◇ OpenCyber Academy
Technical · Chapter 11 · English

Chapter 11 — Backups and restore

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Backups and restore

Lesson map

Lesson 11 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 What to back up"]
  N2["11.2 Where to keep backups"]
  N3["11.3 Checking integrity"]
  N4["11.4 Reading the result"]
  N5["11.5 Test restores"]
  N6["11.6 How often"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 What to back up"]
  N2["11.2 Where to keep backups"]
  N3["11.3 Checking integrity"]
  N4["11.4 Reading the result"]
  N5["11.5 Test restores"]
  N6["11.6 How often"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX041"]

[Learning outcomes]
    |
    v
[11.1 What to back up]
    |
    v
[11.2 Where to keep backups]
    |
    v
[11.3 Checking integrity]
    |
    v
[11.4 Reading the result]
    |
    v
[11.5 Test restores]
    |
    v
[11.6 How often]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) list what must be backed up on a line; (2) verify backup integrity with hashes; and (3) explain why a restore must be tested.

11.1 What to back up

PLC programs, HMI projects and screens, recipe files, device configurations (switches, firewall, camera settings) and the engineering software licence details. Without them, recovering from failure or attack means rebuilding from memory.

At HPFL that means programs for PLC-FILL and PLC-WRAP, HMI-1's project, recipe files, VIS-CAM's settings and the configurations of FW-1 and the line switches. List each item in the register with the date of its latest backup. An item missing from the list is likely to be missing from the backups too.

11.2 Where to keep backups

At least one copy off the line network, ideally offline, so malware that encrypts the line cannot reach it. Label each with device, date and version.

At HPFL the controls engineer keeps an offline store, which is where an older matching copy of the wrapper program was found. Keep at least two copies of each important backup, and record where each is. Check that the offline copy can be reached during a night shift. Note who may take a copy off site.

11.3 Checking integrity

A hash such as SHA-256 is a fingerprint of a file: any change gives a different value. Record the hash when the backup is made; check it before restoring.

"""Lab 11: verify synthetic PLC backup files against recorded SHA-256 values."""
import hashlib
files = {"PLC-FILL_2026-09.bak": b"fill program v3.2 rungs 1-140",
         "PLC-WRAP_2026-09.bak": b"wrap program v2.0 rungs 1-88 edited"}
recorded = {"PLC-FILL_2026-09.bak": hashlib.sha256(b"fill program v3.2 rungs 1-140").hexdigest(),
            "PLC-WRAP_2026-09.bak": hashlib.sha256(b"wrap program v2.0 rungs 1-88").hexdigest()}
for name, data in files.items():
    h = hashlib.sha256(data).hexdigest()
    print(f"{name:22} {h[:12]} {'MATCH' if h == recorded[name] else 'MISMATCH - do not restore'}")

Run with python3 lab_hash.py. Verified output:

PLC-FILL_2026-09.bak   0278a5f83d56 MATCH
PLC-WRAP_2026-09.bak   9974ecb17bab MISMATCH - do not restore

Store the hashes separately from the backups, for example in the change ticket or a register, so that someone who alters a backup cannot also alter its hash. Lab 11 checks two backup files against recorded hashes and shows what a mismatch looks like.

11.4 Reading the result

The filler backup matches its recorded hash. The wrapper backup does not: its content was edited after the hash was recorded. Restoring it could load a program nobody approved, so it is set aside and reported.

A mismatch does not prove an attack; it proves the file changed after its hash was recorded. At HPFL the edit was traced to an approved but unrecorded adjustment. The procedure was updated so that every change produces a new backup and hash in the same ticket.

11.5 Test restores

A backup never restored is a hope, not a plan. Once or twice a year, restore a program to a spare or lab PLC and compare it with the running one.

Record the test restore in the register with the date, the device, the backup used and the result. If a restore fails, find out why before a real failure forces the question. At HPFL a spare PLC from the shelf could be used for this, after checking it is marked as spare in the register.

11.6 How often

Back up after every approved change and on a fixed monthly date, whichever comes first, so the newest good copy is never far behind the running program.

At HPFL the September backups were the newest before the wrapper edit, which is why a later approved change without a new backup caused confusion. Tie backups to change tickets so that each approved change produces a fresh copy and hash. Check monthly that the newest backup of each device is newer than its last approved change. If not, take a fresh backup and hash it before the next shift.

Worked example (synthetic HPFL)

Tomás reports the mismatch. The controls engineer finds an older, matching copy in the offline store and compares the edited file: someone added a line to the wrapper program after the September backup without a change ticket. The edit is traced to an approved but unrecorded adjustment; the register and procedure are updated.

Synthetic case — HPFL. Files and hashes are produced by the lab with invented contents.

Errors and limits

A matching hash proves the file is unchanged since recording, not that the recorded version was good. Hashes must be stored separately from the backups.

Exercises

Synthesis

Backups are offline, labelled, hashed and test-restored; a mismatch stops a restore.

Continue studying — chapter 11 of 18

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →