Chapter 1 — What OT, IoT and cyber-physical security are
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Three overlapping terms"]
N2["1.2 A solar and battery site"]
N3["1.3 Priorities"]
N4["1.4 Why it is a real concern"]
N5["1.5 The guidance map"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Three overlapping terms"]
N2["1.2 A solar and battery site"]
N3["1.3 Priorities"]
N4["1.4 Why it is a real concern"]
N5["1.5 The guidance map"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Three overlapping terms]
|
v
[1.2 A solar and battery site]
|
v
[1.3 Priorities]
|
v
[1.4 Why it is a real concern]
|
v
[1.5 The guidance map]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) define operational technology, IoT and cyber-physical systems; (2) identify them at a solar and battery site; (3) explain why their security priorities differ from office IT; and (4) name the main public guidance.
1.1 Three overlapping terms
Operational technology (OT) is hardware and software that monitors or controls physical equipment and processes; NIST SP 800-82r3 is the main U.S. guide to securing it. The Internet of Things (IoT) is networked devices that sense or act on the world, often small and cloud-connected. A cyber-physical system (CPS) is any system where computing and physical processes are tightly linked. A modern energy site is all three at once.
The terms are useful because they point to different worries. Calling a device OT draws attention to the process it controls; calling it IoT draws attention to its small size, default settings and cloud link; calling the whole site a CPS reminds you that a software fault can become heat, motion or lost power.
1.2 A solar and battery site
Rows of solar panels feed inverters that turn direct current into grid alternating current. A battery energy storage system (BESS) stores energy, managed by a battery management system that watches cell temperatures and voltages. A site controller decides when to charge and discharge, following a schedule and instructions from the grid operator. Weather stations, cameras and the fire detection panel complete the picture. Many devices also report to vendor clouds.
Each of these parts can fail or be misused in a different way. A wrong inverter setting changes how much power reaches the grid; a silent battery management system hides an overheating cell; a confused site controller charges at the wrong hour. Knowing what each part does is what lets Jonah notice when something behaves oddly.
1.3 Priorities
In office IT, protecting confidential data often comes first. On an energy site the first priorities are safety — batteries can overheat and catch fire — and keeping the process stable and available. Integrity of commands matters enormously: a false "discharge now" can damage equipment or disturb the grid. Confidentiality still matters, but rarely first.
This order changes what a good response looks like. Switching a device off to protect its data might be sensible on an office laptop, but at Elmstead it could leave a battery unmanaged or drop power that the grid operator was counting on. Security work on the site therefore starts by asking what the equipment is doing and whether stopping it is safe.
1.4 Why it is a real concern
Industrial and IoT devices were often designed for closed networks and trusted users. Today they are reachable through remote access, clouds and shared networks. CISA publishes advisories for industrial products every week, and IoT botnets such as Mirai, studied by Antonakakis and colleagues, showed how many devices can be taken over through default passwords.
An energy site often combines both kinds of risk: industrial controllers that expect trusted traffic, and small connected devices such as cameras that ship with weak settings. A trainee does not need to follow every advisory, but should know that weaknesses in this equipment are found and published regularly, and that fixing them depends on knowing which devices the site actually has.
1.5 The guidance map
IEC 62443 is the international series for industrial automation security; NIST IR 8259 and ETSI EN 303 645 set baselines for IoT products; MITRE ATT&CK for ICS catalogues adversary techniques; CISA advisories report real weaknesses and incidents.
You do not need to read all of these before starting. Treat them as places to look when a question comes up: IEC 62443 when deciding how to divide a site network, the IoT baselines when buying a camera or sensor, ATT&CK for ICS when describing what you observed, and CISA advisories when asking whether a product you own has a known weakness. Later chapters use each of them in that way.
Worked example (synthetic Elmstead)
Jonah Park joins Elmstead Solar and Battery Site as a trainee. On a tour he lists: inverters INV-01 to INV-04, the BESS with its battery management system, site controller SC-1, a connection to the grid operator, two cameras and a vendor monitoring portal. Next to each he writes one physical consequence of failure.
Synthetic case — Elmstead Solar and Battery Site. The site, Jonah Park and every figure in this book are invented for teaching.
Errors and limits
These definitions overlap; organisations use them differently. This book is introductory and grants no authority to access any real site.
Exercises
- EX001 — Defining OT. Give a one-sentence definition of operational technology. Rubric: 3 = systems monitoring/controlling physical processes, hardware+software; 2 = partial; 1 = "factory computers"; 0 = none.
- EX002 — IoT in your own words. What distinguishes an IoT device from an office laptop? Rubric: 3 = senses/acts on physical world, often small, networked/cloud; 2 = partial; 1 = vague; 0 = none.
- EX003 — CPS example. Give an example of a cyber-physical system outside energy. Rubric: 3 = valid example with computing-physical link explained; 2 = example only; 1 = non-CPS; 0 = none.
- EX004 — Inverter role. What does an inverter do at Elmstead? Rubric: 3 = converts panel DC to grid AC; 2 = "converts power"; 1 = stores; 0 = none.
- EX005 — Battery management. Name two things the battery management system watches. Rubric: 3 = cell temperature and voltage (or state of charge); 2 = one; 1 = wrong; 0 = none.
- EX006 — Deciding charge times. Which device decides when the battery charges and discharges? Rubric: 3 = site controller SC-1 following schedule/grid operator; 2 = SC-1 only; 1 = inverter; 0 = none.
- EX007 — First priority. State the first security priority at a battery site and why. Rubric: 3 = safety, battery fire/overheating risk to people; 2 = safety only; 1 = confidentiality; 0 = none.
- EX008 — False discharge. Describe the harm of a false "discharge now" command. Rubric: 3 = equipment stress/damage, grid disturbance, breach of schedule; 2 = one; 1 = vague; 0 = none.
- EX009 — Botnet lesson. What did the Mirai botnet show about IoT devices? Rubric: 3 = many devices taken over via default passwords at large scale; 2 = partial; 1 = "viruses"; 0 = none.
- EX010 — Matching guidance. Which source fits each need: (a) industrial automation security series; (b) consumer IoT baseline; (c) adversary techniques? Rubric: 3 = IEC 62443, ETSI EN 303 645, ATT&CK for ICS; 2 = two; 1 = one; 0 = none.
- EX011 — Advisories. Who publishes advisories about weaknesses in industrial products in the U.S.? Rubric: 3 = CISA (with vendors); 2 = "government"; 1 = wrong; 0 = none.
- EX012 — Listing the site. List five Elmstead components from the tour. Rubric: 3 = five correct; 2 = four; 1 = two; 0 = none.
- EX013 — Your authority. Does finishing this book allow Jonah to log into Elmstead's inverters? Explain. Rubric: 3 = no; needs owner authorisation/role; book grants none; 2 = no only; 1 = yes; 0 = none.
Synthesis
OT, IoT and CPS join computing to physical equipment; at an energy site safety and command integrity come first.