◇ OpenCyber Academy
Engineering · Chapter 15 · English

Chapter 15 — Security fundamentals

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 15 — Security fundamentals

Lesson map

Lesson 15 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 CIA plus safety"]
  N2["15.2 Vulnerability, exposure, risk"]
  N3["15.3 Empty scores"]
  N4["Practice note"]
  N5["15.1b From property to test"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 CIA plus safety"]
  N2["15.2 Vulnerability, exposure, risk"]
  N3["15.3 Empty scores"]
  N4["Practice note"]
  N5["15.1b From property to test"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX043"]

[Learning outcomes]
    |
    v
[15.1 CIA plus safety]
    |
    v
[15.2 Vulnerability, exposure, risk]
    |
    v
[15.3 Empty scores]
    |
    v
[Practice note]
    |
    v
[15.1b From property to test]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) map CIA and safety to OT assessment questions; (2) distinguish vulnerability, exposure and process risk; (3) refuse empty security scores.

15.1 CIA plus safety

Confidentiality: who can read recipes or trends? Integrity: who can change setpoints or logic? Availability: what stops the batch? Safety: which protective layers remain independent? Every finding should say which properties are affected and whether a safety function is in scope.

Lena adds a line to every CNHP finding naming the affected properties and whether SIS-B is in scope. At ABP, a finding about an unauthenticated write to PLC-A affects integrity and, through the tank level, possibly safety; a finding about the historian replica affects confidentiality. Naming the property tells readers which team must respond.

15.2 Vulnerability, exposure, risk

An unauthenticated Modbus write is a vulnerability. On a PLC reachable from L2 it is an exposure. Process risk adds likelihood and consequence for the plant — which needs the safety engineer's model, not a universal CVSS-only story. Tickets store consequence bounds and protective layers separately; risk acceptance stays with the plant owner.

Lena's ticket template has separate fields for each so that none is lost. Lena records the exposure, such as reachability from L2, separately from the vulnerability, so that fixing either one can be tracked. The plant manager signs any acceptance of residual risk.

15.3 Empty scores

A single OT risk = 42 hides whether SIS independence holds. Prefer concrete measures: open high-consequence findings, conduits into SIS, detector false-alarm rate at the plant's base rate, patch deferral age. If you show a score, show the model and inputs.

Synthetic case — Ashford Batch Plant. Lena stopped putting a composite score on CNHP slides. The deck now shows: SIS reachable from L4? No. Critical opens: 1. Alarms per operator-hour: 1.05. Deferred high-risk patches: 0.

Each CNHP measure has a definition and a source, so it can be recomputed.

15.4 Errors and limits

Fundamentals are vocabulary; they are not a complete hazard analysis. Continue into threat and failure analysis for structured study.

The vocabulary helps people describe findings consistently, but it does not replace the plant's process hazard analysis. Lena links CNHP findings to the hazard analysis where they touch a hazard, and leaves consequence judgments to the process-safety engineer. Threat and failure analysis later in the programme gives the structured method. Each finding links to the relevant hazard. The safety engineer reviews those links.

Practice note

When someone asks for a traffic-light dashboard, offer three lights that mean something: SIS independence intact (yes/no), critical findings open (count), patch deferrals past date (count). Refuse a fourth light called overall cyber.

15.1b From property to test

If a finding claims integrity impact, the validation plan must include an integrity check (who can still write). If it claims availability impact, such as a PLC that stops answering polls, validation uses a canary or a synthetic probe on the bench — not a new attack on the line. Lena writes the property, the finding and the re-test method in one paragraph of the CNHP ticket, beside the work-permit number. The re-test result goes into the same ticket as the original finding, with the date and the check used, so closure can be audited later.

At ABP, the FW-12 finding claimed an integrity exposure, so its re-test checked that the office zone could no longer reach SCADA, using the same reachability method.

Exercises

Synthesis

Name the property, separate exposure from process risk, prefer measures you can recompute.

Continue studying — chapter 15 of 50

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →