Chapter 24 — OT, IoT and cyber-physical security: methods I
Lesson map
Lesson 24 published. Map, example, EX070.
flowchart TD
N0["Learning outcomes"]
N1["24.1 Sequence"]
N2["24.2 Method cards"]
N3["24.3 Done means artefacts"]
N4["Practice note"]
N5["24.1b Quiet vs noisy and dependencies"]
N6["Field note — method freeze in practice"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX070"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["24.1 Sequence"]
N2["24.2 Method cards"]
N3["24.3 Done means artefacts"]
N4["Practice note"]
N5["24.1b Quiet vs noisy and dependencies"]
N6["Field note — method freeze in practice"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX070"]
[Learning outcomes]
|
v
[24.1 Sequence]
|
v
[24.2 Method cards]
|
v
[24.3 Done means artefacts]
|
v
[Practice note]
|
v
[24.1b Quiet vs noisy and dependencies]
|
v
[Field note — method freeze in practice]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX070]
Learning outcomes
You will (1) sequence work-permit to discovery to validation to reporting; (2) pick methods that match authorization and process risk; (3) define done for a method without writing to a PLC.
24.1 Sequence
Work permit first. Discovery enumerates assets and conduits by agreed methods. Validation confirms configuration issues with least privilege. Reporting delivers findings and evidence hashes. Skipping the permit is how unauthorized testing happens.
At ABP, every CNHP activity starts with a signed work permit naming units, methods, windows and stop conditions. Discovery uses passive capture and engineering project exports; validation uses configuration review and bench tests. Findings are reported with evidence hashes, and nothing moves to the next step until the previous one has produced its artefacts.
24.2 Method cards
Each card: name, purpose, privilege, noisy?, process impact, stop conditions, artefacts. Authenticated configuration review is a card; weaponised PLC exploit is not in this programme's deck.
Lena keeps ABP's method cards in the repository beside the work-permit template. A permit can only list methods that have a card, and each card states whether the method is noisy and what process impact it could have. Reviewers check the card's stop conditions against the permit, so a method cannot be used under weaker conditions than its card requires.
24.3 Done means artefacts
A method is done when inventory CSV, config hashes, finding drafts and coverage updates exist — not when someone feels finished.
Synthetic case — Ashford Batch Plant. Method card for serial allow-list verification requires listen-only mode, cycle-time stop at 50 ms, and a lab-style decision table as artefact.
Lena's checklist for each method lists its required artefacts. For serial allow-list verification at ABP, that means the decision table, the capture hash, any draft findings and the updated coverage board. A method with missing artefacts is reopened, not closed with a note promising them later. Lena checks the list at the end of each window.
24.4 Errors and limits
Copying someone else's method list without matching authorization is cargo-cult 62443.
A method list copied from another plant or a published guide may assume authorizations, equipment or process tolerances that ABP does not have. Lena adapts each method to ABP's own permit, writes a card for it and has the card reviewed by control engineering before it is used. A borrowed method without that review is treated as unauthorized, however reputable its source, and stays out of the permit until reviewed.
Practice note
Freeze methods during a window the same way you freeze conduits: new methods need the AUTH path, not while we were here we also tried.
24.1b Quiet vs noisy and dependencies
Quiet methods (listen-only decode, config export) fit more windows. Noisy methods need tighter rate limits and often off-peak hours. Encode method dependencies in the plan so reviews are not scheduled against an empty asset list. Lena's plan lists, for each method, the earlier methods whose artefacts it needs.
Method cards without a noisy field are how morning batch windows get congested. Noisy methods are booked against the batch schedule a week ahead, outside R-101's charge phase, and each booking names the trunk and its 50 ms cycle-time stop.
Lena schedules quiet methods first.
Field note — method freeze in practice
During ABP window W-17 a vendor asked to try an extra diagnostic function mid-shift. Lena parked the request in the next engagement's planning backlog and kept the method card frozen. The batch finished without unexplained traffic, and the diagnostic was evaluated the following month under a fresh work permit with its own stop conditions.
Exercises
- EX070 — Card. Write a method card for listen-only Modbus decode. Rubric: 3 = all fields filled safely; 2 = missing one; 1 = includes writes/exploits; 0 = none.
- EX071 — Sequence. What is wrong with discovery before a signed work permit? Rubric: 3 = unauthorized testing; 2 = process vague; 1 = bad order; 0 = none.
- EX072 — Done. List four artefacts that close a zoning review method. Rubric: 3 = four concrete; 2 = two; 1 = one; 0 = none.
Synthesis
Methods are authorized, carded and done when artefacts exist.
Continue studying — chapter 24 of 50
← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →