Chapter 22 — OT, IoT and cyber-physical security: system and data models
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 Entities"]
N2["22.2 Keys"]
N3["22.3 Forbidden attributes"]
N4["Practice note"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 Entities"]
N2["22.2 Keys"]
N3["22.3 Forbidden attributes"]
N4["Practice note"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 Entities]
|
v
[22.2 Keys]
|
v
[22.3 Forbidden attributes]
|
v
[Practice note]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) draw an entity model for assets, zones, conduits and findings; (2) choose keys and cardinality; (3) keep exploit content out of the model.
22.1 Entities
Plant 1—* Unit; Unit 1—* Asset; Zone 1—* Asset; Conduit — Zone (from/to); Finding — EvidenceObject (by hash); TechniqueTag — Finding. Cardinality mistakes (many active conduit sets without a version pointer) cause auditors to ask which rules were live.
Lena's model gives each ConduitSet a version and records which version was live at any time, so an auditor can see the rules that applied on a given day. Each Finding links to its evidence by hash, and technique tags link to findings only after review.
22.2 Keys
Finding ids are UUID. Evidence is content-addressed by SHA-256. ConduitSet has (plant_id, version_int). Never key findings by title — titles change.
Lena's schema uses these keys throughout CNHP. A finding about FW-12 kept its identifier when its title was reworded after review, and its history stayed intact. Evidence keyed by its hash cannot be silently replaced, since a different file would have a different key. The ConduitSet version number increases with every published change and never reuses an old value.
22.3 Forbidden attributes
No attribute for payload, shellcode or step-by-step attack. For a capture from the L2 monitor, EvidenceObject keeps the bytes in a sealed bucket; the model holds only hash, media type and retention class.
Synthetic case — Ashford Batch Plant. An early schema had notes as free text; people pasted engineering passwords. Lena replaced it with structured fields plus an evidence hash, and a linter rejects password-like strings in titles.
Lena's linter enforces the list. It runs on every record created or imported, including bulk imports from scanners, and rejects password-like strings in titles. Rejected records return an error explaining which field was refused.
22.4 Errors and limits
Models that force every ATT&CK for ICS technique as mandatory fields generate junk tags. Keep technique tags optional and reviewed.
At ABP, technique tags are added by an analyst after the finding is written, and a second person reviews them. A finding with no fitting technique is left untagged rather than forced into the nearest one. This keeps coverage figures honest, because a junk tag would count as observed coverage for a technique nobody really tested. Tags are reviewed when the ATT&CK for ICS version changes.
Practice note
Soft-delete findings with actor and reason; hard purge only via retention jobs that emit audit events. Silent DELETE FROM findings is a repudiation gift.
22.1b Attachment limits and time
Evidence objects need size caps and media-type allow-lists. Unbounded uploads become availability attacks and tempt dumping of bulk proprietary data. Every mutable CNHP entity, from a finding to a conduit record, needs created_at, created_by, and for state changes updated_at/updated_by or an append-only event. Prefer UTC with explicit offsets in exports.
Exports state their time zone once in the file header as well as in each timestamp. API clients that issue DELETE in a loop during a buggy retry get credentials revoked after a threshold.
22.5 Worked example — modelling a finding without leaking the plant (synthetic ABP)
Lena's data model for CNHP findings has entities Asset, Zone, Conduit, Finding and Evidence. A Finding references an Asset by key, never embeds its IP address or credentials, and stores evidence as a hash plus a pointer to the controlled evidence store. The forbidden-attribute list (passwords, full packet payloads, recipe values) is enforced by a schema check that rejects any record containing those fields. When a finding about PLC-A's open Modbus port is exported for management, it reads "Asset PLC-A, Conduit L2→L1, ATT&CK for ICS T0869 Standard Application Layer Protocol, severity high" — enough to act on, not enough to attack with.
Exercises
- EX064 — Cardinality. Why is ConduitSet versioned instead of edited in place? Rubric: 3 = audit of what was authorized when; 2 = vague versioning; 1 = best practice; 0 = none.
- EX065 — Key. Why content-address evidence? Rubric: 3 = integrity + dedup + tamper evidence; 2 = one reason; 1 = vague; 0 = none.
- EX066 — Forbidden. Validation that stops passwords in title. Rubric: 3 = heuristic/linter + process; 2 = one; 1 = vague; 0 = none.
Synthesis
Model assets, zones, versions, findings and hashes — not attacks.
Continue studying — chapter 22 of 50
← Chapter 21 (draft) · Course chapter index · Chapter 23 (draft) →