◇ OpenCyber Academy
Master's · Chapter 2 · English

Chapter 2 — OT, IoT and cyber-physical security: advanced seminar

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — OT, IoT and cyber-physical security: advanced seminar

Lesson map

Lesson 02 published. Map, example, EX008.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["2.1 Architecture: Purdue and zones"]
  N2["2.2 Protocols"]
  N3["2.3 Detection families"]
  N4["2.4 Threat evidence"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX008"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["2.1 Architecture: Purdue and zones"]
  N2["2.2 Protocols"]
  N3["2.3 Detection families"]
  N4["2.4 Threat evidence"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX008"]

[Learning outcomes and connection]
    |
    v
[2.1 Architecture: Purdue and zones]
    |
    v
[2.2 Protocols]
    |
    v
[2.3 Detection families]
    |
    v
[2.4 Threat evidence]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX008]

Learning outcomes and connection

After this chapter you can (1) explain Purdue levels and ISA/IEC 62443 zones, (2) describe why classic industrial protocols lack authentication, (3) contrast network and physics-based detection, (4) read ATT&CK for ICS as capability evidence not frequency evidence, and (5) extract a falsifiable gap from a literature map.

2.1 Architecture: Purdue and zones

NIST SP 800-82 Rev. 3 presents the Purdue model: levels 0–1 (process and basic control), 2 (supervisory), 3 (operations), 4–5 (enterprise), with an industrial DMZ. ISA/IEC 62443-3-2 asks you to partition into zones with a target security level and to control conduits between them. A dissertation can treat a zone design as a hypothesis: does a conduit that permits only Modbus reads from level 2 to level 1 reduce write reachability by a measured fraction in a synthetic topology?

For Harbor Loop the relevant boundary sits between the supervisory level and the PLC, where Modbus/TCP carries both reads and writes. Draw that boundary in the dissertation even though the study measures detection rather than segmentation, because a reader needs to know which attacker positions the replay assumes. A conduit that blocks writes does not stop replayed reads, which is why detection still matters.

2.2 Protocols

The Modbus Application Protocol defines function codes (including write single/multiple registers) and a data model but no authentication or integrity fields. DNP3 Secure Authentication and OPC UA security models show that the industry has added options; adoption and implementation quality remain empirical questions. Never present "Modbus is insecure" as a finding — it is a design property of the specification.

For the Harbor Loop study the relevant property is that a reply carrying a level value has no field that proves it came from the transmitter. That is why replay is possible at all, and why the dissertation measures detection rather than prevention. Name the function codes your attacker model uses, so a reader can see which parts of the specification the results depend on.

2.3 Detection families

Network detectors watch packets; physics-based detectors watch whether sensor and actuator values obey process laws. Giraldo et al. surveyed the latter; Urbina et al. argued for measuring impact under a stealthy adversary. Sommer and Paxson warned that anomaly detection fails when "normal" is open; Arp et al. listed evaluation pitfalls including point-adjusted scoring.

Harbor Loop sits in the second family: its residual CUSUM compares the level reading with an estimate driven by the flow meter. The warnings from both papers apply directly. Normal operation in a water loop is fairly closed, which helps, but scoring must use attack episodes rather than points, and the evaluation must ask what a stealthy adversary could still do. Class B is that question.

2.4 Threat evidence

MITRE ATT&CK for ICS lists techniques such as Modify Parameter and Spoof Reporting Message. Public reporting of Stuxnet, the 2015 Ukrainian outages and TRITON/TRISIS shows that manipulation of view and targeting of safety systems are documented adversary goals. Use these at the level of the cited public analyses; do not invent operational detail.

For the dissertation this evidence supports one sentence: manipulating what operators see is a documented adversary goal, so testing detection of a replayed level reading is relevant. It does not support claims about how often water utilities face replay. Keep the citation to the technique and the public analysis, and keep frequency claims out of the background chapter.

2.5 Worked example: coding a gap

From twelve synthetic studies L1–L12, only two report impact at detection, only one freezes thresholds before a second context, and none combine detector-aware adversary + frozen thresholds + impact + second plant. Gap: No evaluation of residual detection against sensor replay reports event recall, delay and overfill-at-alarm with frozen thresholds on two contexts and an explicit two-sensor attacker class.

Write the gap as a single sentence that names what is missing, then check each word against the coded table. If one study did combine frozen thresholds and a second plant, the gap shrinks and the sentence must change. A gap built from a coding table can be audited; a gap built from impressions of the field cannot.

2.6 Common errors and limits

Citing standards as evidence they work; treating ATT&CK as base rates; claiming novelty from a new dataset name.

These errors share a pattern: they mistake the existence of a document for evidence of an effect. A standard says what should be done; it does not show that doing it reduces harm. ATT&CK lists what adversaries have been seen doing, not how often. A new dataset is useful, but novelty must come from the question it lets you answer.

Exercises — chapter 2

Chapter synthesis

The seminar gives you architecture, protocols, detection families and threat evidence — and the discipline to turn them into hypotheses and gaps rather than slogans.

Continue studying — chapter 02 of 08

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →