Chapter 2 — Discrete mathematics

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Graphs of conduits"]
  N2["2.2 Reachability"]
  N3["2.3 Monotonicity proof"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Graphs of conduits"]
  N2["2.2 Reachability"]
  N3["2.3 Monotonicity proof"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 Graphs of conduits]
    |
    v
[2.2 Reachability]
    |
    v
[2.3 Monotonicity proof]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) represent an OT network as a directed graph; (2) compute reachability between Purdue levels; (3) prove that removing an edge cannot add a path.

2.1 Graphs of conduits

In ISA/IEC 62443 vocabulary, zones are groups of assets with common security requirements and conduits are the permitted communication paths between them. A directed graph models this exactly: nodes are zones (L4 office, L3.5 DMZ, L3 historian, L2 SCADA, L1 PLC, L1 SIS, L0 I/O) and an edge a→b means a can initiate traffic to b. Asking "can the office network write to the safety system?" becomes "is L1-SIS reachable from L4?".

Lena builds ABP's graph from the firewall export, not from the network diagram, because the export is what is enforced.

2.2 Reachability

Depth-first search computes the set of nodes reachable from a start node in time proportional to nodes plus edges. Reachability is transitive: if L4→L3 and L3→L2 and L2→L1-SIS, then L4 reaches SIS even with no direct rule. Firewall reviews that check rules one at a time miss exactly this composition, which is why engineers compute closure rather than reading rule lists.

Lena runs the search from every zone, not only the office, and keeps the result as a table that the next review can compare against.

2.3 Monotonicity proof

Claim: deleting an edge never enlarges a reachable set. Proof: any path in the smaller graph uses only edges that also exist in the larger graph, so every node reachable after deletion was reachable before. The practical rule follows: rule removals can be approved quickly; rule additions need analysis, because they can create new transitive paths.

# Lab 23 - reachability count on a synthetic Purdue-layered OT network
# Nodes: L5-ERP, L4-Office, L3.5-DMZ, L3-Hist, L2-SCADA, L1-PLC, L1-SIS, L0-IO
edges_flat=[("L5","L4"),("L4","L3"),("L3","L2"),("L2","L1-PLC"),("L2","L1-SIS"),("L1-PLC","L0"),("L1-SIS","L0"),("L4","L2")]
edges_zoned=[("L5","L4"),("L4","L3.5"),("L3.5","L3"),("L3","L2"),("L2","L1-PLC"),("L1-SIS","L0"),("L1-PLC","L0")]  # SIS not reachable from SCADA
def reach(edges, start):
    g={};
    for a,b in edges: g.setdefault(a,[]).append(b)
    seen=set(); stack=[start]
    while stack:
        n=stack.pop()
        if n in seen: continue
        seen.add(n); stack.extend(g.get(n,[]))
    return seen
for name,e in (("flat",edges_flat),("zoned",edges_zoned)):
    r=reach(e,"L4")
    print(f"{name}: L4 reaches {sorted(r)} count={len(r)} writes_to_SIS={'L1-SIS' in r}")

Expected output:

flat: L4 reaches ['L0', 'L1-PLC', 'L1-SIS', 'L2', 'L3', 'L4'] count=6 writes_to_SIS=True
zoned: L4 reaches ['L0', 'L1-PLC', 'L2', 'L3', 'L3.5', 'L4'] count=6 writes_to_SIS=False

Synthetic case — Ashford Batch Plant. ABP's original network had a convenience rule L4→L2 for remote HMI viewing. The reachability lab shows that in the flat design the office zone reaches L1-SIS; in the zoned design with a DMZ and no SCADA→SIS conduit, it does not.

2.4 Errors and limits

Graphs model permitted initiation, not actual traffic or vulnerabilities. Bidirectional protocols and remote-access tools can create hidden reverse edges; inventory them explicitly.

Lena adds a remote-access tool used by a vendor as an explicit edge from outside the plant into L2, since its sessions are initiated outward but carry commands inward. Without that edge, the graph would show the office cut off from SCADA while a support session could still reach it. Each such edge is listed with its owner and the record that justifies it, and the graph is rebuilt after any change to remote-access tooling or vendor contracts.

Exercises

• EX004 — Closure. Edges: A→B, B→C, C→D, B→E. List all nodes reachable from A. Rubric: 3 = {A,B,C,D,E}; 2 = one missing; 1 = direct only; 0 = none.
• EX005 — Proof use. Explain in two sentences why adding L3→L1-SIS needs more review than removing L4→L2. Rubric: 3 = addition can create new transitive paths, removal cannot (monotonicity); 2 = intuition only; 1 = vague; 0 = wrong.
• EX006 — Lab. Which single edge in the flat design gives L4 its path to L1-SIS? Rubric: 3 = L2→L1-SIS (with L4→L2 or L4→L3→L2 upstream); 2 = names L4→L2 only; 1 = vague; 0 = wrong.

Synthesis

Zones and conduits are a graph; reachability, not rule-by-rule reading, answers who can touch the safety system.

Continue studying — chapter 02 of 50

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →