Chapter 27 — OT, IoT and cyber-physical security: control design
Lesson map
Lesson 27 published. Map, example, EX079.
flowchart TD
N0["Learning outcomes"]
N1["27.1 Three kinds"]
N2["27.2 Operator skill"]
N3["27.3 Compensation"]
N4["Practice note"]
N5["27.1b Ownership and break-glass detection"]
N6["Field note — control health day"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX079"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["27.1 Three kinds"]
N2["27.2 Operator skill"]
N3["27.3 Compensation"]
N4["Practice note"]
N5["27.1b Ownership and break-glass detection"]
N6["Field note — control health day"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX079"]
[Learning outcomes]
|
v
[27.1 Three kinds]
|
v
[27.2 Operator skill]
|
v
[27.3 Compensation]
|
v
[Practice note]
|
v
[27.1b Ownership and break-glass detection]
|
v
[Field note — control health day]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX079]
Learning outcomes
You will (1) design preventive, detective and corrective controls for CNHP; (2) bind controls to requirements; (3) avoid controls that require exploit skills to operate.
27.1 Three kinds
Preventive: allow-list before forward. Detective: alert on denied write codes. Corrective: auto-disable a compromised engineering account at window end. Each maps to a requirement id.
At ABP, the allow-list on the serial monitor is preventive, the alert when HMI-1 tries to write outside 40001 to 40010 is detective, and disabling temporary engineering accounts at the end of each window is corrective. Lena records the requirement id beside each control, so a reviewer can see which requirement fails if the control is removed or weakened.
27.2 Operator skill
CNHP controls are checked by the site's engineers during permitted windows, not by exploit specialists. A control that needs custom shellcode to verify is the wrong control for this programme.
Lena writes a runbook entry for each CNHP control describing how to check it with ordinary tools, such as replaying a synthetic frame on the bench and reading the decision log. If a control can only be verified by someone writing exploit code, she replaces it with one that can be checked safely by the site's own engineers during routine work.
27.3 Compensation
If a legacy PLC cannot enforce allow-lists, add detective monitoring and tighter human approval for engineering access. Document the compensation in the work permit.
"""Lab: Modbus function-code allow-list on synthetic, already-decoded requests (no network)."""
ALLOW = {("HMI-1", 3), ("HMI-1", 6), ("HIST-1", 3), ("HIST-1", 4)} # (source, function code)
WRITE_REGS = {("HMI-1", 6): range(40001, 40011)} # HMI may write setpoints only
reqs = [("HMI-1", 3, 40001), ("HMI-1", 6, 40003), ("HMI-1", 6, 40050),
("HIST-1", 3, 30001), ("HIST-1", 16, 40001), ("ENG-WS", 8, 0), ("HIST-1", 4, 30010)]
for src, fc, reg in reqs:
if (src, fc) not in ALLOW:
d = "BLOCK fc-not-allowed"
elif (src, fc) in WRITE_REGS and reg not in WRITE_REGS[(src, fc)]:
d = "BLOCK register-out-of-range"
else:
d = "PASS"
print(f"{src:7} fc={fc:2} reg={reg:5} -> {d}")
Expected output:
HMI-1 fc= 3 reg=40001 -> PASS
HMI-1 fc= 6 reg=40003 -> PASS
HMI-1 fc= 6 reg=40050 -> BLOCK register-out-of-range
HIST-1 fc= 3 reg=30001 -> PASS
HIST-1 fc=16 reg=40001 -> BLOCK fc-not-allowed
ENG-WS fc= 8 reg= 0 -> BLOCK fc-not-allowed
HIST-1 fc= 4 reg=30010 -> PASS
Synthetic case — Ashford Batch Plant. Writes outside 40001-40010 are denied — preventive gate with a detective event when someone tries.
At ABP, compensation is written into the work permit with an owner and a review date, so it is checked rather than assumed. For a legacy PLC that cannot enforce an allow-list, Lena pairs detective monitoring on its trunk with two-person approval for engineering access.
27.4 Errors and limits
Stacks of compensating controls without an owner become ignored alerts.
Lena's control register lists every compensating control at ABP with its owner, its alerts and the date it was last tested. A control found without an owner gets one before the next window, or it is removed from the register and its requirement is marked unmet. Controls that nobody watches are counted as missing, because their alerts will be ignored when they finally fire. Ownership is reviewed at each health day.
Practice note
Once a quarter, Lena books a control-health day on the bench: each preventive CNHP control is broken on synthetic traffic, and the matching monitor alert must fire. Untested controls are wishes.
27.1b Ownership and break-glass detection
Every CNHP control, such as the PLC-A trunk allow-list, has an owner who receives its alerts and a review date. Log when an operator uses break-glass to skip dual approval. Break-glass without detection is just a hidden single control. Weekly review of break-glass events is part of the control design, and each review names who used break-glass and the reason given.
Each control's register entry also states how it fails: whether a broken allow-list blocks traffic or passes it decides which detective alert must fire first; on PLC-A's trunk it is the policy-missing alert, which pages the window lead.
Field note — control health day
On the March health day the team deleted the allow-list on a bench monitor and confirmed the detective alert fired in 12 seconds. The preventive path denied writes immediately. One compensating control for a legacy PLC had no owner; it received one before the next window.
Exercises
- EX079 — Map. One preventive and one detective control for evidence tampering. Rubric: 3 = both; 2 = one; 1 = vague; 0 = none.
- EX080 — Operable. Why is verify by exploiting again a bad control? Rubric: 3 = dual-use + unstable + wrong skill; 2 = one reason; 1 = vague; 0 = defends it.
- EX081 — Lab. Which rule blocks HIST-1 fc=16? Rubric: 3 = fc-not-allowed; 2 = vague deny; 1 = wrong; 0 = none.
Synthesis
Controls are preventive/detective/corrective, owned, and operable without exploits.
Continue studying — chapter 27 of 50
← Chapter 26 (draft) · Course chapter index · Chapter 28 (draft) →