Chapter 23 — OT, IoT and cyber-physical security: threat and failure analysis
Lesson map
Lesson 23 published. Map, example, EX067.
flowchart TD
N0["Learning outcomes"]
N1["23.1 The programme can fail dangerously"]
N2["23.2 STRIDE on CNHP tools"]
N3["23.3 Plant threats stay in hazard analysis"]
N4["Practice note"]
N5["23.1b Abuse vs misuse and backlog"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX067"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["23.1 The programme can fail dangerously"]
N2["23.2 STRIDE on CNHP tools"]
N3["23.3 Plant threats stay in hazard analysis"]
N4["Practice note"]
N5["23.1b Abuse vs misuse and backlog"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX067"]
[Learning outcomes]
|
v
[23.1 The programme can fail dangerously]
|
v
[23.2 STRIDE on CNHP tools]
|
v
[23.3 Plant threats stay in hazard analysis]
|
v
[Practice note]
|
v
[23.1b Abuse vs misuse and backlog]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX067]
Learning outcomes
You will (1) enumerate failures of the OT security programme itself; (2) use a lightweight STRIDE-on-tools pass; (3) feed results into requirements without building exploit modules.
23.1 The programme can fail dangerously
Allow-lists failing open, reachability CI skipped, detectors with silent false-alarm storms, patch deferrals without dates — these threaten process safety and honesty, not only confidentiality of a tool.
Lena lists these failures first in CNHP's threat analysis because they could harm the plant through the tools meant to protect it. A monitor that fails open would let unauthorized writes reach PLC-A while everyone believed they were blocked. A reachability check skipped in continuous integration would let a new conduit to SIS-B merge unseen. Each failure gets a requirement and a test.
23.2 STRIDE on CNHP tools
Spoofing: fake engineering account. Tampering: edit firewall export after seal. Repudiation: no actor on deny events. Information disclosure: historian replica world-readable. Denial of service: scanner floods a trunk. Elevation: one person can publish a conduit to SIS. Each row gets a mitigation requirement.
Lena runs the analysis on each CNHP tool and records rows in the backlog with owners. For ABP, the most serious rows were the monitor failing open and one person publishing a conduit to SIS-B; they became requirement S-1 and the dual-approval gate on conduit changes. Each row is reviewed again when its mitigation ships.
23.3 Plant threats stay in hazard analysis
Threats to the process belong in the plant's process hazard analysis and cyber-informed HAZOP, not as features of a student tool. Do not build automated exploitation to satisfy a STRIDE row.
# Lab 27 - residual CUSUM vs band on batch reactor level (synthetic)
import random
def run(seed, atk, det, k=0.8, h=6.0):
rng=random.Random(seed); true=est=50.0; s=0.0; alarm=None
for t in range(500):
inflow=1.0+rng.gauss(0,0.05)+(0.08 if atk and t>=250 else 0)
true+=inflow-0.02*true
lvl=true+rng.gauss(0,0.3); fm=inflow+rng.gauss(0,0.02)
if atk and t>=250: lvl=50+rng.gauss(0,0.3)
if atk=="B" and t>=250: fm=1.0+rng.gauss(0,0.02)
est+=fm-0.02*est
hit=abs(lvl-50)>2.0 if det=="band" else False
if det=="cusum":
s=max(0.0,s+abs(lvl-est)-k); hit=s>h
if hit and alarm is None: alarm=t
return alarm
for det in ("band","cusum"):
fa=sum(run(i,None,det) is not None for i in range(60))
for atk in ("A","B"):
hits=[a-250 for a in (run(i,atk,det) for i in range(60)) if a is not None and a>=250]
print(f"{det} class{atk} FA={fa}/60 det={len(hits)}/60 mean_delay={sum(hits)/len(hits) if hits else float('nan'):.1f}")
Expected output:
band classA FA=0/60 det=0/60 mean_delay=nan
band classB FA=0/60 det=0/60 mean_delay=nan
cusum classA FA=0/60 det=60/60 mean_delay=24.8
cusum classB FA=0/60 det=0/60 mean_delay=nan
Synthetic case — Ashford Batch Plant. STRIDE row fail open became safety requirement S-1. Row solo conduit publish became the dual-approval gate.
Lena passes plant threats to the process-safety engineer for the hazard analysis. She supplies facts about the tools and network, such as which zones can reach PLC-A, and the engineer judges the process consequences. Nothing in CNHP's tools simulates an attack on the process.
23.4 Errors and limits
STRIDE is a prompt, not a proof. Revisit when adding a new trust boundary (for example a vendor SaaS historian).
Lena repeats the analysis whenever CNHP adds a trust boundary, such as a new remote-access path for a vendor or a change to where alerts are sent. The rows from earlier reviews are kept, so the team can see which threats were added, which mitigations were built and which remain open. A STRIDE table never proves a tool safe; tests and reviews do that.
Practice note
Include jumphost compromised in the model: short-lived credentials, egress allow-lists, rapid revocation. If the response is only trust the jumphost, the analysis is incomplete.
23.1b Abuse vs misuse and backlog
Abuse cases are intentional adversary actions against CNHP tools. Misuse cases are honest engineers making dangerous mistakes, such as typing a set-point range wider than the recipe allows. Design controls for both. STRIDE rows become issues with links to requirements. Misuse rows usually become validation rules; abuse rows usually become access controls.
Feeding the backlog means each STRIDE row has an owner and a due date. At ABP, the misuse case of an engineer pasting a partner's CIDR into the conduit file became a validation rule that rejects ranges outside the plant's address plan.
Both kinds feed the backlog.
Exercises
- EX067 — Fail open. One test that proves fail-closed. Rubric: 3 = remove policy, expect deny+alert; 2 = idea; 1 = vague; 0 = none.
- EX068 — STRIDE. Mitigation for repudiation on deny events. Rubric: 3 = authenticated actor + immutable log; 2 = logging only; 1 = vague; 0 = none.
- EX069 — Boundary. Why doesn't programme STRIDE justify an exploit module? Rubric: 3 = different goal/safety boundary; 2 = partial; 1 = justifies it; 0 = none.
Synthesis
Analyse how your programme can hurt the plant or lie; mitigate those first.
Continue studying — chapter 23 of 50
← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →