Chapter 5 — Engineering communication | Engineering OT, IoT and cyber-physical security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Engineering communication

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Three audiences"]
  N2["5.2 Bounded consequences"]
  N3["5.3 Structure of a short report"]
  N4["5.3b Words to avoid and words to use"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Three audiences"]
  N2["5.2 Bounded consequences"]
  N3["5.3 Structure of a short report"]
  N4["5.3b Words to avoid and words to use"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Three audiences]
    |
    v
[5.2 Bounded consequences]
    |
    v
[5.3 Structure of a short report]
    |
    v
[5.3b Words to avoid and words to use]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) write OT security findings that operators and safety engineers can act on; (2) separate observation, consequence and recommendation; (3) avoid alarmist or unbounded language.

5.1 Three audiences

A control-room operator needs to know what to watch for. A process-safety engineer needs to know whether a safety function is affected. A manager needs cost and downtime. One finding can serve all three if it states: asset and zone; what was observed and how; the plausible process consequence; the safety-layer status; the fix and the maintenance window needed.

Lena writes each finding once, in that order, so each reader finds their part quickly. A finding missing any of these parts goes back to its author before review.

5.2 Bounded consequences

"An attacker could blow up the plant" is neither true nor useful. A bounded statement reads: "A station on L2 can write setpoint registers on PLC-A without authentication. A setpoint change on T-1 level could overfill the tank in roughly 40 minutes; the independent high-high trip on SIS-B would stop the feed pump before overflow." This names the path, the time, and the protective layer that still holds.

Lena checks every bounded statement with the process-safety engineer before it is sent, since the minutes to overflow and the trip that holds come from the safety analysis, not from the security team.

5.3 Structure of a short report

Summary (three sentences); scope and method; findings ordered by consequence; residual risk with protective layers named; appendix with evidence references. Diagrams of zones are worth more than pages of rule tables.

Lena's reports for CNHP fit on two pages plus the appendix. The summary names the most serious finding and whether any safety function is affected. Each finding cites its evidence by hash and states the maintenance window needed for the fix, so planners can schedule it. A zone diagram with the affected conduit highlighted usually explains the finding faster than the text.

5.3b Words to avoid and words to use

Avoid "trivial", "catastrophic" and "fully compromised": none can be checked. Use measured quantities — minutes to overflow, number of reachable zones, protective layers intact — and name the evidence. A safety engineer will trust a finding that says "SIS-B remains independent" far more than one that says "everything is at risk".

Synthetic case — Ashford Batch Plant. Lena's first draft of a finding said the SCADA network was "totally insecure". The review version: "Remote-viewing rule L4→L2 allows office hosts to reach SCADA servers (rule FW-12, observed in configuration export 3 March). Recommend removal; viewing via the DMZ historian replica instead. Downtime: none."

5.4 Errors and limits

Never include working attack procedures in reports; reference the evidence store. Do not claim a safety consequence without the safety engineer's review.

Evidence such as configuration exports stays in the sealed store, and the report cites it by hash, so anyone with access can verify it without the report carrying sensitive detail. Lena sends every finding that mentions SIS-B or a trip to the process-safety engineer for review before release, and records the reviewer's name in the report. A consequence the engineer has not confirmed is written as a question, not a claim.

Exercises

EX013 — Rewrite. Rewrite "the PLC can be hacked" as a bounded finding sentence for PLC-A. Rubric: 3 = path, zone, observation, consequence bound, protective layer; 2 = one missing; 1 = still vague; 0 = unchanged.
EX014 — Audience. For the FW-12 finding, write one sentence each for operator, safety engineer and manager. Rubric: 3 = three tailored sentences; 2 = two; 1 = one; 0 = none.
EX015 — Residual risk. After FW-12 removal, state one residual risk honestly. Rubric: 3 = specific remaining path (e.g. engineering workstation, vendor remote access) and its control; 2 = generic; 1 = "none"; 0 = none.

Synthesis

Good OT findings are bounded, name protective layers and give each audience what it needs to decide.

Continue studying — chapter 05 of 50

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →