Chapter 26 — OT, IoT and cyber-physical security: architecture alternatives | Engineering OT, IoT and cyber-physical security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 26 — OT, IoT and cyber-physical security: architecture alternatives

Lesson map

Lesson 26 published. Map, example, EX076.

flowchart TD
  N0["Learning outcomes"]
  N1["26.1 Alternatives"]
  N2["26.2 Criteria"]
  N3["26.3 Decision"]
  N4["Practice note"]
  N5["26.1b Cost, skills and revisit triggers"]
  N6["Field note — skill assumptions"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX076"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["26.1 Alternatives"]
  N2["26.2 Criteria"]
  N3["26.3 Decision"]
  N4["Practice note"]
  N5["26.1b Cost, skills and revisit triggers"]
  N6["Field note — skill assumptions"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX076"]

[Learning outcomes]
    |
    v
[26.1 Alternatives]
    |
    v
[26.2 Criteria]
    |
    v
[26.3 Decision]
    |
    v
[Practice note]
    |
    v
[26.1b Cost, skills and revisit triggers]
    |
    v
[Field note — skill assumptions]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX076]

Learning outcomes

You will (1) compare on-prem monitors vs cloud analytics for OT data; (2) evaluate against residency and process-safety constraints; (3) pick an alternative with explicit rejection of the others.

26.1 Alternatives

A: on-prem serial/IP monitors with local detectors. B: on-prem collection with site historian analytics. C: cloud analytics SaaS receiving process values. Each serves different constraints.

Lena describes each option for ABP in the same structure: where process data goes, who operates it, how it fails and what it costs. Option C would send process values off site, which immediately raises data-residency and recipe-confidentiality questions. Options A and B keep data on site but differ in how quickly they can enforce decisions on the write path.

26.2 Criteria

Process safety independence, data residency, fail-closed behaviour, operability by the site team, cost. Weight safety and residency above novelty.

Lena agrees the weights with the process-safety engineer and the plant manager before scoring. Safety independence and data residency carry the most weight because a failure there cannot be undone by later fixes. Each option is scored with evidence, and options that fail a safety criterion are rejected regardless of their other scores. The weights are published in the analysis so reviewers can challenge them.

26.3 Decision

ABP rejected C because recipe-adjacent trends must not leave the site without a board-level exception. Chose A for write-path enforcement with B for longer-term detection research on replicas.

Synthetic case — Ashford Batch Plant. A vendor demo of C looked slick; counsel and process safety blocked unrestricted upload. ADR-011 records the rejection.

ADR-011 records this decision. The reasons are short: option A enforces decisions locally on the write path and can be run by site engineers; option B adds detection research but needs skills the night shift lacks, so it is kept for daytime work on replicas. Option C remains rejected until residency rules change, which is its recorded revisit trigger.

26.4 Errors and limits

Alternatives analysis that ignores the work permit's data clauses is theatre.

At ABP, the permit's data clauses forbid process values leaving the site without a board-level exception, so option C failed before any technical comparison. Lena records that constraint at the top of the analysis, so readers see why C was rejected without reading the scoring. An analysis that had scored C highly while ignoring the permit would have wasted the board's time and might have pressured someone into granting an exception.

Practice note

Document the skills each alternative demands. A cloud pipeline nobody on site can operate fails open socially even if it fails closed technically.

26.1b Cost, skills and revisit triggers

Include rough annual cost and the skills each alternative demands. An option that needs six FTEs to operate fail-closed is not free. End alternatives analysis with a decision, rejected options with reasons, and a revisit trigger (reopen if residency law changes).

Switching costs matter: a monolith that already exports signed allow-lists can grow into services; a SaaS contract with residency exceptions is harder to unwind mid-incident. Prefer options that keep an offline escape hatch for deny/allow.

ADR-011 states its revisit trigger.

Field note — skill assumptions

Option B's analytics path assumed a site engineer who understood event ordering. ABP did not have that person on nights. Until hiring caught up, Lena kept write-path enforcement on option A and limited B to daytime research on replicas. Architecture that assumes unavailable skills fails open socially.

Exercises

EX076 — Criterion. Add one criterion for SIS data and score A/B/C. Rubric: 3 = sensible criterion + scores; 2 = criterion; 1 = vague; 0 = none.
EX077 — Reject C. Rejection sentence with residency/safety reason. Rubric: 3 = clear; 2 = partial; 1 = cost only; 0 = accepts C.
EX078 — Fallback. When is pure local A the right runtime? Rubric: 3 = WAN outage / isolation drill; 2 = vague; 1 = always; 0 = never.

Synthesis

Choose architecture against weighted constraints; record rejected options.

Continue studying — chapter 26 of 50

← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →