Chapter 5 — Security literacy | Bachelor's OT, IoT and cyber-physical security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 The OT order of concern"]
  N2["5.2 Threat, vulnerability, consequence"]
  N3["5.3 ATT&CK for ICS as a vocabulary"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 The OT order of concern"]
  N2["5.2 Threat, vulnerability, consequence"]
  N3["5.3 ATT&CK for ICS as a vocabulary"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 The OT order of concern]
    |
    v
[5.2 Threat, vulnerability, consequence]
    |
    v
[5.3 ATT&CK for ICS as a vocabulary]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) define confidentiality, integrity and availability for a heating plant; (2) add safety and reliability as first-class properties; (3) separate threat, vulnerability and consequence; and (4) map one public technique from MITRE ATT&CK for ICS to an LDHP asset.

5.1 The OT order of concern

In office IT, confidentiality often leads. In a district heating plant the order usually inverts: the safety of people and equipment first, then availability and integrity of control, and only then confidentiality of data. Recipe tables or customer meter readings still matter — the meter data are personal data — but a leaked spreadsheet does not scald anyone, while a manipulated setpoint can.

Maya applied this when the plant manager asked whether to encrypt the historian database first: she ranked separating the office network from PLC-H higher, because a setpoint write can stop heat to homes and a database copy cannot.

5.2 Threat, vulnerability, consequence

A threat is an actor or event with intent or potential to cause harm. A vulnerability is a weakness that makes harm possible. A consequence is what actually happens to the process. Students often confuse them: "Modbus has no authentication" is a vulnerability, "a disgruntled contractor" is a threat source, and "loss of heat to 4,000 homes in January" is a consequence. Risk statements need all three.

Maya's risk statement for PLC-H joins them: a contractor on the office network (threat) can write register 100 because Modbus has no authentication and port 502 is reachable (vulnerability), lowering the supply setpoint to 30 °C and cutting heat to 4,000 homes (consequence).

5.3 ATT&CK for ICS as a vocabulary

MITRE ATT&CK for ICS catalogues adversary behaviour observed against industrial systems. Technique T0836 Modify Parameter describes changing controller parameters such as setpoints or limits to cause an effect; T0883 Internet Accessible Device describes reaching controllers exposed directly to the internet. Use these identifiers to describe behaviour precisely — not as a checklist claiming completeness.

At LDHP, T0836 describes the scenario this book returns to most often: a write to holding register 100, the supply-temperature setpoint. T0883 describes the classmate's "real" heating controller found on a search engine in Chapter 10. Naming them lets Maya link her notes to public advisories without implying the plant has seen either.

Worked example (synthetic LDHP)

Statement: "An unauthorized party with access to the office VLAN (threat) could use the unauthenticated Modbus path through rule 14 (vulnerability) to change the supply setpoint, behaviour described by ATT&CK for ICS T0836 Modify Parameter, reducing delivered heat by about 1 MW (consequence, from Chapter 1); the hardwired SIS-H limits over-temperature harm." Each clause is separable and each can be challenged.

Synthetic case — Lakeside District Heating Plant. The plant manager asks whether encrypting the historian database is the top priority. Maya ranks it below separating the office from PLC-H and explains why using the OT order of concern.

Errors and limits

ATT&CK lists observed behaviour; absence of a technique is not proof it cannot happen. Safety is not the same as security, and security controls must never weaken a safety function.

Exercises

EX013 — Sorting threat, weakness and harm. Classify: (a) "default password on the meter gateway", (b) "ransomware crew", (c) "boiler trips and district loses heat for six hours". Rubric: 3 = vulnerability, threat, consequence; 2 = two right; 1 = one; 0 = none.
EX014 — Ranking LDHP priorities. Justify placing setpoint integrity above meter-data confidentiality at LDHP, without saying confidentiality is unimportant. Rubric: 3 = physical consequence vs privacy harm, both retained; 2 = ranking only; 1 = dismisses privacy; 0 = none.
EX015 — Mapping an exposed gateway. Which ATT&CK for ICS technique ID describes the meter gateway being reachable from the internet, and what does mapping it not prove? Rubric: 3 = T0883 and "does not prove exploitation or completeness"; 2 = ID only; 1 = wrong ID; 0 = none.

Synthesis

Security literacy in OT means speaking precisely about threats, weaknesses and physical consequences, with safety at the top and shared vocabularies used honestly.

Continue studying — chapter 05 of 40

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →