◇ OpenCyber Academy
Postgraduate · Chapter 11 · English

Chapter 11 — Applied project

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Applied project

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Choosing the project"]
  N2["11.2 Stakeholders and constraints"]
  N3["11.3 Milestones and risks"]
  N4["11.4 Success measures"]
  N5["11.5 The dossier"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Choosing the project"]
  N2["11.2 Stakeholders and constraints"]
  N3["11.3 Milestones and risks"]
  N4["11.4 Success measures"]
  N5["11.5 The dossier"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 Choosing the project]
    |
    v
[11.2 Stakeholders and constraints]
    |
    v
[11.3 Milestones and risks]
    |
    v
[11.4 Success measures]
    |
    v
[11.5 The dossier]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) scope an applied OT security project inside a real organisational constraint; (2) plan stakeholders, milestones and risks; (3) deliver an artefact plus an evidence dossier; and (4) define success measures before starting.

11.1 Choosing the project

A postgraduate applied project should change something in an organisation, with the owner's written agreement, and be finishable in one term. At BWRP, Daniel's project is "passive write monitoring for the dosing network": it closes the unsupported claim G6 from Chapter 9, uses the evaluation method from Chapter 6 and the impact measure from Chapter 10.

The monitoring project fits these tests. Operations and engineering own the systems it touches and can agree to it in writing. It can be finished in twelve weeks. It closes a named gap in the assurance case, and its result will be measurable. A project that only produces a report, with nothing changed, would not meet the standard.

11.2 Stakeholders and constraints

Operations must approve the monitoring tap (passive, on a mirror port, installed in a maintenance window). Engineering provides the register map. IT provides log storage. The regulator need not approve but will see the results in the next assurance report. The constraint list includes: no active traffic on the dosing network, no change to PLC-D, and data retention of 90 days.

Write each constraint as a test that can fail, and check them at each milestone. If the mirror port cannot be installed without touching PLC-D's configuration, the constraint wins and the plan changes. Keep a short stakeholder log of who agreed what and when, because the dossier will need it.

11.3 Milestones and risks

Weeks 1–2: agreement, tap installed and capture validated. Weeks 3–6: baseline and rules. Weeks 7–9: controlled evaluation with an independently authored attack replay. Weeks 10–12: dossier and handover. Risks: mirror-port packet loss (mitigation: monitor loss counters), operator alert fatigue (mitigation: alerts to OT security first for 4 weeks), staff turnover (mitigation: written runbook).

Review the risks at each milestone and record whether each mitigation is working. If capture loss cannot be brought under control by week 2, later results would be unreliable, so the plan pauses rather than carrying a weak baseline forward. Protect weeks 7 to 9 in particular, because evaluation is the first phase to be squeezed when earlier work slips.

11.4 Success measures

Defined in advance: capture loss below 0.1 % over a week; recall at least 0.8 on the independent replay with false-alert rate below 2 % of normal windows; maximum undetected dosing deviation reported; runbook accepted by operations.

Record these measures in the project agreement, with the date and the stakeholders who accepted them. The maximum undetected dosing deviation has no target because it is a finding, not a pass mark, but it must be reported whatever it shows. Failing a measure is reported as a failure, as Daniel does at week 9.

11.5 The dossier

The evidence dossier contains the agreement, configuration, test reports, evaluation results with intervals, open issues and handover. It becomes evidence E5 in the assurance case.

Organise the dossier so that a reviewer can follow the project from agreement to handover without asking questions. Include the capture-loss figures, the evaluation counts, the week-9 miss on false alerts and the re-run. When it becomes evidence in the assurance case, it carries a date, so its validity period starts then. Keep it in the plant's controlled records.

Worked example (synthetic BWRP)

At week 9 the independent replay gives recall 33/40 (0.825) and 4/160 false alerts (2.5 %): the recall target is met, the false-alert target is not. Daniel reports the miss, tightens one rule that produced three of the four false alerts, and schedules a re-run rather than redefining the target.

Synthetic case — Bayside Water Reclamation Plant. Project results are invented.

Errors and limits

Projects in live organisations slip; protect the evaluation phase. Do not let success measures drift after results arrive.

Exercises

Synthesis

An applied project closes a real gap under real constraints, with success defined in advance and reported honestly in a dossier that becomes assurance evidence.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →