Chapter 8 — Critical infrastructure and sector security: supervised case analysis | Professional Critical infrastructure and sector security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 8 — Critical infrastructure and sector security: supervised case analysis

Lesson map

Lesson 08 published. Map, example, EX036.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["8.1 Why suppliers matter so much here"]
  N2["8.2 The supplier lifecycle"]
  N3["8.3 The access review"]
  N4["8.4 Worked case: the May review synthetic"]
  N5["8.5 Contract and onboarding requirements"]
  N6["8.6 Supervised presentation"]
  N7["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX036"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["8.1 Why suppliers matter so much here"]
  N2["8.2 The supplier lifecycle"]
  N3["8.3 The access review"]
  N4["8.4 Worked case: the May review synthetic"]
  N5["8.5 Contract and onboarding requirements"]
  N6["8.6 Supervised presentation"]
  N7["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX036"]

[Learning outcomes and connection]
    |
    v
[8.1 Why suppliers matter so much here]
    |
    v
[8.2 The supplier lifecycle]
    |
    v
[8.3 The access review]
    |
    v
[8.4 Worked case: the May review synthetic]
    |
    v
[8.5 Contract and onboarding requirements]
    |
    v
[8.6 Supervised presentation]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX036]

Learning outcomes and connection

After this chapter you should be able to:

analyse a supplier-access problem as a governance case: contracts, accounts, people and evidence;
run a periodic third-party remote-access review and act on its findings proportionately;
write supplier security requirements into contracts and onboarding;
present a case analysis to a supervisor with decisions requested, evidence attached and uncertainty labelled.

This is the book's first supervised case. It brings together risk (Chapter 4), roles (Chapter 6) and control verification (Chapter 7).

8.1 Why suppliers matter so much here

Essential services depend on suppliers for equipment, software, maintenance and monitoring. Supplier remote access is convenient — a pump expert can fix a problem from 200 kilometres away at night — and it is also a recurring route of compromise. CISA's guidance on primary mitigations for OT lists reducing exposure and securing remote access among its priorities (CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology). NIST's supply-chain guidance treats suppliers as part of the organization's risk and recommends integrating supply-chain risk management into governance and acquisition (NIST SP 800-161 Rev. 1). NIS2 lists supply-chain security among the risk-management measures entities must take (Directive (EU) 2022/2555, Article 21).

8.2 The supplier lifecycle

Governance of a supplier with access follows a lifecycle:

Select — security questions in procurement proportionate to the access requested.
Contract — security obligations: named individuals, MFA, notification of incidents and staff departures, right to review, data handling, support for your incident response.
Onboard — accounts created per named person, least access, approval process for sessions (Chapter 6).
Operate — sessions approved, logged and reviewed; periodic access reviews.
Change — new staff, new systems, mergers: re-review.
Exit — accounts removed, data returned or destroyed, confirmation recorded.

Most real problems sit at the joins: a contract that ended but whose account survived; an engineer who left the supplier but whose password did not.

8.3 The access review

A periodic access review reconciles three sources: the list of accounts (what exists), the contracts register (what should exist) and session records (what is used). Typical findings and proportionate responses:

Finding	Why it matters	Proportionate response
Account for ended contract	Nobody is accountable for its use	Disable now; confirm with supplier
Unused for more than 90 days	Unneeded exposure	Disable; re-enable on request through process
Shared or unnamed account	Actions cannot be attributed	Replace with named accounts; meanwhile restrict
No MFA	Password alone grants access	Fix or record a time-limited exception
Usage far above expected	May be legitimate project, misuse or compromise	Ask the supplier and the internal owner; review session records before concluding

The last row needs care. Unusual volume is a question, not an accusation.

8.4 Worked case: the May review (synthetic)

Following the control gaps in Chapter 7, the coordinator runs the first supplier-access review on 4 May 2026, under an authorization from A. Mensah that permits read-only export of the gateway account list and session log. Lab 8 reproduces the reconciliation.

Lab 8 (save as lab08.py, run with python3 lab08.py):

# Lab 8 - third-party remote-access review (offline, standard library only; all data synthetic)
import datetime as dt
TODAY = dt.date(2026, 5, 4)
# account, supplier, named person, MFA, contract end, last session, sessions in 90 days
ACCOUNTS = [
    ("v-hydro1",  "HydroLogic Ltd",  "P. Novak",  True,  "2027-03-31", "2026-04-28", 6),
    ("v-hydro2",  "HydroLogic Ltd",  "",          True,  "2027-03-31", "2026-04-30", 11),
    ("v-scadaco", "ScadaCo",         "M. Ilic",   False, "2026-12-31", "2026-03-15", 2),
    ("v-pumps",   "Vale Pumps",      "D. Ruiz",   True,  "2025-11-30", "2026-02-10", 1),
    ("v-meter",   "MeterWorks",      "K. Sato",   True,  "2026-09-30", "2025-10-02", 0),
    ("v-integr",  "Northgate Integration", "S. Brandt", True, "2026-08-31", "2026-05-01", 19),
]
SESSIONS_EXPECTED = {"HydroLogic Ltd": 8, "ScadaCo": 4, "Vale Pumps": 2, "MeterWorks": 2, "Northgate Integration": 4}
for acct, sup, person, mfa, end, last, n90 in ACCOUNTS:
    f = []
    if not person: f.append("shared/unnamed account")
    if not mfa: f.append("no MFA")
    if dt.date.fromisoformat(end) < TODAY: f.append("contract ended - disable")
    if (TODAY - dt.date.fromisoformat(last)).days > 90: f.append("unused >90 days - disable")
    if n90 > 2 * SESSIONS_EXPECTED[sup]: f.append(f"{n90} sessions vs ~{SESSIONS_EXPECTED[sup]} expected - ask why")
    print(f"{acct:10s} {sup:22s} {'OK' if not f else '; '.join(f)}")

Expected output (Python 3.13.5):

v-hydro1   HydroLogic Ltd         OK
v-hydro2   HydroLogic Ltd         shared/unnamed account
v-scadaco  ScadaCo                no MFA
v-pumps    Vale Pumps             contract ended - disable
v-meter    MeterWorks             unused >90 days - disable
v-integr   Northgate Integration  19 sessions vs ~4 expected - ask why

The coordinator's analysis, labelled:

Decided (by A. Mensah, 4 May): disable v-pumps (Vale Pumps' contract ended in November) and v-meter (unused since October) today; replace v-hydro2 with a named account within 14 days and restrict it meanwhile to supervised sessions.
Owed: ScadaCo to enable MFA on v-scadaco within 30 days, or an exception to be proposed with compensating measures (Chapter 7); owner A. Mensah.
Open: v-integr — Northgate Integration had 19 sessions in 90 days against about 4 expected. The coordinator does not conclude misuse. She asks J. Tan whether a project explains it and asks Northgate's account manager for the work log. J. Tan replies that Northgate is commissioning the new telemetry link at KW-11, which was approved in March; the work log matches 17 of 19 sessions. Two sessions on 12 and 19 April at 02:00 are not in the work log. Those two are passed to the security lead and KVROC for review of session records, under the incident escalation path, with the supplier informed only after the security lead agrees.
Assumed: the gateway export is complete. (Next review: also compare against the firewall's allowed sources.)

The case shows the coordinator's discipline: act quickly on clear governance failures, ask before accusing, escalate the residual unexplained activity through the proper path, and record what is assumed.

8.5 Contract and onboarding requirements

From the case, the coordinator drafts standard clauses for new supplier contracts with remote access: named individuals only; MFA; sessions only through the utility's gateway, approved per session or per scheduled window; supplier to notify the utility within 24 hours of staff departure and promptly of any security incident that could affect the utility; work logs available on request; cooperation in incident response; deletion of utility data at contract end, confirmed in writing. ISA/IEC 62443 includes requirements for service providers and integrators that can inform such clauses (ISA/IEC 62443 overview). Legal wording is for your legal team; your job is to specify the security outcome.

8.6 Supervised presentation

Present the case to your supervisor (here, E. Varga) in five parts: what was reviewed and under what authority; findings with evidence; decisions already taken and by whom; decisions requested from the supervisor (budget for MFA on ScadaCo's side, approval of contract clauses); and open questions with owners and dates.

Keep each part short and label it, so the supervisor can stop you at any point and still know what is decided and what is asked. In the May review, the two unexplained Northgate sessions belong under open questions with their owner, not under findings. Bring the Lab 8 output and the authorization as attachments, and state plainly what was assumed, such as that the gateway export was complete. End by repeating the decisions requested and the date by which they are needed.

8.7 Common errors and limits

Treating unusual activity as proof of compromise — or ignoring it as "probably the project".
Removing access needed for safety-critical support without a fallback.
Reviews using only one source (accounts without contracts or sessions).
Contract clauses that cannot be checked.
The lab models one gateway; real environments have several access paths (dial-up, cellular modems, supplier-installed remote tools) that the review must find.
Disabling an account for a supplier whose support is needed for a dosing problem in progress, without arranging an alternative.
Closing a review once the obvious findings are fixed, while two unexplained sessions remain open without an owner.

Exercises — chapter 8

EX036 — Read Lab 8. Objective: interpret review results. Inputs: Lab 8 output. Steps: for each account state the finding, risk and proportionate response with owner. Expected evidence: six rows. Rubric: 3 = matches 8.4 including restraint on v-integr and a fallback for v-scadaco; 2 = correct actions but accusatory on v-integr; 1 = disables everything; 0 = none.

EX037 — Extend the review. Objective: add a source. Inputs: Lab 8. Steps: add a "last staff confirmation" date per account and flag accounts whose supplier has not confirmed its staff list in 180 days; show output. Expected evidence: code and output. Rubric: 3 = field added for all rows with test values that trigger and do not trigger, output shown, explains why staff confirmation matters (departures); 2 = no explanation; 1 = rule only; 0 = none.

EX038 — Draft contract clauses. Objective: specify supplier obligations. Inputs: 8.5. Steps: write five checkable clauses in plain language. Expected evidence: clauses. Rubric: 3 = each clause has a measurable obligation and a way to verify (for example staff departure notice within 24 hours, verified at quarterly review); 2 = not checkable; 1 = "supplier will be secure"; 0 = none.

EX039 — Handle the two night sessions. Objective: escalate unexplained activity properly. Inputs: 8.4. Steps: write the message to the security lead and the decision you need. Expected evidence: message. Rubric: 3 = facts with times in UTC and source, what is known (17 of 19 explained), what is not, request for session-record review via escalation path, guidance not to alert the supplier yet, sensitive handling (TLP:RED or AMBER+STRICT), next check time; 2 = no handling guidance; 1 = "please investigate Northgate"; 0 = none.

EX040 — Present the case. Objective: supervised presentation. Inputs: 8.6. Steps: write the five-part briefing in under 300 words. Expected evidence: briefing. Rubric: 3 = all five parts, decisions requested explicitly, uncertainty labelled, no unsupported accusation; 2 = missing requested decisions; 1 = narrative only; 0 = none.

Chapter synthesis

Supplier access is governed across a lifecycle — select, contract, onboard, operate, change, exit — and most failures sit at the joins. An access review reconciles accounts, contracts and sessions; respond proportionately, treat anomalies as questions, and escalate what remains unexplained through the proper path. Turn lessons into checkable contract requirements and present cases with decisions requested and uncertainty labelled.

Continue studying — chapter 08 of 12

← Chapter 07 · Course chapter index · Chapter 09 →

Continue to the next authored lesson.