◇ OpenCyber Academy
Engineering · Chapter 42 · English

Chapter 42 — OT, IoT and cyber-physical security: applied research

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 42 — OT, IoT and cyber-physical security: applied research

Lesson map

Lesson 42 published. Map, example, EX124.

flowchart TD
  N0["Learning outcomes"]
  N1["42.1 Questions that fit"]
  N2["42.2 Design"]
  N3["42.3 Disclosure"]
  N4["Practice note"]
  N5["42.1b Data sharing and negative results"]
  N6["Field note — amendment log"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX124"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["42.1 Questions that fit"]
  N2["42.2 Design"]
  N3["42.3 Disclosure"]
  N4["Practice note"]
  N5["42.1b Data sharing and negative results"]
  N6["Field note — amendment log"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX124"]

[Learning outcomes]
    |
    v
[42.1 Questions that fit]
    |
    v
[42.2 Design]
    |
    v
[42.3 Disclosure]
    |
    v
[Practice note]
    |
    v
[42.1b Data sharing and negative results]
    |
    v
[Field note — amendment log]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX124]

Learning outcomes

You will (1) frame a research question about OT security programmes; (2) choose measures and baselines with detector-evaluation hygiene; (3) keep dual-use out of student research.

42.1 Questions that fit

Does dual-approval reduce conduit-widen incidents? Does showing denominators change stakeholder interpretation of coverage? Not new bypass against PLC brand X.

Lena's applied research at ABP followed this pattern: she chose a question about detector baselines, set out in the worked example below. The question could be answered with recorded traffic and would directly change how the plant configures its monitor. She declined a suggestion to study bypasses against a particular PLC brand, because that would produce attack knowledge without improving how ABP runs its defences.

42.2 Design

Pre-register measures; use synthetic or consented operational data; report intervals and attack classes (Urbina et al.; Giraldo et al.). Replication beats novelty theatre.

Lena registered her measures, baseline lengths and threshold before analysing ABP's 60 days of recorded traffic. Her amendment log holds the one change she made after registration, with its reason. Results are reported with intervals for each baseline length, so readers can see where the evidence is weak. She would rather confirm an earlier finding carefully than claim a new one that nobody can reproduce.

42.3 Disclosure

If research accidentally finds a live issue in a PLC or a vendor tool, follow coordinated disclosure with the vendor and the plant — not a class blog.

Synthetic case — Ashford Batch Plant. Lena's applied study measured how many days of baseline a new-conduit detector needs before its false alerts fall below one per week (§42.5); pre-registered, synthetic+anonymized.

Lena's research plan named the vendor's product security team as the first contact for any flaw found in a product, and it set publication only after the vendor responded. The thesis would describe a fault only in general terms. Her supervisor reviewed the plan before any traffic was analysed.

42.4 Errors and limits

Course projects are not human-subjects work; avoid collecting personal operator data.

Lena's research at ABP used traffic between devices, not records of what individual operators did, so no person could be identified from her data. Where operator actions appeared in logs, such as acknowledgements on HMI-1, she removed user names before analysis. Studying people properly needs ethics review that a course project does not have, so any question about operator behaviour is left for future work with the appropriate approvals rather than answered with data collected informally.

Practice note

Lena's preregistered analysis code lives in the CNHP repo with a freeze commit made before the first pilot capture. Amending after peeking requires a logged amendment.

42.1b Data sharing and negative results

Even synthetic-plus-anonymized metrics from a plant's monitor need a written agreement with the host before they enter a student thesis. Publishable applied research includes negative results. Hiding negatives biases the next cohort toward empty confidence.

The thesis ethics section states the dual-use boundary with a concrete refusal, such as declining to publish the register addresses an attacker would need on PLC-A.

Lena's host agreement for ABP's data was signed before analysis, and her thesis reports the baseline lengths that never reached the threshold with full figures.

Field note — amendment log

After peeking at pilot data, a student wanted to change the primary measure. The amendment log recorded the reason and kept the original measure as a secondary analysis. Pre-registration without amendment discipline is theatre.

The agreement names who may see the raw extracts and when they are deleted.

Each amendment entry carries the date, the reason and the commit that changed the analysis code.

42.5 Worked example — a research question that fits the plant (synthetic ABP)

Lena's applied research asks: on ABP's recorded traffic, how many days of baseline are needed before a new-conduit detector's false alerts fall below one per week? The design uses 60 days of synthetic-but-realistic traffic, sliding baselines of 3, 7, 14 and 28 days, and a pre-registered threshold. The amendment log records one change: an ERP upgrade added traffic on day 33, so that day is analysed separately rather than silently removed. Disclosure planning is part of the design: if the work reveals a product flaw, it goes to the vendor's PSIRT before publication.

Exercises

Synthesis

Research the programme and process; leave weaponization alone.

Continue studying — chapter 42 of 50

← Chapter 41 (draft) · Course chapter index · Chapter 43 (draft) →