◇ OpenCyber Academy
Rapid course · Chapter 2 · English

Chapter 2 — Assets, networks and exposure

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Assets, networks and exposure

Lesson map

Lesson 02 published. Map, example, EX014.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Inventory first"]
  N2["2.2 Reading the lab"]
  N3["2.3 Separating the network"]
  N4["2.4 Exposure and remote access"]
  N5["2.5 Cloud portals"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX014"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Inventory first"]
  N2["2.2 Reading the lab"]
  N3["2.3 Separating the network"]
  N4["2.4 Exposure and remote access"]
  N5["2.5 Cloud portals"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX014"]

[Learning outcomes]
    |
    v
[2.1 Inventory first]
    |
    v
[2.2 Reading the lab]
    |
    v
[2.3 Separating the network]
    |
    v
[2.4 Exposure and remote access]
    |
    v
[2.5 Cloud portals]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX014]

Learning outcomes

You will (1) explain why an inventory comes first; (2) review a device list for common weaknesses; (3) describe how a site network should be separated; and (4) recognise internet exposure and remote access risks.

2.1 Inventory first

You cannot protect what you do not know exists. NIST SP 800-82r3 places asset inventory at the foundation. For each device record name, function, location, owner, firmware version, network address and whether it connects to a cloud.

"""Lab 2: review a synthetic Elmstead inverter list for default passwords, old firmware and cloud links."""
inv = [("INV-01", "5.1", False, True), ("INV-02", "5.1", True, True),
       ("INV-03", "4.7", False, True), ("INV-04", "5.1", False, False)]
LATEST = "5.1"
for name, fw, default_pw, cloud in inv:
    issues = []
    if default_pw: issues.append("default-password")
    if fw != LATEST: issues.append(f"old-fw {fw}")
    print(f"{name} cloud={'yes' if cloud else 'no '} {', '.join(issues) or 'ok'}")
print("needs action:", sum(1 for _, fw, d, _ in inv if d or fw != LATEST))

Run with python3 lab_inverters.py. Verified output:

INV-01 cloud=yes ok
INV-02 cloud=yes default-password
INV-03 cloud=yes old-fw 4.7
INV-04 cloud=no  ok
needs action: 2

A useful inventory also records who to call about each device and when it was last checked. Records go stale as vendors swap parts and engineers add equipment, so Elmstead reviews the list after each maintenance visit. Lab 2 works from a short version of this list for the four inverters, and shows how quickly a few columns reveal what needs attention.

2.2 Reading the lab

INV-02 still uses its default password: anyone who has read the manual could log in. INV-03 runs firmware 4.7 while 5.1 is current, so it may miss security fixes. INV-04 has no cloud link and no issues. Two of four inverters need action. Fixing them is done by the owner and vendor at planned times, not by trainees experimenting.

The lab only checks what the list says. If the list is wrong, for example because a vendor changed a password during a visit and nobody updated the record, the result will be wrong too. Treat the output as a list of questions for the site engineer, and confirm each item with records or with the vendor before anyone acts.

2.3 Separating the network

IEC 62443 describes zones — groups of devices with similar needs — joined by conduits, controlled connections. At Elmstead the control zone holds SC-1, inverters and the battery management system; cameras sit in their own zone; the office network is separate again; a DMZ holds the server that shares data outward. Firewalls between zones allow only the connections that are needed.

The point of the zones is that trouble in one should not spread freely to another. If a camera were compromised, the firewall between the camera zone and the control zone should stop it from reaching SC-1 or the inverters. Each allowed connection between zones should have a reason, an owner and a record, so that old rules can be found and removed.

2.4 Exposure and remote access

Devices reachable directly from the internet are a common weakness; MITRE ATT&CK for ICS calls this T0883 Internet Accessible Device. Remote access for vendors should go through one gateway with multi-factor authentication, enabled only when needed — recommendations echoed in CISA advisory AA21-042A after a 2021 water treatment facility compromise.

For Elmstead this means checking that no inverter, controller or camera answers directly from the internet, and that the vendor's support path ends at a gateway the site owns. Accounts on that gateway should belong to named people, be switched on for a specific job and be switched off afterwards. Session logs let the engineer see who connected and what they did.

2.5 Cloud portals

Vendor clouds are convenient for monitoring, but a portal that can also send commands is effectively remote access. Ask whether it can control equipment, who has accounts, and whether multi-factor authentication is on.

At Elmstead the engineer found that the vendor monitoring portal could send charge commands, not only show data. That makes it part of the remote-access picture, with the same questions about named accounts and second factors. The answers belong in the inventory beside each device the portal can reach, so they are not forgotten when staff or contracts change.

Worked example (synthetic Elmstead)

Jonah shows the lab output to the site engineer. She books the inverter vendor for next week to change INV-02's password and update INV-03, and notes that the monitoring portal can send charge commands — a finding for Chapter 3.

Synthetic case — Elmstead. Devices, versions and settings are invented.

Errors and limits

A list made from records may miss devices; walk-downs and network records complete it. Never scan a live site to build an inventory unless the owner has authorised and planned it.

Exercises

Synthesis

Know every device, fix defaults and old firmware through planned work, separate zones, and keep remote access narrow.

Continue studying — chapter 02 of 04

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →