◇ OpenCyber Academy
Bachelor's · Chapter 4 · English

Chapter 4 — Academic writing

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Academic writing

Lesson map

Lesson 04 published. Map, example, EX010.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Claim, evidence, limitation"]
  N2["4.2 Citing standards precisely"]
  N3["4.3 One fact, three audiences"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX010"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Claim, evidence, limitation"]
  N2["4.2 Citing standards precisely"]
  N3["4.3 One fact, three audiences"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX010"]

[Learning outcomes]
    |
    v
[4.1 Claim, evidence, limitation]
    |
    v
[4.2 Citing standards precisely]
    |
    v
[4.3 One fact, three audiences]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX010]

Learning outcomes

You will (1) structure a technical memo as claim, evidence and limitation; (2) cite a standard by its exact identifier and edition; (3) write for an operator, an engineer and a manager without changing the facts; and (4) avoid inflated language in security findings.

4.1 Claim, evidence, limitation

Every paragraph in an OT security memo should let the reader find three things: what you assert, what you observed that supports it, and where the assertion stops. "Port 502 on PLC-H is reachable from the office VLAN (observed in the approved firewall rule export of 3 March); we did not test whether writes succeed" is a better sentence than "PLC-H is wide open", because it is checkable and honest about scope.

Maya's memo used this sentence nearly word for word, and the shift lead's only question, what operators should do differently tonight, was answerable because the limitation was stated.

4.2 Citing standards precisely

Write "NIST SP 800-82 Rev. 3 (September 2023)", not "NIST guidance". For the 62443 family name the part: IEC 62443-3-3 covers system security requirements and security levels; IEC 62443-2-1 covers the asset owner's security programme; IEC 62443-4-2 covers component requirements. A reader must be able to open the exact document. Do not cite a clause number you have not read.

Maya's later SL-T proposal for LDHP cites IEC 62443-3-2 by part for the zone method and IEC 62443-3-3 for the requirements, rather than "62443" for both. A reader who wants to check her SL-T 3 for the boiler control zone needs to open the part that defines security levels, not a family of fourteen documents.

4.3 One fact, three audiences

The operator needs to know what to watch for; the engineer needs the technical path; the manager needs cost, downtime and residual risk. Keep the facts identical across versions — only emphasis and vocabulary change. If the versions disagree on facts, one of them is wrong.

For the PLC-H finding: the operator hears "if the supply setpoint changes without a request from HMI-1, call the shift lead"; the engineer hears "port 502 reachable from the office VLAN per the 3 March rule export; writes untested"; the manager hears the cost of the firewall change and the residual risk until it is made. All three versions name the same port, the same date and the same untested question.

Worked example (synthetic LDHP)

Weak: "Hackers could take over the boiler, which is extremely dangerous." Rewritten: "A host on the office VLAN can open Modbus/TCP connections to PLC-H (rule 14 in the 3 March export). We have not tested write access. The SIS-H high-temperature trip is hardwired and does not depend on this path. Recommended: remove rule 14 and route historian reads through the DMZ." The rewrite gives location, evidence, untested scope, the independent safeguard and an action.

Synthetic case — Lakeside District Heating Plant. Maya's memo is reviewed by the plant's shift lead, who asks only one question: "What should my operators do differently tonight?" The memo must answer it.

Errors and limits

Avoid "military-grade", "fully secure" and "zero risk". Passive voice that hides who observed what weakens evidence. A literature review is not a substitute for your own observation.

Exercises

Synthesis

Good OT writing is checkable: exact sources, observed evidence and stated limits, in words each audience can act on.

Continue studying — chapter 04 of 40

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →