Chapter 8 — OT, IoT and cyber-physical security: difficult cases
Lesson map
Lesson 08 published. Map, example, EX036.
flowchart TD
N0["Learning outcomes"]
N1["8.1 When containment endangers the process"]
N2["8.2 Insiders"]
N3["8.3 Supplier compromise"]
N4["8.4 Communicating under uncertainty"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX036"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 When containment endangers the process"]
N2["8.2 Insiders"]
N3["8.3 Supplier compromise"]
N4["8.4 Communicating under uncertainty"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX036"]
[Learning outcomes]
|
v
[8.1 When containment endangers the process]
|
v
[8.2 Insiders]
|
v
[8.3 Supplier compromise]
|
v
[8.4 Communicating under uncertainty]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX036]
Learning outcomes
You will (1) lead a response when containment and process safety conflict; (2) handle an insider scenario with fairness and evidence; (3) manage a supplier compromise affecting multiple sites; and (4) communicate under uncertainty with regulators and the public.
8.1 When containment endangers the process
Suppose evidence suggests an intruder on BWRP's SCADA server during a storm, when lift stations need remote pump starts to avoid overflows. Disconnecting SCADA stops the intruder and the operators' remote control together. The leader's job is to choose the least-bad option: keep SCADA connected under heightened watch with manual verification of each command; dispatch crews to high-consequence stations to take local control; then isolate. NIST SP 800-82r3 emphasises that OT incident response must weigh the safety and operational impact of response actions.
8.2 Insiders
An unexplained local change at a dosing panel (Chapter 3's example) might be a technician's well-meant adjustment or sabotage. Treat it as a process deviation first, collect evidence without accusation, involve human resources and legal counsel before interviews, and remember that blame cultures make staff hide mistakes, which is worse for security.
At BWRP the evidence already pointed to a local change during a period when the panel was in local mode. The next step is to check rosters and work orders for that window, and to ask the technician what they were doing, with the conversation handled as a process review. Only if the explanation does not fit does it become a disciplinary or legal matter.
8.3 Supplier compromise
If a SCADA vendor announces that its update server distributed tampered software, every utility using it must determine exposure. Leaders need an inventory of installed versions and a record of where updates came from. Sector information sharing helps; so does an existing relationship with the vendor's security team.
For BWRP the first question would be which SCADA servers and engineering workstations received updates from the affected source, and when. That needs records kept before the announcement, which is why the inventory work in the gap list matters. Contacts with the vendor's security team and the sector sharing group should be established before a crisis, not during one.
8.4 Communicating under uncertainty
Tell regulators what you know, what you do not, what you are doing and when you will update. Avoid both reassurance you cannot support and speculation about attribution.
At BWRP the holding statement at 01:00 on the storm night followed this pattern: an unfamiliar session from the SCADA server, crews at the beach-side stations, the external path cut, and the time of the next update. It made no claim about who was responsible. Prepare templates for such statements in advance so they can be issued quickly without careless wording.
Worked example (synthetic BWRP)
Storm night, 23:40: monitoring alerts on an unfamiliar outbound session from the SCADA server. Daniel and the shift supervisor agree: crews to the six beach-side stations by 00:30 for local control; SCADA stays connected with two-person verification of every remote command; at 00:35, with local control confirmed, SCADA's external path is cut at the DMZ firewall. The regulator receives a holding statement at 01:00 per the permit's notification terms.
Synthetic case — Bayside Water Reclamation Plant. The event and timings are invented.
Errors and limits
Two-person verification slows operations; it is a temporary measure. Holding statements must not be delayed to perfect them.
Exercises
- EX036 — Sequencing a storm-night response. Explain why crews were dispatched before cutting the external path. Rubric: 3 = maintain overflow prevention via local control before losing remote control; 2 = partial; 1 = speed; 0 = none.
- EX037 — First steps on a possible insider. List the first three actions after the unexplained panel change. Rubric: 3 = make process safe/verify setpoint, preserve evidence, involve HR/legal before interviews; 2 = two; 1 = accuse; 0 = none.
- EX038 — Supplier exposure question. Which two records let BWRP answer "were we affected by the tampered update?" Rubric: 3 = installed version per host and update source/date history; 2 = one; 1 = vendor list; 0 = none.
- EX039 — A holding statement. Draft a three-sentence holding statement to the regulator. Rubric: 3 = known, unknown, actions and next update time; 2 = three of four; 1 = speculative; 0 = none.
- EX040 — Ending two-person verification. State a criterion for ending the temporary measure. Rubric: 3 = intruder path closed and SCADA integrity verified (e.g. clean rebuild or verified hashes), owner sign-off; 2 = partial; 1 = time-based only; 0 = none.
Synthesis
Difficult cases demand sequencing that keeps the process safe, fairness toward people, inventories that answer supplier questions, and honest communication.
Continue studying — chapter 08 of 12
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →