◇ OpenCyber Academy
Engineering · Chapter 19 · English

Chapter 19 — Identity and cryptography

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 19 — Identity and cryptography

Lesson map

Lesson 19 published. Map, example, EX055.

flowchart TD
  N0["Learning outcomes"]
  N1["19.1 Identity in the plant"]
  N2["19.2 Evidence hashing"]
  N3["19.3 Secrets"]
  N4["Practice note"]
  N5["19.1b Certificates and break-glass"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX055"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["19.1 Identity in the plant"]
  N2["19.2 Evidence hashing"]
  N3["19.3 Secrets"]
  N4["Practice note"]
  N5["19.1b Certificates and break-glass"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX055"]

[Learning outcomes]
    |
    v
[19.1 Identity in the plant]
    |
    v
[19.2 Evidence hashing]
    |
    v
[19.3 Secrets]
    |
    v
[Practice note]
    |
    v
[19.1b Certificates and break-glass]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX055]

Learning outcomes

You will (1) assess OT identity without attacking crypto; (2) use hashing for evidence integrity; (3) handle engineering credentials safely.

19.1 Identity in the plant

Ask: which accounts exist on HMIs, historians and engineering hosts? Which use shared passwords? Which integrate with the site directory? MFA on L4 jump hosts is common; MFA on a legacy HMI may be impossible — document compensating controls (physical access, session recording).

Lena's identity review at ABP listed every account on HMI-1, the historian and eng-WS-1, with its owner and whether it was shared. The shared engineer password was the clearest finding and was replaced with named accounts. Where MFA could not be added to a legacy HMI, she recorded the compensating controls, such as locked control-room access and session recording on the jump host, and named who checks them.

19.2 Evidence hashing

Hash configuration exports and evidence files (SHA-256); store digests in the ticket. Re-hash later to detect tampering. Pair hashes with actor id and work-permit version.

Lena hashes every firewall export when it is collected and stores the digest in the ticket with the time, her account and the work-permit version. Later reviews re-hash the stored file and compare. A mismatch is investigated before the evidence is used, because a changed export could mean tampering, a careless edit or simply the wrong file. The manifest names the algorithm used.

19.3 Secrets

Engineering credentials live in a vault; short-lived checkouts; rotate at window end. No secrets in git, screenshots or chat. Service accounts for historians get unique passwords and monitored use.

Synthetic case — Ashford Batch Plant. A shared "engineer" password on eng-WS-1 was replaced with named accounts after CNHP's identity review. Checkout of the PLC project files now logs the person, not a mythic shared user.

At ABP, engineering credentials for PLC-A's project are checked out from the vault for one window and rotated afterwards.

19.4 Errors and limits

Hashes detect change, not malice versus accident. Pair them with access logs. Do not attempt to crack plant password hashes in this course.

A matching hash proves only that a file has not changed since it was hashed, not that it was collected lawfully or interpreted correctly. Lena pairs hash checks with the access log for the evidence store, which shows who touched each file and when. Password findings are reported from configuration and account lists; cracking hashes is outside the programme and outside any permit she holds.

Practice note

Break-glass accounts for plant emergencies need dual control to retrieve and automatic rotation after use. An unbroken break-glass password taped under a keyboard is not a control.

19.1b Certificates and break-glass

For TLS-facing historians and jump hosts, record presented certificates under authorization. Expired or mismatched certs are operations findings. Lena's certificate record lists, for each host, the subject, issuer, expiry date and date observed, so an expiring certificate on the historian replica becomes a dated ticket rather than a surprise outage. Prefer SHA-256 for evidence manifests; document the algorithm in the manifest.

Algorithm choices for manifests are a version field, not a silent swap mid-window. When the algorithm changes, existing manifests keep their original algorithm field and are re-hashed into a new manifest rather than edited.

Exercises

Synthesis

Read identity config; hash evidence; keep secrets in a vault.

Continue studying — chapter 19 of 50

← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →