Chapter 12 — Operating systems

Lesson map

Lesson 12 published. Map, example, EX034.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Workstations are part of the control system"]
  N2["12.2 Least privilege for engineers"]
  N3["12.3 Patch windows"]
  N4["Practice note"]
  N5["12.1b Image and offline analysis"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX034"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Workstations are part of the control system"]
  N2["12.2 Least privilege for engineers"]
  N3["12.3 Patch windows"]
  N4["Practice note"]
  N5["12.1b Image and offline analysis"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX034"]

[Learning outcomes]
    |
    v
[12.1 Workstations are part of the control system]
    |
    v
[12.2 Least privilege for engineers]
    |
    v
[12.3 Patch windows]
    |
    v
[Practice note]
    |
    v
[12.1b Image and offline analysis]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX034]

Learning outcomes

You will (1) harden HMI and engineering workstations without breaking control; (2) collect OS evidence under least privilege; (3) plan patching inside maintenance windows.

12.1 Workstations are part of the control system

HMIs and engineering workstations often run general-purpose OSes with decades of legacy software. Treating them as just PCs is how malware walks into L2. Hardening baselines (application allow-listing, local admin removal, USB control) must be tested against the HMI vendor's support matrix — an unsupported hardening change that blanks a screen during a batch is an availability incident.

At ABP, Lena tests each hardening change on a bench HMI running the same vendor version before it reaches the control room, and records which items the vendor supports.

12.2 Least privilege for engineers

Named accounts, time-boxed admin rights, logged elevations. Shared engineer passwords are still common and still wrong: they destroy attribution and linger after contractors leave. Findings about shared passwords are configuration findings, not invitations to crack hashes.

At ABP, the shared engineer password on eng-WS-1 is replaced with named accounts, and each elevation is logged with the person and the reason. Contractors receive accounts that expire at the end of their work order. Lena reports shared passwords from the configuration and the account list, never by testing them.

12.3 Patch windows

OT patches land in maintenance windows, not on Patch Tuesday. Fit jobs by risk into the available hours; defer what does not fit rather than overrunning into production.

"""Lab: fit patch jobs into plant maintenance windows (synthetic, greedy by risk)."""
windows = [("W1 Sat 02-06", 4.0), ("W2 Sun 02-04", 2.0)]
jobs = [("HMI OS update", 1.5, 8), ("historian DB patch", 2.5, 5), ("PLC-A firmware", 3.0, 9),
        ("eng-WS AV update", 0.5, 3), ("switch firmware", 1.0, 6)]   # name, hours, risk score
left = {w: h for w, h in windows}; plan = {w: [] for w, _ in windows}; deferred = []
for name, h, r in sorted(jobs, key=lambda j: -j[2]):
    for w, _ in windows:
        if left[w] >= h:
            left[w] -= h; plan[w].append(name); break
    else:
        deferred.append(name)
for w, _ in windows:
    print(w, plan[w], f"spare={left[w]:.1f}h")
print("deferred:", deferred)

Expected output:

W1 Sat 02-06 ['PLC-A firmware', 'switch firmware'] spare=0.0h
W2 Sun 02-04 ['HMI OS update', 'eng-WS AV update'] spare=0.0h
deferred: ['historian DB patch']

Synthetic case — Ashford Batch Plant. The patch lab deferred the historian DB patch because W1 and W2 were full with higher-risk PLC and HMI work. Lena scheduled a dedicated window the next month instead of squeezing it into Sunday morning.

Each deferred job keeps its ticket and date. Deferrals are reviewed monthly.

12.4 Errors and limits

Do not disable antivirus or allow-listing to make the vendor happy without a written exception and compensating monitoring. Offline plants still need media control.

When the HMI vendor asks for an exception, Lena records which protection is relaxed, on which host, for how long, and what monitoring replaces it. The exception has an owner and an expiry date. Offline hosts still receive media through a scanning station and a logged transfer, since USB sticks are the usual route into an isolated network.

Practice note

Every deferred patch gets a ticket with residual risk and a date. Deferred-without-date is how decade-old HMI OS images survive. Review the deferred list in the same meeting that plans the next window.

12.1b Image and offline analysis

Full-disk images of HMIs are high impact: they take systems offline, may contain proprietary recipes and tempt out-of-scope browsing. Prefer live, least-privilege reads and configuration exports. If an image is truly required, the work permit must name chain-of-custody, encryption at rest, who may mount it, and a destroy-by date — and the course labs still do not practice imaging real hosts. Offline plants still need media control; air gaps that hide USB and cellular modems are not air gaps.

Lena has never needed a full image at ABP.

Exercises

• EX034 — Account. Specify a least-privilege pattern for PLC engineering access. Rubric: 3 = named, time-boxed, logged, dual control for logic download; 2 = three of four; 1 = shared admin; 0 = none.
• EX035 — Lab. Which job was deferred and why? Rubric: 3 = historian DB patch; windows full after higher-risk jobs; 2 = name only; 1 = vague; 0 = wrong.
• EX036 — Exception. Write a one-line USB exception for a vendor bring-up with compensating control. Rubric: 3 = time-boxed, scanned media, monitored host; 2 = partial; 1 = open USB; 0 = none.

Synthesis

Harden and patch workstations as if they were controllers — because for malware, they are the door.

Continue studying — chapter 12 of 50

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →