## Chapter 1 — Computing and service architecture ### Learning outcomes and connection After this chapter you should be able to: - draw the technical architecture of a supervisory control service — field devices, communication links, front-end and SCADA servers, historian, HMI, engineering workstation, management plane — and say which component does what; - distinguish the **control path**, the **monitoring path** and the **management path**, and explain why a technician protects each differently; - calculate a **poll-cycle budget** and use it to predict what a slow or dead link does to the freshness of operator data; - identify the shared platform components (virtualization hosts, directory, time, storage) whose failure crosses service boundaries. This is the first chapter of a hands-on course. Everything later — protocol decoding, hardening, detection, troubleshooting — assumes you can point at a box on the diagram and say what traffic it sends, what it stores and what breaks if it stops. The entry knowledge (networks, operating systems, scripting) is assumed; the new element is the physical process at the other end of the wire. ### 1.1 The layers of a supervisory control service Most critical-sector services that move water, power, air or people share a recognizable layered shape. NIST's guide to operational technology describes the same components in general terms ([SP 800-82 Rev. 3](https://csrc.nist.gov/pubs/sp/800/82/r3/final)); the names below are the ones used in this book. - **Field devices**: sensors (level, flow, chlorine, pressure, temperature, current), actuators (pumps, valves, breakers) and the controllers that connect them — **PLCs** (programmable logic controllers) running local logic and **RTUs** (remote terminal units) built for remote sites with limited communications. - **Communication links**: fibre, licensed radio, cellular routers, leased lines or an operator's MPLS network. Their latency, loss and cost shape everything above them. - **Front-end processor (FEP) or SCADA server**: polls field devices, applies scaling and alarms, and keeps the current state of the process. - **Historian**: stores time series for reporting, investigation and regulatory records. - **HMI** (human–machine interface): the operator's screens, from which commands such as "start pump 2" are issued. - **Engineering workstation**: holds controller projects and the vendor tools that change controller logic; the single most powerful computer in the system. - **Management plane**: jump hosts, directory services, time servers, backup, virtualization management and the monitoring collector. ### 1.2 Three paths, three protection problems A technician should be able to trace three different paths on the diagram. The **control path** carries commands to the process: HMI → SCADA server → link → controller → actuator. Integrity and availability of this path are what keep people safe; an unauthorized or corrupted write here is the worst case in this book. The **monitoring path** carries measurements back: sensor → controller → link → SCADA server → historian and HMI. If it is wrong, operators act on false information — a failure that can be as dangerous as a bad command, and harder to notice. The **management path** changes the system itself: an engineer downloading new logic, an administrator patching the historian, a vendor connecting to diagnose a fault. It is used rarely but holds the most privilege, and it is where most real intrusions into control environments have been reported to begin; CISA's alert on the December 2015 attacks on Ukrainian distribution companies describes remote access and credential use preceding the operational impact ([CISA IR-ALERT-H-16-056-01](https://www.cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01)). The three paths often share cables, switches and servers. Drawing them separately is how you discover that a "monitoring" laptop on the control-centre switch can also reach controller programming ports. ### 1.3 Polling and freshness Most station protocols in this book are **request–response**: the SCADA server asks, the device answers. The time to refresh every station once is the **poll cycle**. For each station it is roughly *polls per cycle × (link round-trip time + device turnaround time)*. If the server polls stations one after another on a single channel, the cycle is the **sum** over stations; if it has an independent channel per station, the cycle is set by the **slowest** station. Two consequences matter for security work. First, a slow link (a congested cellular router, a degraded radio path) stretches the cycle for everyone polled after it. Second, a device that does not answer costs the full **timeout** on every poll, so one dead station can stretch the cycle more than a slow one. Freshness requirements — "every station refreshed at least every 5 s" — therefore depend on timeouts and retry counts as well as link speed, and a security control that adds latency (a VPN, an inspection proxy) must be checked against this budget before it goes in. ### 1.4 Shared platforms Modern control centres run their SCADA servers, historians and directory on virtualization hosts, often shared between services. A shared hypervisor, directory, time source or storage array is a point where a fault in one sector becomes a fault in several. Lab 15 in Chapter 15 traces these dependencies with code; here, simply learn to mark every shared component on the diagram with the services that depend on it. At KVROC the host esx-02 runs the SCADA server, the historian and the hospital BMS server, so its outage or a bad patch can affect water and healthcare monitoring together. Mark each shared component with every service that depends on it, and ask who owns the host when those services disagree about a change window. ### 1.5 Worked example: the Kestrel Vale operations centre (synthetic) You are a technical officer at the **Kestrel Vale Regional Operations Centre (KVROC)**, which runs supervisory systems for **Kestrel Water** (12 stations, KW-01 to KW-12), monitoring of building-management systems for **Kestrel General Hospital**, and the telecontrol front end for one substation (**SS-3**) of **Kestrel Grid**. Station RTUs sit in 10.10.0.0/16 (KW-*n* is 10.10.*n*.2); the control centre is 10.20.0.0/24 (SCADA server `scada-01` 10.20.0.10, engineering workstation `eng-ws-15` 10.20.0.15, historian `hist-02` 10.20.0.21); corporate desks are 10.30.0.0/16; the management network is 10.90.0.0/24 (jump host `jump-01` 10.90.0.20). All names and addresses are fictional. Operations require every station refreshed within 5 seconds. `scada-01` polls all twelve stations on one channel. Lab 1 computes the budget. **Lab 1** (save as `lab01.py`, run with `python3 lab01.py`): ```python # Lab 1 - poll-cycle budget for a SCADA server polling stations (offline, standard library only) # Synthetic Kestrel Water figures. Each poll = request + response over the link plus device turnaround. stations = { # name: (link, round-trip ms on the link, device turnaround ms, polls per cycle) "KW-01": ("fibre", 4, 20, 3), "KW-02": ("fibre", 4, 20, 3), "KW-03": ("fibre", 5, 25, 3), "KW-04": ("cellular", 180, 40, 4), "KW-05": ("cellular", 210, 40, 4), "KW-06": ("cellular", 650, 40, 4), "KW-07": ("radio", 420, 60, 3), "KW-08": ("radio", 460, 60, 3), "KW-09": ("cellular", 190, 40, 4), "KW-10": ("fibre", 4, 20, 3), "KW-11": ("radio", 440, 60, 3), "KW-12": ("cellular", 200, 40, 4), } REQUIRED_S = 5.0 # operations require every station refreshed at least every 5 s TIMEOUT_MS = 1500 # a poll that gets no reply costs the full timeout def cycle(stations, sequential=True, dead=()): per = {} for n, (link, rtt, turn, polls) in stations.items(): per[n] = polls * (TIMEOUT_MS if n in dead else rtt + turn) return (sum(per.values()) if sequential else max(per.values())) / 1000, per c, per = cycle(stations) print(f"sequential cycle {c:.2f} s (requirement {REQUIRED_S} s) -> {'OK' if c <= REQUIRED_S else 'FAILS'}") worst = max(per, key=per.get); print(f"slowest station {worst}: {per[worst] / 1000:.2f} s per cycle") c2, _ = cycle(stations, dead={"KW-06"}) print(f"sequential with KW-06 not answering: {c2:.2f} s") c3, _ = cycle(stations, sequential=False, dead={"KW-06"}) print(f"one polling channel per station, KW-06 dead: {c3:.2f} s") ``` Expected output (Python 3.13.5): ```text sequential cycle 11.33 s (requirement 5.0 s) -> FAILS slowest station KW-06: 2.76 s per cycle sequential with KW-06 not answering: 14.57 s one polling channel per station, KW-06 dead: 6.00 s ``` The result says the requirement is already failed (11.33 s), mostly because of cellular and radio stations, with KW-06 the slowest. A dead KW-06 adds a further 3.24 s because every unanswered poll costs 1.5 s. Even with a channel per station the cycle is 6.00 s while KW-06 is dead: per-station channels remove the *sum* problem but not the *timeout* problem. A technician who is asked to "add an encrypted tunnel to the cellular stations" now knows the question to ask first: how many milliseconds does it add per poll, and what does that do to an already failing cycle? ### 1.6 Practical activity: draw your own three-path diagram Using the KVROC description, draw the control, monitoring and management paths in three colours. Mark every component that appears on more than one path, and every shared platform component. Keep the drawing: Chapters 6, 10 and 15 refine it. Use three colours or three page layers so that a shared switch or jump host stands out. Then check whether eng-ws-15 appears on both the management path and the control path: if it does, a compromise of that workstation reaches every station. Keep the drawing with Lab 1's budget, because a later tunnel or encryption proposal has to be judged against both the paths and the poll cycle. ### 1.7 Common errors and limits - Drawing only the network and forgetting the management path, which is where privilege lives. - Treating the historian as "just IT"; it is often the bridge between control and corporate networks. - Measuring link speed but not timeouts and retries; dead devices dominate poll cycles. - Assuming a parallel architecture fixes freshness; it changes the arithmetic, not the timeout. - Lab 1's model ignores retries, serial-line contention and protocol overhead; treat its numbers as a first estimate, then measure. - Forgetting that a dead station costs the full timeout on every poll, so one non-answering RTU can stretch the cycle more than a slow one. - Drawing the control and monitoring paths and leaving out the jump host, directory and time server. - Treating Lab 1's numbers as measured values rather than a first estimate that still needs retries and protocol overhead checked on site. ### Exercises — chapter 1 **EX001 — Path classification.** *Objective:* separate the three paths. *Inputs:* these flows: HMI → scada-01 "start pump 2"; KW-04 RTU → scada-01 level reading; eng-ws-15 → KW-04 project download; jump-01 → hist-02 SSH; hist-02 → corporate report server CSV export. *Steps:* classify each as control, monitoring or management (or a combination) and state the worst consequence if an unauthorized party could alter it. *Expected evidence:* a five-row table. *Rubric:* 3 = correct classes with the project download recognized as the most dangerous management action and the CSV export recognized as a cross-zone monitoring flow; 2 = one misclassification; 1 = classes without consequences; 0 = none. **EX002 — Fix the cycle on paper.** *Objective:* use the poll-cycle model. *Inputs:* Lab 1. *Steps:* propose two changes that bring the sequential cycle under 5 s with all stations healthy, and say which also limits the effect of one dead station. Change the lab to test them. *Expected evidence:* modified parameters and the new printed cycle times. *Rubric:* 3 = changes are realistic (separate channels for slow link types, fewer polls per cycle for slow stations, a shorter timeout with a justified retry policy) and verified by running the lab; 2 = correct but unverified; 1 = "buy faster links" only; 0 = none. **EX003 — Tunnel impact.** *Objective:* check a security control against an operational budget. *Inputs:* a proposed encrypted tunnel adds 35 ms to each round trip on the five cellular stations. *Steps:* compute the effect on the sequential cycle and on the per-station-channel design. *Expected evidence:* arithmetic and a recommendation. *Rubric:* 3 = correct increases (5 stations × 4 polls × 35 ms = 0.70 s sequential; 0.14 s on the slowest cellular station's own cycle) and a recommendation that ties the tunnel to the channel redesign; 2 = arithmetic right, weak recommendation; 1 = qualitative only; 0 = none. **EX004 — Shared platform list.** *Objective:* find cross-service dependencies. *Inputs:* the KVROC description and your diagram. *Steps:* list four components likely to be shared by water, hospital and grid services and, for each, the first question you would ask its owner. *Expected evidence:* four rows. *Rubric:* 3 = for example virtualization hosts, directory, time source and monitoring collector, each with a specific question (capacity headroom, administrative group, time source redundancy, behaviour when full); 2 = generic questions; 1 = components only; 0 = none. ### Chapter synthesis A critical-sector service is a set of layers joined by three paths. Commands, measurements and changes travel different routes and fail in different ways; the management path holds the most privilege. Request–response polling makes freshness a matter of arithmetic, and timeouts, not bandwidth, usually decide it. Every later chapter adds a technique to one of these paths, so keep the diagram and the budget at hand. ### Continue studying — chapter 01 of 18 [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 →](#ch-02) Continue to the next authored lesson. ## Worked answers **EX001 — Path classification.** HMI → scada-01 "start pump 2": control; worst case an unauthorized start or stop of a pump (overflow, pressure transient). KW-04 → scada-01 reading: monitoring; worst case operators act on a false level. eng-ws-15 → KW-04 project download: management (and indirectly control); worst case replaced controller logic — the most dangerous action on the list, because it changes what the controller does even when no further command is sent. jump-01 → hist-02 SSH: management; worst case altered or deleted historical records, or a foothold in Z2. hist-02 → corporate CSV: monitoring data leaving the control zone; worst case disclosure of operational data or, if implemented as a pull, a corporate credential into Z2 (Chapter 15). **EX002 — Fix the cycle on paper.** Example: (1) poll the four fibre stations and the five cellular stations on separate channels from the three radio stations (three channels: fibre 0.31 s, cellular 6.52 s, radio 4.50 s — cellular still too slow); (2) reduce cellular polls per cycle from 4 to 2 by combining register reads into one request (cellular channel 3.26 s) and give KW-06 its own channel (2 polls × 690 ms = 1.38 s; remaining cellular 1.88 s). With channels of ≤ 4.5 s all healthy stations meet 5 s. Limiting a dead station: a timeout of 800 ms with no immediate retry keeps a dead KW-06 at 1.6 s on its own channel. Full credit verifies by editing `stations`, `TIMEOUT_MS` and the `cycle` function and reports the printed values; any configuration that runs and meets the requirement earns credit if the timeout is justified against real link latency. **EX003 — Tunnel impact.** Sequential: 5 cellular stations × 4 polls × 35 ms = 700 ms, so 11.33 → 12.03 s. Per-station channels: each cellular station's own cycle rises by 4 × 35 = 140 ms; KW-06 becomes 2.90 s, still under 5 s. Recommendation: the tunnel is acceptable only together with the channel redesign (EX002), and its latency should be measured in a pilot, not assumed. **EX004 — Shared platform list.** Virtualization hosts — "What is the headroom if one host fails, and which guests restart where?" Directory — "Who is in the administrator groups, and can operators log in to the HMI if the directory is unreachable?" Time source — "What is the reference, is there a second one, and is offset monitored?" Monitoring collector — "What happens when its disk fills or it stops — do sources buffer, and does anyone get alerted?"