◇ OpenCyber Academy
Postgraduate · Chapter 2 · English

Chapter 2 — OT, IoT and cyber-physical security: current practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — OT, IoT and cyber-physical security: current practice

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 What current guidance expects"]
  N2["2.2 Documented versus performed"]
  N3["2.3 Building the gap list"]
  N4["2.4 Prioritising"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 What current guidance expects"]
  N2["2.2 Documented versus performed"]
  N3["2.3 Building the gap list"]
  N4["2.4 Prioritising"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX006"]

[Learning outcomes]
    |
    v
[2.1 What current guidance expects]
    |
    v
[2.2 Documented versus performed]
    |
    v
[2.3 Building the gap list]
    |
    v
[2.4 Prioritising]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) benchmark an organisation's OT security programme against NIST SP 800-82r3 and IEC 62443-2-1 themes; (2) distinguish documented practice from performed practice; (3) produce a gap list with evidence; and (4) prioritise gaps for leadership.

2.1 What current guidance expects

NIST SP 800-82r3 organises an OT security programme around governance, risk management, architecture, and the security capabilities applied to OT systems, and it maps OT considerations onto the NIST Cybersecurity Framework functions. IEC 62443-2-1 specifies requirements for an asset owner's security programme. Neither is a checklist to be ticked; both describe capabilities a mature programme demonstrates.

In a review, use each document to generate questions rather than a score. For BWRP that means asking, for example, how remote access is governed, how assets are inventoried and how incidents in the dosing system would be handled. The answers then go into the gap list with evidence, so the review reports what the plant can show rather than how many clauses it claims.

2.2 Documented versus performed

A policy saying "remote access is reviewed monthly" is documented practice. A log showing the last three monthly reviews, with findings closed, is performed practice. Postgraduate assessors look for the second. At BWRP Daniel samples evidence for each claimed practice rather than accepting interview answers.

Sampling has to be chosen before looking, or it drifts toward the cases that look good. Daniel picks five practices that sit on paths to consequence and asks, for each, for the most recent artefact that proves it was done. An interview answer can point to evidence, but it never replaces it in the gap list.

2.3 Building the gap list

For each capability: what the guidance expects, what BWRP documents, what evidence shows is performed, the gap, the consequence of the gap and a proposed owner. Remote lift stations connected over cellular RTUs are a common blind spot: they appear in the asset register as "pumping stations" but not as network endpoints.

Each row should be specific enough that its owner can act on it. For BWRP's inventory gap that means naming the nine lift-station RTUs not yet listed, the consequence that they cannot be monitored or patched, and the person who will add them. A row that only says inventory incomplete gives nobody a task.

2.4 Prioritising

Prioritise gaps that sit on paths to consequence (dosing, discharge quality) and those that are cheap to close. A missing inventory of cellular RTUs blocks several other capabilities — monitoring, patching, incident scoping — so it ranks high even though it is "only documentation".

Write the ranking with its reason, so the plant director can see why an inventory task outranks a new tool. At BWRP the remote-access review comes next, because it has not been performed since March and vendors can reach PLC-D. Restore testing for PLC logic follows, since backups whose restore has never been tried may fail when needed.

Worked example (synthetic BWRP)

Daniel's sample of five practices: asset inventory (documented, partly performed — 14 of 23 lift-station RTUs listed); remote-access review (documented, not performed since March); backup of PLC logic (performed, restore never tested); incident response plan (documented, no OT-specific playbook); patching (performed for Windows HMIs, not for RTU firmware).

Synthetic case — Bayside Water Reclamation Plant. Counts and dates are invented.

Errors and limits

A benchmark against one document can miss sector regulation. Sampling five practices gives a view, not an audit opinion.

Exercises

Synthesis

Current-practice reviews compare evidence of what is done, not what is written, and rank gaps by their effect on consequence and on other capabilities.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →