Chapter 10 — Patches and security advisories
Lesson map
Lesson 10 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Where advisories come from"]
N2["10.2 Reading one"]
N3["10.3 Why not patch immediately"]
N4["10.4 Recording the decision"]
N5["10.5 HMI and laptop updates"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Where advisories come from"]
N2["10.2 Reading one"]
N3["10.3 Why not patch immediately"]
N4["10.4 Recording the decision"]
N5["10.5 HMI and laptop updates"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX037"]
[Learning outcomes]
|
v
[10.1 Where advisories come from]
|
v
[10.2 Reading one]
|
v
[10.3 Why not patch immediately]
|
v
[10.4 Recording the decision]
|
v
[10.5 HMI and laptop updates]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) read an ICS advisory and find the facts that matter; (2) match an advisory to the asset register; and (3) explain why plants often mitigate before they patch.
10.1 Where advisories come from
Vendors and CISA publish advisories for industrial products; CISA's index lists them with product names, affected versions, impact and mitigations. An advisory is the starting point, not the decision.
At HPFL the controls engineer and Tomás check advisories for the makers of PLC-FILL, PLC-WRAP, HMI-1 and VIS-CAM. Matching each one against the register tells them quickly whether any action is needed, and the register's firmware fields make that possible. Note in the record where each advisory came from and when it was read, and whether it has since been revised.
10.2 Reading one
Find five facts: product and model, affected versions, what an attacker could do, whether it needs network or physical access, and the vendor's fix or workaround. Then look up the register: do we have that model, at that version, reachable in that way?
At HPFL the advisory affecting PLC-WRAP needed network access to its programming port, and FW-1 already allowed that only from ENG-LT. Answering the five questions made that clear within minutes. Record the answers in the advisory record, even when the result is that no action is needed.
10.3 Why not patch immediately
A firmware update on a PLC stops it, may change behaviour and needs testing with the program. Food plants also need quality checks after changes. So the usual order is: confirm exposure, apply a mitigation quickly (for example, block the vulnerable service at the firewall), then schedule the patch for a planned stop with a rollback plan.
At HPFL the mitigation for PLC-WRAP was already in place on FW-1, and the patch was scheduled for a planned stop three weeks later. The rollback plan should name the saved program and firmware version to return to if the update causes problems.
10.4 Recording the decision
Each advisory gets a record: applies or not, why, mitigation, planned patch date, owner. A decision not to patch, with reasons and a review date, is still a decision.
Keep the records in one place, linked to the register, so that a later reader can see which advisories were considered and why. Review open items monthly. A record without a review date tends to be forgotten. At HPFL the record for the PLC-WRAP advisory named FW-1's existing rule as the mitigation and gave the date of the planned stop for the patch. When the patch is applied, the record is closed with the new firmware version.
10.5 HMI and laptop updates
Windows-based HMIs and ENG-LT also need operating system updates, but only those the HMI vendor has approved, installed during planned stops.
Ask the HMI vendor which updates are approved, and record each update in the register and change ticket. Test after updating that screens show correct values and that HMI-1 still communicates with both PLCs. Updates for ENG-LT follow the same planned approach. Keep the previous image or restore point so the update can be undone if screens or communication fail. Never let an HMI update itself automatically from the internet; that would need a connection the line should not have.
Worked example (synthetic HPFL)
A synthetic advisory states that firmware 2.0 of the wrapper's PLC model allows unauthenticated program changes over the network. The register (after Chapter 5) says PLC-WRAP runs 2.0. The controls engineer confirms FW-1 already blocks the programming port from everything except ENG-LT, records that as the mitigation, and schedules firmware 2.3 for the next planned stop in three weeks.
Synthetic case — HPFL. The advisory and versions are invented; real advisories are at cisa.gov.
Errors and limits
Advisories can be revised; recheck before acting. Version strings may be reported differently on labels and in software.
Exercises
- EX037 — Five facts. List the five facts to extract from an advisory. Rubric: 3 = product/model, versions, impact, access needed, fix/workaround; 2 = four; 1 = two; 0 = none.
- EX038 — Does it apply? An advisory affects versions before 2.2 of PLC-FILL's model; PLC-FILL runs 3.2. Applies? Rubric: 3 = no, 3.2 is later, record as not applicable with reason; 2 = no; 1 = yes; 0 = none.
- EX039 — Mitigate first. Why does the engineer mitigate at FW-1 before patching PLC-WRAP? Rubric: 3 = patch needs stop/testing/quality; firewall reduces exposure now; 2 = one; 1 = "lazy"; 0 = none.
- EX040 — Record of a deferred patch. Write the advisory record for PLC-WRAP. Rubric: 3 = applies, reason, mitigation, planned date, owner, review; 2 = most; 1 = "patch later"; 0 = none.
Synthesis
Advisories are matched against the register, mitigated quickly and patched at a planned, tested stop.
Continue studying — chapter 10 of 18
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →