Chapter 6 — Critical infrastructure and sector security: controlled evaluation | Postgraduate Critical infrastructure and sector security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 06 published. Map, example, EX026.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["6.1 Why evaluate under control"]
  N2["6.2 Detection: rates, families and intervals"]
  N3["6.3 False-alarm burden"]
  N4["6.4 Drills and exercises"]
  N5["6.5 Safe test design and rules of engagement"]
  N6["6.7 Practical activity: what the evaluation shows"]
  N7["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX026"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["6.1 Why evaluate under control"]
  N2["6.2 Detection: rates, families and intervals"]
  N3["6.3 False-alarm burden"]
  N4["6.4 Drills and exercises"]
  N5["6.5 Safe test design and rules of engagement"]
  N6["6.7 Practical activity: what the evaluation shows"]
  N7["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX026"]

[Learning outcomes and connection]
    |
    v
[6.1 Why evaluate under control]
    |
    v
[6.2 Detection: rates, families and intervals]
    |
    v
[6.3 False-alarm burden]
    |
    v
[6.4 Drills and exercises]
    |
    v
[6.5 Safe test design and rules of engagement]
    |
    v
[6.7 Practical activity: what the evaluation shows]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX026]

Learning outcomes and connection

After this chapter you should be able to:

Plan a controlled evaluation of a security control — a detection rule, a design, a recovery procedure — that answers a stated question safely.
Report detection and success rates with intervals, and calculate how many trials a claim needs.
Measure false-alarm burden in the units operators experience.
Evaluate drills and exercises with paired comparisons and recognize threats to their validity.
Write rules of engagement and safety conditions for tests near operating plant.

Chapter 5 chose designs; Chapter 2 graded evidence that controls exist. This chapter asks whether they work, by how much, and how sure we can be — before a real incident answers the question for us. Chapter 11 extends the method to evaluating a whole project.

6.1 Why evaluate under control

Security controls in essential services are rarely exercised by real attacks, so their effectiveness is usually assumed. Controlled evaluation creates the evidence deliberately: inject known events and see whether they are detected; run a recovery and time it; run a drill and observe whether staff can operate manually. The phrase controlled matters twice. Scientifically, it means the evaluator controls what is injected, so detection and miss can be counted against a known truth. Operationally, it means the test is controlled so it cannot harm the process: rigs, simulators, digital twins, isolated restore targets and tabletop exercises carry most of the load, and live tests happen only with operations' authority and safety conditions.

6.2 Detection: rates, families and intervals

A detection evaluation counts how many injected scenarios were detected. A single rate hides two things. First, families: a rule that catches every direct HMI write but half of slow-drift manipulations has a different risk profile from one that catches 85% of everything. Report by technique family — for OT, the families in MITRE ATT&CK for ICS are a good vocabulary (MITRE, ATT&CK for ICS). Second, uncertainty: 17 detections out of 20 trials is consistent with a wide range of true rates. The Wilson score interval (Wilson, 1927) behaves well for small samples and rates near 0 or 1; use it rather than the simple normal approximation.

A practical consequence follows: claims need sample sizes. To claim "at least 90% detection" with a 95% Wilson lower bound, you need dozens of successful trials, not a handful; each miss raises the number further. Plan trial counts before testing and say which claim the planned count can support.

Two further cautions come from research on evaluating detection systems. Test data must resemble the operating environment — the base rate of real attacks, the variety of benign behaviour — or results will not transfer (Sommer and Paxson, 2010; Arp et al., 2022). And for time-series anomaly detection, some popular scoring conventions inflate performance; evaluation must be defined carefully (Kim et al., 2022).

6.3 False-alarm burden

A detection is useful only if operators can act on its alerts. Measure false alarms by replaying representative benign traffic for a long enough period and counting alerts, then express the rate per shift or per operator and with an interval; for counts of rare events the exact Poisson interval is appropriate. Combine it with the base rate of real events: when real attacks are rare, even a low false-alarm rate means most alerts are false. Agree an acceptable burden with operations before the test — for example "no more than one investigation per night shift" — so the result can pass or fail.

6.4 Drills and exercises

Manual-operation drills, recovery exercises and tabletop exercises test people and procedures. NIST's contingency-planning guidance treats testing, training and exercises as a cycle with documented objectives and after-action results (NIST SP 800-34 Rev. 1). To evaluate whether training improved performance, compare the same people before and after (a paired design), report the mean improvement with an interval, and look at individual differences: a mean improvement can hide one operator who did not improve at all. Threats to validity are serious in drills: participants learn the scenario (practice effect), know they are observed, and are often the most willing staff. Vary scenarios, include night shifts and less experienced staff, and do not treat one good drill as proof of readiness.

6.5 Safe test design and rules of engagement

Every test near operating plant needs written rules of engagement: scope (systems, times), excluded systems, permitted techniques, stop conditions (any unexpected process change, any alarm the operators cannot explain), named authority to stop, communications, rollback and evidence handling. The operations lead signs them. Tests that inject commands should use rigs or simulators wherever possible; tests on live plant should be read-only or use pre-agreed benign markers. The ethical principles from Chapter 4 apply: the test must not shift risk onto customers without their protection.

6.6 Worked example: a new detection rule and a drill (synthetic)

Merrow Water's managed-detection provider proposes a rule to detect unauthorised setpoint writes. The specialist designs an evaluation on the test rig: 20 injected scenarios in three families, 336 hours of replayed benign traffic from Hollin, and a manual-dosing drill with six operators before and after a new training module. The operations lead agreed acceptance criteria in advance: detection lower bound at least 0.80 overall with no family below 0.50 point estimate; no more than one false alarm per night shift on average; and a manual-dosing time improvement whose interval excludes zero.

6.7 Practical activity: what the evaluation shows

# Lab 6 - what a controlled evaluation can and cannot show (offline, standard library only)
# Synthetic: Merrow Water tests a new detection rule for unauthorised setpoint writes on a test rig,
# replays two weeks of benign plant traffic, and times a manual-operation drill before and after training.
import math
def wilson(k, n, z=1.96):
    p = k / n; d = 1 + z*z/n
    c = (p + z*z/(2*n)) / d; h = z*math.sqrt(p*(1-p)/n + z*z/(4*n*n)) / d
    return c - h, c + h
def pois_cdf(k, mu): return sum(math.exp(-mu) * mu**i / math.factorial(i) for i in range(k + 1))
def pois_ci(k, a=0.05):  # exact (Garwood) interval by bisection
    def solve(f, lo, hi):
        for _ in range(200):
            mid = (lo + hi) / 2
            if f(mid): lo = mid
            else: hi = mid
        return (lo + hi) / 2
    lower = 0.0 if k == 0 else solve(lambda m: 1 - pois_cdf(k - 1, m) < a/2, 0, 10*k + 10)
    upper = solve(lambda m: pois_cdf(k, m) > a/2, 0, 10*k + 10)
    return lower, upper
# 1. Detection on injected scenarios, split by technique family
RESULTS = {"direct HMI write": (9, 9), "engineering-workstation download": (6, 7), "slow drift via historian tag": (2, 4)}
k = sum(a for a, b in RESULTS.values()); n = sum(b for a, b in RESULTS.values())
lo, hi = wilson(k, n); print(f"overall detected {k}/{n} = {k/n:.2f}, 95% Wilson [{lo:.2f}, {hi:.2f}]")
for fam, (a, b) in RESULTS.items():
    lo, hi = wilson(a, b); print(f"  {fam:34s} {a}/{b}  [{lo:.2f}, {hi:.2f}]")
# 2. How many trials, all detected, before the lower bound clears 0.90?
n = 1
while wilson(n, n)[0] < 0.90: n += 1
print(f"perfect runs needed for Wilson lower bound >= 0.90: {n}")
# 3. False alarms in 336 hours of benign replay
fa, hours = 9, 336
lo, hi = pois_ci(fa); print(f"false alarms {fa} in {hours} h = {fa/hours*24:.2f}/day, 95% CI [{lo/hours*24:.2f}, {hi/hours*24:.2f}]/day")
# 4. Drill: minutes to stable manual dosing, same six operators before and after training (paired)
before = [34, 41, 29, 52, 38, 45]; after = [22, 30, 27, 31, 25, 44]
diffs = [b - a for b, a in zip(before, after)]
md = sum(diffs) / len(diffs); sd = math.sqrt(sum((d - md)**2 for d in diffs) / (len(diffs) - 1))
t = 2.571  # two-sided 95% t quantile, 5 degrees of freedom
print(f"paired improvement mean {md:.1f} min, 95% CI [{md - t*sd/math.sqrt(6):.1f}, {md + t*sd/math.sqrt(6):.1f}]; diffs {diffs}")

Expected output:

overall detected 17/20 = 0.85, 95% Wilson [0.64, 0.95]
  direct HMI write                   9/9  [0.70, 1.00]
  engineering-workstation download   6/7  [0.49, 0.97]
  slow drift via historian tag       2/4  [0.15, 0.85]
perfect runs needed for Wilson lower bound >= 0.90: 35
false alarms 9 in 336 h = 0.64/day, 95% CI [0.29, 1.22]/day
paired improvement mean 10.0 min, 95% CI [2.1, 17.9]; diffs [12, 11, 2, 21, 13, 1]

Interpretation. Overall detection is 17/20 = 0.85, but the 95% Wilson interval [0.64, 0.95] does not clear the pre-agreed lower bound of 0.80. By family, direct HMI writes were all detected, engineering-workstation downloads six of seven, and slow drift via a historian tag only two of four — the point estimate meets the 0.50 floor, but its interval runs from 0.15 to 0.85, so the evaluation cannot say whether slow drift is detected reliably at all. To claim 90% detection with all trials successful would need 35 consecutive successes. False alarms run at 0.64 a day (interval 0.29–1.22), about 0.21 per eight-hour shift, comfortably inside the burden criterion. The drill shows a mean improvement of 10.0 minutes with a 95% interval of 2.1 to 17.9 minutes — the interval excludes zero, so the criterion is met — but two operators improved by only one and two minutes; their experience is worth understanding before rollout.

The honest result is therefore mixed: adopt the rule for direct writes and downloads with monitoring of its performance, do not rely on it for slow drift, and design further trials for that family. That is a more useful answer than "85% detection".

6.8 Common errors and limits

Reporting one detection rate without families or intervals.
Running too few trials to support the claim, then making the claim anyway.
Testing with scenarios the rule's author designed, and only those.
Measuring false alarms on a short or unrepresentative replay.
Expressing false alarms per day for a whole network instead of per shift or operator.
Treating one successful drill as proof of readiness.
Testing on live plant without signed rules of engagement and stop conditions.

The limit of controlled evaluation is transfer: a rig is not a plant and injected scenarios are not adversaries. Use evaluation to bound claims and find weaknesses, keep measuring in operation, and repeat when the environment changes.

Exercises — chapter 6

EX026 — Intervals and sample size. Objective: connect claims to trial counts. Inputs: Lab 6 functions. Constraints: 95% Wilson intervals. Steps: (1) compute the interval for 19/20; (2) find the number of consecutive successes needed for a lower bound of 0.80; (3) find the trials needed for a lower bound of 0.90 if exactly one miss occurs; (4) explain to a manager why "we tested it 20 times" is not enough for a 90% claim. Expected evidence: numbers and paragraph. Rubric: 3 = 19/20 → [0.76, 0.99], 16 successes, 53 trials with one miss, explanation in plain language; 2 = one number wrong; 1 = normal approximation used without comment; 0 = none.

EX027 — Test plan for slow drift. Objective: design trials for the weakest family. Inputs: the slow-drift result. Constraints: rig only; scenarios must vary rate, duration and target tag; include scenarios not written by the rule's author. Steps: (1) define the claim to test; (2) choose trial count; (3) list scenario variations; (4) define pass/fail and what you will do if it fails. Expected evidence: plan. Rubric: 3 = claim explicit and trial count justified by an interval calculation, independent scenario authorship, realistic variations, pre-agreed decision; 2 = count not justified; 1 = reuses the four scenarios; 0 = none.

EX028 — Alarm burden. Objective: express false alarms in operators' units and combine with base rates. Inputs: 0.64 false alarms a day; assume real unauthorised writes occur about once every two years; detection 0.85. Constraints: three eight-hour shifts a day. Steps: (1) false alarms per shift and per year; (2) expected true alerts per year; (3) share of alerts that are true; (4) what this means for the response procedure. Expected evidence: calculation and paragraph. Rubric: 3 = about 0.21 per shift and 234 a year, about 0.43 true alerts a year, about 0.2% of alerts true, a procedure that makes each investigation fast and cheap; 2 = arithmetic right, implication missing; 1 = confuses rates; 0 = none.

EX029 — Drill validity. Objective: critique a drill evaluation. Inputs: the six-operator paired result. Constraints: name at least four threats to validity. Steps: list threats, the direction each would bias the result, and a design change for each. Expected evidence: table. Rubric: 3 = practice effect, observation effect, selection of willing staff, same scenario, small sample, day versus night; directions stated; changes concrete; 2 = threats without directions; 1 = generic; 0 = none.

EX030 — Rules of engagement. Objective: write safe test conditions. Inputs: a proposal to verify on live plant at Fenley that the new rule alerts on a harmless, pre-agreed setpoint write (from 1.80 to 1.81 mg/L). Constraints: operations has authority; customers must not be affected. Steps: write scope, timing, roles, stop conditions, communications, rollback and evidence handling. Expected evidence: one-page rules of engagement. Rubric: 3 = operations sign-off, low-demand timing, explicit stop conditions and authority, independent verification of dose, rollback, alert-handling team forewarned without telling detection analysts if blind detection is part of the test, evidence recorded; 2 = one element missing; 1 = no stop conditions; 0 = none.

Chapter synthesis

Controlled evaluation turns assumed controls into measured ones. Inject known events on rigs and simulators, report detection by family with Wilson intervals, and plan trial counts for the claims you want to make. Measure false alarms over representative periods and express them in operators' units alongside base rates. Evaluate drills with paired comparisons, look at individuals, and design against practice and selection effects. Test near live plant only under written, signed rules of engagement. The honest result of an evaluation is often mixed; say exactly which uses a control is fit for.