Chapter 13 — OT, IoT and cyber-physical security: risk scenarios
Lesson map
Lesson 13 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["13.1 Scenario structure"]
N2["13.2 Scales"]
N3["13.3 Safeguards"]
N4["13.4 Ranking"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["13.1 Scenario structure"]
N2["13.2 Scales"]
N3["13.3 Safeguards"]
N4["13.4 Ranking"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX037"]
[Learning outcomes]
|
v
[13.1 Scenario structure]
|
v
[13.2 Scales]
|
v
[13.3 Safeguards]
|
v
[13.4 Ranking]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) write risk scenarios that link a threat, a path and a physical consequence; (2) estimate likelihood and consequence on simple scales; (3) identify existing safeguards; and (4) rank scenarios for action.
13.1 Scenario structure
A useful scenario reads: "[Threat] uses [path] to cause [action], leading to [consequence], unless [safeguard] works." For NCS: "Office ransomware uses the office → control flow to encrypt HMI-C, leaving operators without a screen; cooling continues on PLC logic, but alarms are invisible until the screen is restored, unless the cloud logger alerts reach the duty manager's phone."
Priya's three NCS scenarios follow this form: contractor remote tool misused to change freezer setpoints, office ransomware reaching HMI-C, and an internet-exposed camera used as a foothold.
13.2 Scales
A three-point consequence scale suits a small site: 1 = inconvenience, 2 = stock loss or regulatory issue, 3 = harm to people or loss of the business. Likelihood, also 1–3, is a judgement based on exposure and known threat activity. Write the reason beside each score.
Priya's scores show the scale in use: the contractor-tool scenario is consequence 2, because a changed freezer setpoint means stock loss rather than harm to people, and likelihood 2, because the tool was always on but the contractor's credentials were not known to be exposed. The camera foothold is consequence 1, likelihood 2. Each score has its reason written beside it.
13.3 Safeguards
Existing safeguards change the story. Independent ammonia detection makes a cyber-caused gas release unlikely to go unnoticed. Cloud logger alerts provide a second view of temperature. PLC logic keeps cooling if the HMI is lost. Listing safeguards stops scenarios from sounding worse than they are — and shows which safeguard is doing a lot of work.
At NCS, the cloud logger alerts carry the contractor-tool scenario: they are the safeguard that would reveal a changed freezer setpoint.
If a contractor's tool changed a setpoint, the alerts would show the room warming before the stock was spoiled.
13.4 Ranking
Rank by consequence first, then likelihood, then how cheaply the scenario can be reduced. A scenario with consequence 2 and an easy fix often deserves action before a consequence-3 scenario whose safeguard is already strong.
Priya's ranking follows this rule. The contractor-tool and office-ransomware scenarios both score consequence 2 and likelihood 2; ransomware comes second only because its safeguard, PLC logic that keeps cooling without HMI-C, is stronger than the cloud alerts protecting against a changed setpoint. Removing rule 9 then went first among the controls, because it was cheap and reduced two scenarios at once, as Chapter 18 explains.
Worked example (synthetic NCS)
Priya's top three: (1) contractor remote tool misused to change freezer setpoints (consequence 2, likelihood 2, safeguard: cloud logger alerts — fix: supervised sessions); (2) office ransomware reaches HMI-C (2, 2, safeguard: PLC keeps cooling — fix: remove rule 9); (3) internet-exposed camera used as foothold (1, 2 — fix: move to camera zone).
Synthetic case — Northgate Cold Storage. Scores are illustrative.
Errors and limits
Simple scales hide differences within a category. Likelihood for deliberate attack changes quickly with news of campaigns; revisit.
Exercises
- EX037 — Completing a scenario sentence. Write a scenario for "falsified logger readings" using the five-part structure. Rubric: 3 = all five parts; 2 = four; 1 = vague; 0 = none.
- EX038 — Scoring with reasons. Score scenario 1's consequence and justify it. Rubric: 3 = 2 with stock/food-safety reasoning and safeguard noted; 2 = score only; 1 = 3 without reason; 0 = none.
- EX039 — A safeguard doing heavy lifting. Which safeguard appears in more than one scenario, and what does that imply? Rubric: 3 = cloud logger alerts (or PLC autonomy); single point to protect and test; 2 = name only; 1 = wrong; 0 = none.
Synthesis
Scenarios connect cyber paths to physical consequences and safeguards, and simple, reasoned scores are enough to rank action at a small site.
Continue studying — chapter 13 of 30
← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →