◇ OpenCyber Academy
Engineering · Chapter 18 · English

Chapter 18 — Security architecture

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 18 — Security architecture

Lesson map

Lesson 18 published. Map, example, EX052.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Zones that match safety"]
  N2["18.2 Engineering access"]
  N3["18.3 Synthetic ranges"]
  N4["Practice note"]
  N5["18.1b Jump hosts and egress"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX052"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Zones that match safety"]
  N2["18.2 Engineering access"]
  N3["18.3 Synthetic ranges"]
  N4["Practice note"]
  N5["18.1b Jump hosts and egress"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX052"]

[Learning outcomes]
    |
    v
[18.1 Zones that match safety]
    |
    v
[18.2 Engineering access]
    |
    v
[18.3 Synthetic ranges]
    |
    v
[Practice note]
    |
    v
[18.1b Jump hosts and egress]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX052]

Learning outcomes

You will (1) apply Purdue/62443 zoning at ABP; (2) define trust boundaries for engineering access; (3) choose when a synthetic range is the right place to test.

18.1 Zones that match safety

L0/L1 hold process and basic control; L2 supervision; L3 site operations; L3.5 DMZ; L4/L5 enterprise. SIS sits with carefully controlled conduits. Architecture diagrams must match the reachability graph, not a marketing Purdue poster.

Lena checks the ABP diagram against the reachability results from the firewall export at each review. At ABP, SIS-B's engineering ports are reachable only through the keyswitch path during scheduled tests, and the office reaches SCADA data only through the DMZ historian replica. Where the diagram and the reachability results disagree, the results win and the diagram is corrected. Lena marks the diagram with the export hash it was checked against.

18.2 Engineering access

Engineering workstations and vendor laptops cross trust boundaries. Prefer: DMZ jump host, time-limited accounts, monitored sessions, no standing VPN from the internet to L2. USB and cellular modems are architecture too — inventory them.

At ABP, vendor sessions pass through a DMZ jump host with time-limited accounts and recorded sessions. Lena's inventory lists every engineering laptop allowed to connect, and any standing VPN found in a review is reported as a finding. USB use on engineering workstations is logged and reviewed monthly.

18.3 Synthetic ranges

When methods are noisy or the plant is fragile, use a synthetic or digital-twin range that mirrors configuration. Results then support claims about the mirrored config, not about live process behaviour. Say so in the report.

# Lab 23 - reachability count on a synthetic Purdue-layered OT network
# Nodes: L5-ERP, L4-Office, L3.5-DMZ, L3-Hist, L2-SCADA, L1-PLC, L1-SIS, L0-IO
edges_flat=[("L5","L4"),("L4","L3"),("L3","L2"),("L2","L1-PLC"),("L2","L1-SIS"),("L1-PLC","L0"),("L1-SIS","L0"),("L4","L2")]
edges_zoned=[("L5","L4"),("L4","L3.5"),("L3.5","L3"),("L3","L2"),("L2","L1-PLC"),("L1-SIS","L0"),("L1-PLC","L0")]  # SIS not reachable from SCADA
def reach(edges, start):
    g={};
    for a,b in edges: g.setdefault(a,[]).append(b)
    seen=set(); stack=[start]
    while stack:
        n=stack.pop()
        if n in seen: continue
        seen.add(n); stack.extend(g.get(n,[]))
    return seen
for name,e in (("flat",edges_flat),("zoned",edges_zoned)):
    r=reach(e,"L4")
    print(f"{name}: L4 reaches {sorted(r)} count={len(r)} writes_to_SIS={'L1-SIS' in r}")

Expected output:

flat: L4 reaches ['L0', 'L1-PLC', 'L1-SIS', 'L2', 'L3', 'L4'] count=6 writes_to_SIS=True
zoned: L4 reaches ['L0', 'L1-PLC', 'L2', 'L3', 'L3.5', 'L4'] count=6 writes_to_SIS=False

Synthetic case — Ashford Batch Plant. CNHP's target architecture is the zoned graph: L4 views through L3.5; SIS engineering only via keyswitch; no L2 to L1-SIS conduit.

Lena's bench copy of ABP's firewall and monitor is such a range; its reports state that results apply to the mirrored configuration only.

18.4 Errors and limits

Diagrams age. Re-validate zones against the live firewall export at each window.

Lena compares the diagram with the live firewall export at the start of each window and records any difference as a finding. A diagram that has not been checked against the export is marked as unverified, so nobody relies on it by mistake during an incident. The six-month re-test later found exactly this kind of drift. The check takes minutes with the reachability script. Its result is filed with the window record.

Practice note

Hang the zone diagram next to the privilege map from Chapter 8. When a vendor asks for a temporary rule, point at the wall and ask which edge they want to add — and which requirement it breaks.

18.1b Jump hosts and egress

Engineering jump hosts are high-value: harden them, log session start/stop, forbid personal file sync agents, and rebuild from golden images between windows when feasible. Assessment and engineering zones need egress allow-lists: only in-scope plant CIDRs and the evidence store. Open egress turns a compromised laptop into a pivot the work permit never authorized.

Lena exports the L2 and DMZ diagrams for each window into the CNHP dossier and hashes them like any evidence file. When an auditor asks how traffic reached L2, you show the diagram version that was live, not a newer cleaned-up sketch.

Exercises

Synthesis

Zones, engineering-access boundaries and honest limits on what a twin can prove.

Continue studying — chapter 18 of 50

← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →