◇ OpenCyber Academy
Technical · Chapter 1 · English

Chapter 1 — Computing and service architecture

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 1 — Computing and service architecture

Lesson map

Lesson 01 published. Map, example, EX001.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["1.1 The layers of a supervisory control service"]
  N2["1.2 Three paths, three protection problems"]
  N3["1.3 Polling and freshness"]
  N4["1.4 Shared platforms"]
  N5["1.6 Practical activity: draw your own three-path dia"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["1.1 The layers of a supervisory control service"]
  N2["1.2 Three paths, three protection problems"]
  N3["1.3 Polling and freshness"]
  N4["1.4 Shared platforms"]
  N5["1.6 Practical activity: draw your own three-path dia"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]

[Learning outcomes and connection]
    |
    v
[1.1 The layers of a supervisory control service]
    |
    v
[1.2 Three paths, three protection problems]
    |
    v
[1.3 Polling and freshness]
    |
    v
[1.4 Shared platforms]
    |
    v
[1.6 Practical activity: draw your own three-path dia]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX001]

Learning outcomes and connection

After this chapter you should be able to:

This is the first chapter of a hands-on course. Everything later — protocol decoding, hardening, detection, troubleshooting — assumes you can point at a box on the diagram and say what traffic it sends, what it stores and what breaks if it stops. The entry knowledge (networks, operating systems, scripting) is assumed; the new element is the physical process at the other end of the wire.

1.1 The layers of a supervisory control service

Most critical-sector services that move water, power, air or people share a recognizable layered shape. NIST's guide to operational technology describes the same components in general terms (SP 800-82 Rev. 3); the names below are the ones used in this book.

1.2 Three paths, three protection problems

A technician should be able to trace three different paths on the diagram.

The control path carries commands to the process: HMI → SCADA server → link → controller → actuator. Integrity and availability of this path are what keep people safe; an unauthorized or corrupted write here is the worst case in this book.

The monitoring path carries measurements back: sensor → controller → link → SCADA server → historian and HMI. If it is wrong, operators act on false information — a failure that can be as dangerous as a bad command, and harder to notice.

The management path changes the system itself: an engineer downloading new logic, an administrator patching the historian, a vendor connecting to diagnose a fault. It is used rarely but holds the most privilege, and it is where most real intrusions into control environments have been reported to begin; CISA's alert on the December 2015 attacks on Ukrainian distribution companies describes remote access and credential use preceding the operational impact (CISA IR-ALERT-H-16-056-01).

The three paths often share cables, switches and servers. Drawing them separately is how you discover that a "monitoring" laptop on the control-centre switch can also reach controller programming ports.

1.3 Polling and freshness

Most station protocols in this book are request–response: the SCADA server asks, the device answers. The time to refresh every station once is the poll cycle. For each station it is roughly polls per cycle × (link round-trip time + device turnaround time). If the server polls stations one after another on a single channel, the cycle is the sum over stations; if it has an independent channel per station, the cycle is set by the slowest station.

Two consequences matter for security work. First, a slow link (a congested cellular router, a degraded radio path) stretches the cycle for everyone polled after it. Second, a device that does not answer costs the full timeout on every poll, so one dead station can stretch the cycle more than a slow one. Freshness requirements — "every station refreshed at least every 5 s" — therefore depend on timeouts and retry counts as well as link speed, and a security control that adds latency (a VPN, an inspection proxy) must be checked against this budget before it goes in.

1.4 Shared platforms

Modern control centres run their SCADA servers, historians and directory on virtualization hosts, often shared between services. A shared hypervisor, directory, time source or storage array is a point where a fault in one sector becomes a fault in several. Lab 15 in Chapter 15 traces these dependencies with code; here, simply learn to mark every shared component on the diagram with the services that depend on it.

At KVROC the host esx-02 runs the SCADA server, the historian and the hospital BMS server, so its outage or a bad patch can affect water and healthcare monitoring together. Mark each shared component with every service that depends on it, and ask who owns the host when those services disagree about a change window.

1.5 Worked example: the Kestrel Vale operations centre (synthetic)

You are a technical officer at the Kestrel Vale Regional Operations Centre (KVROC), which runs supervisory systems for Kestrel Water (12 stations, KW-01 to KW-12), monitoring of building-management systems for Kestrel General Hospital, and the telecontrol front end for one substation (SS-3) of Kestrel Grid. Station RTUs sit in 10.10.0.0/16 (KW-n is 10.10.n.2); the control centre is 10.20.0.0/24 (SCADA server scada-01 10.20.0.10, engineering workstation eng-ws-15 10.20.0.15, historian hist-02 10.20.0.21); corporate desks are 10.30.0.0/16; the management network is 10.90.0.0/24 (jump host jump-01 10.90.0.20). All names and addresses are fictional.

Operations require every station refreshed within 5 seconds. scada-01 polls all twelve stations on one channel. Lab 1 computes the budget.

Lab 1 (save as lab01.py, run with python3 lab01.py):

# Lab 1 - poll-cycle budget for a SCADA server polling stations (offline, standard library only)
# Synthetic Kestrel Water figures. Each poll = request + response over the link plus device turnaround.
stations = {  # name: (link, round-trip ms on the link, device turnaround ms, polls per cycle)
 "KW-01": ("fibre", 4, 20, 3), "KW-02": ("fibre", 4, 20, 3), "KW-03": ("fibre", 5, 25, 3),
 "KW-04": ("cellular", 180, 40, 4), "KW-05": ("cellular", 210, 40, 4), "KW-06": ("cellular", 650, 40, 4),
 "KW-07": ("radio", 420, 60, 3), "KW-08": ("radio", 460, 60, 3), "KW-09": ("cellular", 190, 40, 4),
 "KW-10": ("fibre", 4, 20, 3), "KW-11": ("radio", 440, 60, 3), "KW-12": ("cellular", 200, 40, 4),
}
REQUIRED_S = 5.0          # operations require every station refreshed at least every 5 s
TIMEOUT_MS = 1500         # a poll that gets no reply costs the full timeout
def cycle(stations, sequential=True, dead=()):
    per = {}
    for n, (link, rtt, turn, polls) in stations.items():
        per[n] = polls * (TIMEOUT_MS if n in dead else rtt + turn)
    return (sum(per.values()) if sequential else max(per.values())) / 1000, per
c, per = cycle(stations)
print(f"sequential cycle {c:.2f} s (requirement {REQUIRED_S} s) -> {'OK' if c <= REQUIRED_S else 'FAILS'}")
worst = max(per, key=per.get); print(f"slowest station {worst}: {per[worst] / 1000:.2f} s per cycle")
c2, _ = cycle(stations, dead={"KW-06"})
print(f"sequential with KW-06 not answering: {c2:.2f} s")
c3, _ = cycle(stations, sequential=False, dead={"KW-06"})
print(f"one polling channel per station, KW-06 dead: {c3:.2f} s")

Expected output (Python 3.13.5):

sequential cycle 11.33 s (requirement 5.0 s) -> FAILS
slowest station KW-06: 2.76 s per cycle
sequential with KW-06 not answering: 14.57 s
one polling channel per station, KW-06 dead: 6.00 s

The result says the requirement is already failed (11.33 s), mostly because of cellular and radio stations, with KW-06 the slowest. A dead KW-06 adds a further 3.24 s because every unanswered poll costs 1.5 s. Even with a channel per station the cycle is 6.00 s while KW-06 is dead: per-station channels remove the sum problem but not the timeout problem. A technician who is asked to "add an encrypted tunnel to the cellular stations" now knows the question to ask first: how many milliseconds does it add per poll, and what does that do to an already failing cycle?

1.6 Practical activity: draw your own three-path diagram

Using the KVROC description, draw the control, monitoring and management paths in three colours. Mark every component that appears on more than one path, and every shared platform component. Keep the drawing: Chapters 6, 10 and 15 refine it.

Use three colours or three page layers so that a shared switch or jump host stands out. Then check whether eng-ws-15 appears on both the management path and the control path: if it does, a compromise of that workstation reaches every station. Keep the drawing with Lab 1's budget, because a later tunnel or encryption proposal has to be judged against both the paths and the poll cycle.

1.7 Common errors and limits

Exercises — chapter 1

EX001 — Path classification. Objective: separate the three paths. Inputs: these flows: HMI → scada-01 "start pump 2"; KW-04 RTU → scada-01 level reading; eng-ws-15 → KW-04 project download; jump-01 → hist-02 SSH; hist-02 → corporate report server CSV export. Steps: classify each as control, monitoring or management (or a combination) and state the worst consequence if an unauthorized party could alter it. Expected evidence: a five-row table. Rubric: 3 = correct classes with the project download recognized as the most dangerous management action and the CSV export recognized as a cross-zone monitoring flow; 2 = one misclassification; 1 = classes without consequences; 0 = none.

EX002 — Fix the cycle on paper. Objective: use the poll-cycle model. Inputs: Lab 1. Steps: propose two changes that bring the sequential cycle under 5 s with all stations healthy, and say which also limits the effect of one dead station. Change the lab to test them. Expected evidence: modified parameters and the new printed cycle times. Rubric: 3 = changes are realistic (separate channels for slow link types, fewer polls per cycle for slow stations, a shorter timeout with a justified retry policy) and verified by running the lab; 2 = correct but unverified; 1 = "buy faster links" only; 0 = none.

EX003 — Tunnel impact. Objective: check a security control against an operational budget. Inputs: a proposed encrypted tunnel adds 35 ms to each round trip on the five cellular stations. Steps: compute the effect on the sequential cycle and on the per-station-channel design. Expected evidence: arithmetic and a recommendation. Rubric: 3 = correct increases (5 stations × 4 polls × 35 ms = 0.70 s sequential; 0.14 s on the slowest cellular station's own cycle) and a recommendation that ties the tunnel to the channel redesign; 2 = arithmetic right, weak recommendation; 1 = qualitative only; 0 = none.

EX004 — Shared platform list. Objective: find cross-service dependencies. Inputs: the KVROC description and your diagram. Steps: list four components likely to be shared by water, hospital and grid services and, for each, the first question you would ask its owner. Expected evidence: four rows. Rubric: 3 = for example virtualization hosts, directory, time source and monitoring collector, each with a specific question (capacity headroom, administrative group, time source redundancy, behaviour when full); 2 = generic questions; 1 = components only; 0 = none.

Chapter synthesis

A critical-sector service is a set of layers joined by three paths. Commands, measurements and changes travel different routes and fail in different ways; the management path holds the most privilege. Request–response polling makes freshness a matter of arithmetic, and timeouts, not bandwidth, usually decide it. Every later chapter adds a technique to one of these paths, so keep the diagram and the budget at hand.

Continue studying — chapter 01 of 18

← Course home · Course chapter index · Chapter 02 →

Continue to the next authored lesson.

Worked answers

EX001 — Path classification. HMI → scada-01 "start pump 2": control; worst case an unauthorized start or stop of a pump (overflow, pressure transient). KW-04 → scada-01 reading: monitoring; worst case operators act on a false level. eng-ws-15 → KW-04 project download: management (and indirectly control); worst case replaced controller logic — the most dangerous action on the list, because it changes what the controller does even when no further command is sent. jump-01 → hist-02 SSH: management; worst case altered or deleted historical records, or a foothold in Z2. hist-02 → corporate CSV: monitoring data leaving the control zone; worst case disclosure of operational data or, if implemented as a pull, a corporate credential into Z2 (Chapter 15).

EX002 — Fix the cycle on paper. Example: (1) poll the four fibre stations and the five cellular stations on separate channels from the three radio stations (three channels: fibre 0.31 s, cellular 6.52 s, radio 4.50 s — cellular still too slow); (2) reduce cellular polls per cycle from 4 to 2 by combining register reads into one request (cellular channel 3.26 s) and give KW-06 its own channel (2 polls × 690 ms = 1.38 s; remaining cellular 1.88 s). With channels of ≤ 4.5 s all healthy stations meet 5 s. Limiting a dead station: a timeout of 800 ms with no immediate retry keeps a dead KW-06 at 1.6 s on its own channel. Full credit verifies by editing stations, TIMEOUT_MS and the cycle function and reports the printed values; any configuration that runs and meets the requirement earns credit if the timeout is justified against real link latency.

EX003 — Tunnel impact. Sequential: 5 cellular stations × 4 polls × 35 ms = 700 ms, so 11.33 → 12.03 s. Per-station channels: each cellular station's own cycle rises by 4 × 35 = 140 ms; KW-06 becomes 2.90 s, still under 5 s. Recommendation: the tunnel is acceptable only together with the channel redesign (EX002), and its latency should be measured in a pilot, not assumed.

EX004 — Shared platform list. Virtualization hosts — "What is the headroom if one host fails, and which guests restart where?" Directory — "Who is in the administrator groups, and can operators log in to the HMI if the directory is unreachable?" Time source — "What is the reference, is there a second one, and is offset monitored?" Monitoring collector — "What happens when its disk fills or it stops — do sources buffer, and does anyone get alerted?"