Chapter 13 — IoT devices on the factory floor | Technical OT, IoT and cyber-physical security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 13 — IoT devices on the factory floor

Lesson map

Lesson 13 published. Map, example, EX049.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 What counts as IoT here"]
  N2["13.2 A baseline to check against"]
  N3["13.3 Connecting safely"]
  N4["13.4 End of support"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX049"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 What counts as IoT here"]
  N2["13.2 A baseline to check against"]
  N3["13.3 Connecting safely"]
  N4["13.4 End of support"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX049"]

[Learning outcomes]
    |
    v
[13.1 What counts as IoT here]
    |
    v
[13.2 A baseline to check against]
    |
    v
[13.3 Connecting safely]
    |
    v
[13.4 End of support]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX049]

Learning outcomes

You will (1) identify IoT devices on a line; (2) check them against a baseline of ETSI EN 303 645 provisions; and (3) decide how to connect them safely.

13.1 What counts as IoT here

Smart energy meters, wireless vibration sensors, the vision camera, a cloud-connected label printer and tablets used by quality staff. They often arrive through purchasing rather than engineering, so nobody checks them first.

At HPFL the quality team asked for wireless vibration sensors on the wrapper motors, and the vision camera is already in place. Each of these devices should appear in the register, with an owner and the network it uses. Purchasing should involve the network owner before ordering. Ask purchasing to tell you about every networked device ordered.

13.2 A baseline to check against

ETSI EN 303 645 sets baseline security provisions for consumer IoT, and NIST IR 8259 describes what manufacturers should do. Both are useful checklists for plant devices too. Questions to ask a supplier: are there universal default passwords? Is there a way to report vulnerabilities? Will software updates be provided and for how long? Is communication encrypted? Can the device be reset and its data deleted?

Send the questions to the supplier before purchase and keep the answers with the purchase record. Where possible, check claims on delivery: does the device force a password change at setup, and does it really use TLS? An answer that cannot be checked is still useful, but it should be marked as a claim.

13.3 Connecting safely

IoT devices that talk to a vendor cloud belong in their own segment, not the line VLAN. Allow only the cloud addresses they need, block them from reaching PLCs, and record them in the register with an owner and an update plan.

At HPFL the network owner chose a new IoT VLAN for the VIB-1 to VIB-4 gateway rather than the line VLAN 20, because the sensors report to a vendor cloud. Check after installation that the gateway cannot reach the PLCs, with the network owner, through a rule review rather than probing.

13.4 End of support

When a supplier stops publishing updates, plan replacement. A cheap sensor left unpatched for years on the line network is an easy foothold.

Record the supplier's stated support period in the register, so that the end of support can be planned well before it arrives. At HPFL the vibration sensor supplier promised updates for five years; the replacement date belongs in the register next to the device entry. If a device must stay after support ends, tighten its isolation and record the decision with a review date. Tell the owner well in advance so that budget can be planned.

Worked example (synthetic HPFL)

Quality wants wireless vibration sensors VIB-1 to VIB-4 on the wrapper motors, reporting to a vendor cloud. Tomás sends the supplier the five questions. Answers: unique passwords per device, a published disclosure address, updates for five years, TLS to the cloud, factory reset documented. The network owner puts the sensor gateway on a new IoT VLAN allowed only to the vendor's cloud addresses.

Synthetic case — HPFL. The sensors and supplier answers are invented.

Errors and limits

Supplier answers are claims; check what you can (for example, that the device forced a password change at setup). ETSI EN 303 645 targets consumer products, so industrial devices may need further requirements from IEC 62443-4-2.

Exercises

EX049 — Spotting IoT. List three IoT devices that might appear at HPFL outside the engineering drawings. Rubric: 3 = three plausible devices; 2 = two; 1 = one; 0 = none.
EX050 — Supplier questions. Write the five baseline questions to a supplier. Rubric: 3 = default passwords, disclosure, update period, encryption, reset/deletion; 2 = four; 1 = two; 0 = none.
EX051 — Placement. Where should the VIB sensor gateway connect, and what should it be allowed to reach? Rubric: 3 = separate IoT VLAN; only vendor cloud; blocked from PLCs; 2 = separate only; 1 = line VLAN; 0 = none.
EX052 — Updates ended. The label printer supplier announces end of support. What does Tomás record and plan? Rubric: 3 = register status, risk note, compensating isolation, replacement plan/date; 2 = some; 1 = ignore; 0 = none.

Synthesis

Floor IoT is checked against a baseline, isolated to what it needs and replaced when support ends.

Continue studying — chapter 13 of 18

← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →