Chapter 28 — Field practice
Lesson map
Lesson 28 published. Map, example, EX082.
flowchart TD
N0["Learning outcomes and connection"]
N1["28.1 Planning a visit"]
N2["28.2 Safety first"]
N3["28.3 Evidence collection at site"]
N4["28.4 Removable media and field laptops"]
N5["28.5 Working with operations"]
N6["28.6 Exercises with operators"]
N7["28.8 Practical activity: site work plan"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX082"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["28.1 Planning a visit"]
N2["28.2 Safety first"]
N3["28.3 Evidence collection at site"]
N4["28.4 Removable media and field laptops"]
N5["28.5 Working with operations"]
N6["28.6 Exercises with operators"]
N7["28.8 Practical activity: site work plan"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX082"]
[Learning outcomes and connection]
|
v
[28.1 Planning a visit]
|
v
[28.2 Safety first]
|
v
[28.3 Evidence collection at site]
|
v
[28.4 Removable media and field laptops]
|
v
[28.5 Working with operations]
|
v
[28.6 Exercises with operators]
|
v
[28.8 Practical activity: site work plan]
|
v
[Worked example] --> [Exercise EX082]
Learning outcomes and connection
After this chapter you should be able to:
- plan and carry out a site visit to a remote operational site safely and with the operator's agreement;
- collect configuration and inventory evidence at a site without disturbing the process;
- work with operations staff as partners, respecting their authority over the physical process;
- take part in an exercise that tests the service's integration with continuity plans.
Much of a critical-service technologist's work happens away from the desk: at pumping stations, plant rooms, depots and hospital equipment rooms. Field work brings physical risks, operational risks and security risks of its own. This chapter is about doing it well.
28.1 Planning a visit
Before going to PS-07, agree with Water operations: purpose and tasks; date and time (avoiding peak demand and other planned work); who will be present from Water (site work on control equipment is done by or with Water's engineers); access arrangements (keys, alarms, lone-working procedure); what equipment you bring (a laptop that is clean, patched and dedicated to field work, with only the tools needed); and what you will and will not touch. Write it in a short work plan and get it approved like a change (Chapter 14).
28.2 Safety first
Physical safety rules at operational sites come from the operator and from health-and-safety law: confined spaces, chemicals (chlorine dosing rooms), electrical panels, lone working, weather. Follow the site's induction and the operator's instructions; if in doubt, stop and ask. Security work never justifies a safety shortcut.
At PS-07, the chlorine dosing room is part of the visit route; Water's engineer leads and decides where you may stand.
Lone working at a station like PS-09, silent for three weeks, needs a check-in arrangement with the Water control room before the visit, not after.
28.3 Evidence collection at site
Field visits are the moment to verify what remote sources cannot: the physical presence and labels of devices (Chapter 11); firmware versions read from the device or its engineering export by Water's engineer; cabling that may create undeclared paths (a second network cable to a cellular modem, a laptop left connected); physical protection of the station gateway that holds HMAC keys (Chapter 15); and the state of local buffering and time. Photograph labels and panels only with permission and without capturing passwords or screens with sensitive data. Record everything with time and source, under observed / inferred / done / open.
28.4 Removable media and field laptops
Field equipment is a classic path into control systems: USB drives and maintenance laptops carry malware between sites and networks. Use dedicated, scanned media; never connect a personal device; never connect a field laptop to the corporate network and a station network at the same time; record what was connected to what. CISA's performance goals include controls on connecting unauthorized devices and media to OT networks (CISA CPGs).
PS-07's cellular modem, installed by Kell for remote support and still attached to the PLC's second port, shows the same risk from a supplier's side: a connection nobody recorded.
28.5 Working with operations
Operations staff hold authority over the process and knowledge that no document contains. Ask them what they would expect to see if the station were misbehaving; how they would run it manually; what changed recently. Explain what you are doing in plain language, and stop if they ask you to. Many of the best findings at site come from conversations: "we sometimes plug the vendor's laptop into that spare port" is worth more than a scan.
At PS-07, the modem was explained by the engineer in one sentence; no scan would have told its history.
28.6 Exercises with operators
A tabletop exercise walks through a scenario in discussion; a functional exercise performs some actions for real in a controlled way. For LANTERN, an annual exercise with Water operations tests the "telemetry unreliable" trigger (Chapter 21): FSTS declares it, the control room switches to manual readings at selected stations, and both sides time each step and record problems. The exercise is planned with rules of engagement (Chapter 23) and stop conditions, and ends with a blameless review (Chapter 25).
PS-09's three silent weeks are a good tabletop starting point.
28.7 Worked example: the PS-07 visit (synthetic)
You visit PS-07 with Water's engineer to read the PLC firmware (for Chapter 16's advisory) and inspect the station gateway. Findings: the PLC's firmware, read by the engineer from the device, is 3.9 as recorded. The gateway's enclosure is unlocked and its key file is on a removable card — physical protection is weaker than the design assumed. A cellular modem, not in any inventory, is connected to the PLC's second port; the engineer explains Kell installed it years ago for remote support and nobody uses it now. The station's clock is correct. You do not unplug the modem — that is a change to an operational site — but you record it, photograph its label with permission, and the engineer raises a change to remove it after Water confirms nothing depends on it. The modem is an undeclared conduit (Chapter 2) that no flow record would ever have shown.
28.8 Practical activity: site work plan
Write a site work plan for the PS-09 visit (Chapter 11 discrepancies: firmware not independently verified, station silent for three weeks). Include every element of "Planning a visit" above, safety notes, the evidence you intend to collect, what you will not touch, and how findings will be recorded and raised.
For PS-09, the plan's evidence list should include the RTU's firmware read from the device, the station clock against the relay's, and the state of the NTP path, given the 422-second offset found in Chapter 20. List what you will not touch, such as the RTU configuration and the gateway's key file, and who raises the change if a modem like PS-07's is found.
28.9 Common errors and limits
- Visits without an approved plan or without Water's engineer.
- Field laptops used for other work or connected to several networks.
- Fixing things at site without change control.
- Photographs that capture passwords or sensitive screens.
- Treating operations staff as obstacles rather than partners.
- Exercises without stop conditions.
Unplugging PS-07's modem on the spot would have been the third error, however obviously unused it looked; Water confirmed first that nothing depended on it, and the engineer raised the change.
The unlocked gateway enclosure at PS-07 marks a limit of the visit itself: you can record that the HMAC key file sits on a removable card, but locking the enclosure or moving the key is Water's change, not yours to make on the day.
Exercises — chapter 28
EX082 — Record the modem. Objective: write field findings correctly. Inputs: Chapter 28 ("Worked example: the PS-07 visit"). Constraints: observed / inferred / done / open labels; no recommendation to act without change control. Steps: write the finding record and say which registers must be updated. Expected evidence: record. Rubric: 3 = observed (modem present, model/label, connected to PLC port 2, engineer's account), inferred (undeclared remote path, possibly active), done (photographed with permission, change raised by Water), open (whether it is powered and has a working SIM, who holds the account, removal date); inventory, conduit list, data-flow register and risk register updated; 2 = labels mixed; 1 = narrative; 0 = none.
EX083 — Field laptop rules. Objective: define field equipment controls. Inputs: Chapter 28 ("Removable media and field laptops"). Constraints: six rules, each with how it is checked. Steps: write them. Expected evidence: table. Rubric: 3 = dedicated device, patched and hardened, no personal use, never dual-connected, removable media scanned and dedicated, connection log kept, device checked after each visit; each with a check; 2 = four or five; 1 = generic; 0 = none.
EX084 — Exercise plan. Objective: plan a functional exercise. Inputs: trigger "telemetry unreliable" (Chapter 21). Constraints: two stations; no effect on supply; one hour. Steps: write objectives, scenario, participants, steps with timing points, stop conditions, safety notes, and how results are recorded. Expected evidence: one page. Rubric: 3 = measurable objectives (time to declare, time to first manual reading), realistic scenario, control room authority preserved, stop conditions on any process concern, safety at sites, blameless review scheduled; 2 = one element weak; 1 = tabletop only; 0 = none.
Chapter synthesis
Field work verifies what remote sources cannot and brings its own risks. Plan visits with the operator, follow site safety rules, work with operations' engineers on control equipment, and collect evidence without disturbing the process or changing anything outside change control. Control field laptops and media strictly. Treat operations staff as partners, and exercise the service's integration with continuity plans in planned, stoppable exercises.
Continue studying — chapter 28 of 30
← Chapter 27 · Course chapter index · Chapter 29 →
Continue to the next authored lesson.