◇ OpenCyber Academy
Technical · Chapter 18 · English

Chapter 18 — Capstone: a security walk-through of the line

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 18 — Capstone: a security walk-through of the line

Lesson map

Lesson 18 published. Map, example, EX069.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Planning"]
  N2["18.2 What to check"]
  N3["18.3 Writing findings"]
  N4["18.4 Prioritising"]
  N5["18.5 Following up"]
  N6["18.6 Presenting to the supervisor"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX069"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Planning"]
  N2["18.2 What to check"]
  N3["18.3 Writing findings"]
  N4["18.4 Prioritising"]
  N5["18.5 Following up"]
  N6["18.6 Presenting to the supervisor"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX069"]

[Learning outcomes]
    |
    v
[18.1 Planning]
    |
    v
[18.2 What to check]
    |
    v
[18.3 Writing findings]
    |
    v
[18.4 Prioritising]
    |
    v
[18.5 Following up]
    |
    v
[18.6 Presenting to the supervisor]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX069]

Learning outcomes

You will (1) combine the book's skills into one planned walk-through; (2) produce a short findings list with priorities; and (3) present it to the supervisor and engineer.

18.1 Planning

Agree scope, date and permit with the supervisor: which cabinets, which records, no connections to devices, stop conditions. Bring the asset register, network drawing, rule table and media and remote-access logs.

Write the plan on the permit: the time window, the cabinets to be opened by an electrician, the records to be checked and the stop conditions. At HPFL the walk-through had a two-hour permit. Agree beforehand who will receive the findings and when. Book the date well before so that operations can plan around it.

18.2 What to check

Physical: cabinets locked, no unexplained modems or switches, no passwords on panels, no loose USB drives. Records: register complete, backups recent and hashes matching, advisories recorded, changes closed. Access: vendor accounts disabled outside sessions, admin use limited.

Use a checklist so that nothing is missed and so the next walk-through can be compared with this one. At HPFL the checklist led Tomás to the modem in the filler cabinet, ENG-LT's old anti-malware signatures, the outdated drawing and a recipe drive missing from the media log.

18.3 Writing findings

Each finding: what you saw, where, why it matters (consequence), suggested fix, owner. Keep evidence (photographs, log extracts) with it.

Write findings during or right after the walk-through, while details are fresh. At HPFL the cellular modem finding included its location in the filler cabinet, a photograph and the consequence that someone could reach the filler from outside. Each finding needs one owner who agrees to act. Keep each finding to a few lines so it can be read quickly in the meeting. Separate what you saw from what you think it means.

18.4 Prioritising

Order by consequence and ease: anything that gives an unreviewed path to PLCs comes first; tidy-ups last. Present the top three clearly; long lists hide the important items.

At HPFL the modem came first because it was an unreviewed path to a PLC. ENG-LT's old anti-malware signatures came second, because that laptop programs the PLCs. The missing drive and the outdated drawing followed. Write a one-line reason for each ranking. Agree the order with the supervisor, who may know production reasons for changing it.

18.5 Following up

Agree owners and dates in the meeting, then check progress monthly.

Record the owners and dates in a short list shared with the supervisor. At each monthly check, note what was completed and what slipped, with a reason. At HPFL the next walk-through should start by confirming that the filler cabinet modem has been disconnected or controlled. Findings that keep slipping are raised with the supervisor rather than quietly carried forward. Close each item only with evidence that it was done.

18.6 Presenting to the supervisor

Use plain language and consequences the supervisor cares about: "this modem could let someone change the filler from outside" works better than protocol names. Bring photographs, keep to ten minutes, and end with the decisions you need: owner, date and any production window. Thank the operators who helped; their cooperation decides whether the next walk-through is welcome.

Send a short written summary afterwards with the findings, owners and dates. Keep a copy of the summary with the walk-through evidence, so the next walk-through can start by checking what changed since. If the supervisor does not agree with a ranking, record the disagreement and the reason.

Worked example (synthetic HPFL)

Tomás's walk-through, under a two-hour permit, finds: (1) a cellular modem connected inside the filler cabinet and missing from the register; (2) ENG-LT anti-malware signatures 40 days old; (3) the network drawing at revision 3 while the IoT VLAN exists only in revision 4 drafts; (4) one recipe drive missing from the media log. He ranks the modem first, the laptop second, the drive third and the drawing fourth, and the supervisor assigns owners.

Synthetic case — HPFL. The findings are invented.

Errors and limits

A walk-through is a snapshot; issues return without regular repetition. It does not replace a professional assessment against IEC 62443.

Exercises

Synthesis

A planned walk-through ties inventory, access, backups, changes and evidence into ranked, owned fixes.

Continue studying — chapter 18 of 18

← Chapter 17 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →