The 0.60 gap comes almost entirely from exposure, where B scores 5 against A's 2, so the recommendation is only as good as that pair of scores. If the cloud broker were judged a weaker dependency than shown, B's lead would shrink, though not by enough on its own to reverse it.

34.4 Sensitivity

Raise operational fit to 0.45 and lower exposure to 0.1: A = 0.2 + 0.75 + 2.25 + 0.4 + 0.4 = 4.00; B = 0.5 + 1.25 + 1.35 + 0.3 + 0.2 = 3.60. The ranking flips, so the recommendation depends on how much the plant values night-time vendor availability. Say so explicitly.

The flip happens because operational fit is where A scores 5 and B scores 3: at a weight of 0.45 that gap is worth 0.9, more than B's advantage on exposure at the reduced weight of 0.1. Maya's answer was not to pick a weighting she preferred but to fix B's weakest criterion: a night procedure in which the shift lead enables a session by phone call to the on-call engineer.

Worked example (synthetic LDHP)

Maya recommends B with one change to address its weakest criterion: a documented night procedure in which the shift lead can enable a session by phone call to the on-call engineer. She records the residual risk that the cloud broker is a third-party dependency and requests its security attestation.

Synthetic case — Lakeside District Heating Plant. Scores are the student's judgements on invented options.

34.5 Evidence for each score

Attach a reason to every number. B's attribution score of 5 rests on session recording and named vendor accounts in the broker; A's exposure score of 2 rests on the VPN being permanently reachable even when no work is scheduled. If a reviewer disputes a score, the evidence column shows exactly what to check, and the sensitivity test shows whether the dispute could change the recommendation at all.

B's dependency score of 2 rests on the cloud broker, which is why Maya requested its security attestation.

34.6 Presenting the comparison

Show the plant manager the matrix, the sensitivity result and one paragraph per option describing a night-time support call under each design. Concrete scenarios are easier to judge than weighted totals.

For LDHP's two options, the night-time paragraph does most of the work. Under A, a vendor engineer is called at 03:00 about a boiler fault, connects through the VPN that is always open and reaches the jump host within minutes. Under B, the shift lead phones the on-call engineer, who enables a four-hour session for the ticket; the vendor connects through the broker and the session is recorded. The manager can see that B costs a phone call and a few minutes at night, and that A leaves the path open on every other night of the year.

Errors and limits

Weighted matrices mix judgement with arithmetic; disclose weights and run sensitivity checks. Scores without evidence are opinions.

Exercises

EX100 — Recomputing with equal weights. Using weight 0.2 for all five criteria, score A and B. Rubric: 3 = A 3.6, B 3.6, tie noted; 2 = one right; 1 = arithmetic errors; 0 = none.
EX101 — An assumption behind B's exposure score. Name one assumption behind giving B exposure 5. Rubric: 3 = sessions really end, broker cannot open sessions itself, shift lead enabling is enforced; 2 = vague but relevant; 1 = none relevant; 0 = none.
EX102 — When to flip the recommendation. State the condition under which A should be chosen. Rubric: 3 = if 24/7 vendor availability outweighs exposure (fit weight high) and A's risk is compensated; 2 = partial; 1 = "if cheaper"; 0 = none.

Synthesis

Comparative work is honest when criteria, weights, evidence and sensitivity are all visible, and the recommendation states when it would change.

Continue studying — chapter 34 of 40

← Chapter 33 (draft) · Course chapter index · Chapter 35 (draft) →