Chapter 20 — OT, IoT and cyber-physical security: engineering context
Lesson map
Lesson 20 published. Map, example, EX058.
flowchart TD
N0["Learning outcomes"]
N1["20.1 Discipline map"]
N2["20.2 What we build"]
N3["20.3 Safety boundary"]
N4["Practice note"]
N5["20.1b Neighbouring courses and deliverables"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX058"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["20.1 Discipline map"]
N2["20.2 What we build"]
N3["20.3 Safety boundary"]
N4["Practice note"]
N5["20.1b Neighbouring courses and deliverables"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX058"]
[Learning outcomes]
|
v
[20.1 Discipline map]
|
v
[20.2 What we build]
|
v
[20.3 Safety boundary]
|
v
[Practice note]
|
v
[20.1b Neighbouring courses and deliverables]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX058]
Learning outcomes
You will (1) place OT security engineering among SP 800-82, ISA/IEC 62443 and ATT&CK for ICS; (2) define what this degree programme builds; (3) state the safety boundary for all later chapters.
20.1 Discipline map
NIST SP 800-82 guides ICS security. ISA/IEC 62443 structures zones, conduits and security levels. ATT&CK for ICS names adversary techniques for planning and coverage — not as a residual-risk score. Modbus specs define the protocol you allow-list. Academic surveys (Giraldo et al.; Urbina et al.) warn against detectors evaluated only on easy attacks. Engineers build the platforms and processes that make those sources operable under process-safety constraints.
Lena uses each source for what it is good at and cites the exact revision.
20.2 What we build
CNHP at Ashford Batch Plant is the running example: zoning, allow-lists, detectors with honest metrics, patch windows, evidence dossiers. Graduates design, verify and operate such programmes — they do not invent exploits against PLCs.
The programme's outputs are concrete: a zoned network with tested reachability, allow-lists enforced on Modbus traffic, detectors with published false-alarm intervals, a patch schedule with dated deferrals and a dossier an auditor can verify. Each later chapter adds one part of that system and shows how Lena built and checked it at ABP without endangering a batch.
20.3 Safety boundary
No exploit payloads, no unauthorized plant access, no live personal or proprietary batch data in labs, labs on synthetic local data only. Dual-use requests are refused (Chapter 10). Process safety stop conditions always win. Every CNHP design review in Chapters 21-50 checks the design against this boundary before it checks anything else.
Synthetic case — Ashford Batch Plant. Leadership asked for a red team that hacks the plant. Lena reframed the charter: an authorized hardening programme that enforces zones and measures detection without endangering batches.
Lena checks every design against this boundary.
20.4 Errors and limits
OT standards are revised part by part, so a link that worked for one CNHP document may point to a superseded part a term later. This chapter orients; it does not replace reading the primary sources.
Lena's list of sources records the revision and access date for each standard and paper used in CNHP documents. Before citing a framework in her thesis, she checks whether a newer revision exists and notes any change that affects her argument. She keeps a copy of each superseded revision she cited in the dossier, so a reader can see the text her argument relied on.
Practice note
Keep a one-page "sources we actually use" list in the CNHP binder with access dates. Examiners and auditors ask which revision of 62443 you meant; "the ISA one" is not an answer.
20.1b Neighbouring courses and deliverables
This engineering book assumes comfort with calculus, probability and software engineering from earlier chapters and applies them to the CNHP case at Ashford Batch Plant. The bachelor's OT book is broader; the technologist book emphasizes implementation drills. Operators need runbooks and tickets; engineers need schemas, tests and ADRs. Capstone grading looks for both. Each deliverable names its intended reader on its first page.
Lena's own deliverables at ABP include both kinds. Her runbooks and tickets serve the operators who run the plant each day, while the schemas, tests and decision records serve the engineers who will maintain the tools after her.
Exercises
- EX058 — Framework fit. Pair each need with SP 800-82 / 62443 / ATT&CK ICS / Modbus spec. Rubric: 3 = four sensible pairs; 2 = three; 1 = two; 0 = none.
- EX059 — Charter. Rewrite "hack the plant" as an engineering charter sentence. Rubric: 3 = authorization + hardening/measurement + safety; 2 = partial; 1 = still attack-centric; 0 = none.
- EX060 — Boundary. Three concrete out-of-scope items for this programme. Rubric: 3 = three clear; 2 = two; 1 = one; 0 = none.
Synthesis
Engineers enable authorized OT hardening; they do not replace process safety with cleverness.
Continue studying — chapter 20 of 50
← Chapter 19 (draft) · Course chapter index · Chapter 21 (draft) →