◇ OpenCyber Academy
Postgraduate · Chapter 5 · English

Chapter 5 — OT, IoT and cyber-physical security: design alternatives

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — OT, IoT and cyber-physical security: design alternatives

Lesson map

Lesson 05 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 The problem"]
  N2["5.2 Three alternatives"]
  N3["5.3 Evaluating them"]
  N4["5.4 Recording rejections"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 The problem"]
  N2["5.2 Three alternatives"]
  N3["5.3 Evaluating them"]
  N4["5.4 Recording rejections"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX021"]

[Learning outcomes]
    |
    v
[5.1 The problem]
    |
    v
[5.2 Three alternatives]
    |
    v
[5.3 Evaluating them]
    |
    v
[5.4 Recording rejections]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes

You will (1) generate genuinely different design alternatives for securing remote lift stations; (2) evaluate them against operational, security and lifecycle criteria; (3) use IEC 62443 zone and conduit concepts to describe each; and (4) document why rejected alternatives were rejected.

5.1 The problem

BWRP's 23 lift stations pump wastewater to the plant. Each has an RTU with a cellular modem reporting levels and pump status to SCADA and accepting start/stop commands. Some modems have public IP addresses, which places them in the exposure category ATT&CK for ICS names T0883 Internet Accessible Device.

The commands matter most. A false level reading could hide an overflow, but a remote stop sent to a pump during a storm could cause one. Any design therefore has to answer two questions: who can reach the RTUs, and whether remote commands are needed at all. The answers differ by station, which is why the alternatives are compared station by station.

5.2 Three alternatives

Alternative 1 — private APN: the carrier provides a private access point name so modems have no public addresses; traffic reaches BWRP through a carrier-managed tunnel. Alternative 2 — RTU-side VPN: each RTU (or a small router beside it) builds an IPsec tunnel to a BWRP concentrator in the DMZ. Alternative 3 — monitoring-only uplink with local control: remote commands are removed; RTUs run local level control and report only, and operators dispatch crews for exceptions.

Each alternative changes a different thing. The first removes public addresses but leaves trust in the carrier. The second adds BWRP's own encryption and authentication at the cost of more equipment. The third removes the riskiest capability, remote commands, and accepts slower response. They are genuinely different, which is what makes comparing them useful.

5.3 Evaluating them

Alternative 1 is quick and cheap but trusts the carrier's isolation. Alternative 2 gives BWRP its own cryptographic boundary but adds 23 devices to patch and certificates to manage. Alternative 3 shrinks the attack surface most — no remote commands means no remote manipulation of pumps — but lengthens response to some faults, which operations must accept. In 62443 terms, each alternative defines a different conduit between the lift-station zones and the SCADA zone, with different security capabilities.

Put the evaluation in a table with the same criteria for each alternative, such as time to deploy, cost over five years, effect on response to overflows and remaining exposure. Score each station class separately, because a beach-side station with high overflow consequence justifies more than an inland station whose overflow is contained.

5.4 Recording rejections

A design record lists rejected alternatives and the reason. Future reviewers otherwise re-propose them without knowing the history.

For BWRP the record notes that Alternative 3 was rejected because remote pump starts prevented three overflows last year. If operations later change, for example by adding local storage or automatic control at the high-consequence stations, the reason may no longer hold, and the record tells the next reviewer exactly which condition to check. Date the record and name who agreed to the rejection.

Worked example (synthetic BWRP)

Daniel recommends Alternative 1 immediately (removes public exposure within a month) and Alternative 2 for the six stations whose overflow consequence is highest (near beaches), with Alternative 3 rejected because operations showed that remote pump starts prevented three overflows last year.

Synthetic case — Bayside Water Reclamation Plant. Station counts and overflow history are invented.

Errors and limits

A private APN is not encryption; carriers' internal networks are outside BWRP's control. Alternatives must be tested for latency effects on telemetry.

Exercises

Synthesis

Good design work produces real alternatives, evaluates them across their lifecycle, tiers protection by consequence and remembers why options were rejected.

Continue studying — chapter 05 of 12

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →