Chapter 31 — Critical infrastructure and sector security: implementation II
Lesson map
Lesson 31 published. Map, example, EX061.
flowchart TD
N0["Learning outcomes and connection"]
N1["31.1 Staged deployment"]
N2["31.2 Production key and secret management"]
N3["31.3 Legacy integration"]
N4["31.4 Commissioning and handover"]
N5["31.6 Practical activity"]
N6["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX061"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["31.1 Staged deployment"]
N2["31.2 Production key and secret management"]
N3["31.3 Legacy integration"]
N4["31.4 Commissioning and handover"]
N5["31.6 Practical activity"]
N6["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX061"]
[Learning outcomes and connection]
|
v
[31.1 Staged deployment]
|
v
[31.2 Production key and secret management]
|
v
[31.3 Legacy integration]
|
v
[31.4 Commissioning and handover]
|
v
[31.6 Practical activity]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX061]
Learning outcomes and connection
After this chapter you can (1) deploy controls into operational environments through staged rollout with rollback; (2) manage keys, configuration and secrets in production; (3) integrate legacy equipment through gateways and compensating controls; and (4) commission a control with acceptance tests and operator handover. It moves Chapter 28's bench implementation into the field and prepares Chapters 32–34.
31.1 Staged deployment
Field deployment follows stages, each with entry and exit criteria: bench (all tests pass); pilot site with low consequence; one high-consequence site with extra monitoring and a rollback plan; fleet. Each stage has a rollback — the ability to return to the previous known-good state quickly — tested before it is needed. Schedule changes outside peak demand and with operators informed; in water, avoid changes during high-demand periods or when storage is low.
TMRP's stages are bench, PS2 as the low-consequence pilot, PS4 as the first high-consequence site, then the fleet.
31.2 Production key and secret management
On the bench, keys are files; in production they are lifecycles. Generate keys in hardware security modules or device secure elements; enrol devices with an auditable ceremony (two people, logged); store the inventory of which key belongs to which device and its rotation date; rotate; and revoke promptly when a device is lost or decommissioned. Secrets for service accounts go into a vault with access logging, not into scripts. A key inventory is itself sensitive.
For TMRP, keys are generated in the gateway's secure element at enrolment.
31.3 Legacy integration
Legacy devices that cannot authenticate are wrapped: a gateway placed physically adjacent (same cabinet) adds authentication on the network side and speaks the legacy protocol on a short, physically protected link. The gateway becomes part of the device's security boundary, so it needs its own hardening, monitoring and update path. Compensating controls cover what the gateway cannot: cabinet tamper alarms, local logging, and restrictions on which function codes pass through.
At PS2, the gateway sits in the RTU cabinet on a 30 cm serial link and passes only two function codes.
31.4 Commissioning and handover
Commissioning verifies the installed system in its real environment: site acceptance tests repeat key bench tests on site (authentication rejects forged frames; replay rejected; failover to local automatic works; alarms reach the control room within 60 s). Handover gives operators procedures, training, contacts and the known limitations. Until operators can run and recover the system, the control is not in service.
At PS2, site acceptance also found the gateway's clock drift, which was fixed and re-tested before handover. Operators were trained first.
31.5 Worked example: PS2 pilot (synthetic)
TMRP's pilot site is PS2 — legacy RTU-A, low consequence. Entry criteria: T1, T2, T3 (v2), T5 passed on the bench; rollback image ready; operators briefed. The gateway is installed in the RTU cabinet; the serial link is 30 cm inside the locked cabinet; the gateway passes only function codes 3 (read) and 6 (write single register) for the configured register range. Site acceptance: forged and replayed frames rejected and alarmed; pulling the LTE antenna results in local automatic operation and a communication-loss alarm within 60 s; restoring the antenna resumes telemetry with counters continuing. One finding: the gateway clock drifted 40 s in 48 h because NTP was not reachable through the new conduit; fixed by adding an internal time source to the conduit allowlist. Exit criteria met after re-test; PS4 is next.
31.6 Practical activity
Write the stage plan for TMRP fleet rollout with entry/exit criteria and rollback for each stage, and a two-page operator handover note for the gateway.
Use the PS2 pilot as your model for entry and exit criteria, then extend the plan to PS4 and the remaining stations. For each stage, say how rollback is done and who decides to use it. In the handover note, give operators the alarms the gateway raises, what each means, how to switch to local manual operation and whom to call. List the known limitations plainly, such as the dependence on an internal time source learned at PS2.
31.7 Common errors and limits
- "Big bang" deployment without pilot or rollback.
- Rollback plans never tested.
- Key enrolment by one person without records.
- Gateways treated as transparent rather than as security-critical devices.
- Commissioning without operators; handover without known limitations.
TMRP's PS2 pilot avoided these: it had a rollback image, operators were briefed before installation, and the clock-drift finding was handled as an interface fix and re-tested before PS4 began. Key enrolment follows the two-person, logged ceremony described above, and the gateway was treated as a security-critical device with its own hardening and update path.
Exercises — chapter 31
EX061 — Rollback criteria. Objective: define when to roll back. Inputs: PS4 deployment. Steps: define three measurable rollback triggers, who decides, and the maximum time to complete rollback. Expected evidence: list. Rubric: 3 = triggers measurable (e.g., telemetry loss > 5 min not explained by link loss, any accepted message failing audit, alarm latency > 60 s for priority alarms), decision owner named by role, rollback time consistent with hospital buffer; 2 = vague triggers; 1 = no owner; 0 = none.
EX062 — Gateway as boundary. Objective: secure a legacy wrapper. Inputs: the PS2 gateway. Steps: list six controls that the gateway itself needs, and the residual risk if an attacker gains physical access to the cabinet. Expected evidence: list and residual statement. Rubric: 3 = hardening, signed updates, key protection, function-code filtering, tamper detection, logging; honest residual (physical attacker can bypass via serial link); 2 = residual missing; 1 = generic; 0 = none.
Chapter synthesis
Deploy in stages with entry and exit criteria and tested rollback. Manage keys and secrets as lifecycles with auditable ceremonies. Wrap legacy devices with gateways that are themselves treated as security-critical, plus compensating physical controls. A control is in service only after site acceptance and operator handover.
Continue studying — chapter 31 of 50
← Chapter 30 · Course chapter index · Chapter 32 →
Continue to the next authored lesson.