Chapter 14 — OT, IoT and cyber-physical security: methods I | Technologist OT, IoT and cyber-physical security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 14 — OT, IoT and cyber-physical security: methods I

Lesson map

Lesson 14 published. Map, example, EX040.

flowchart TD
  N0["Learning outcomes"]
  N1["14.1 Walk-down"]
  N2["14.2 Interviews"]
  N3["14.3 Configuration review"]
  N4["14.4 Assembling findings"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX040"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["14.1 Walk-down"]
  N2["14.2 Interviews"]
  N3["14.3 Configuration review"]
  N4["14.4 Assembling findings"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX040"]

[Learning outcomes]
    |
    v
[14.1 Walk-down]
    |
    v
[14.2 Interviews]
    |
    v
[14.3 Configuration review]
    |
    v
[14.4 Assembling findings]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX040]

Learning outcomes

You will (1) run a structured site walk-down; (2) interview operators and contractors effectively; (3) review configuration exports safely; and (4) assemble findings with evidence references.

14.1 Walk-down

Walk the site with someone who owns it. Look for network sockets in odd places, cellular routers in panels, labels with passwords, laptops left connected, USB sticks in HMIs, and devices not in the inventory. Photograph only with permission, and avoid capturing screens showing customer data.

Priya's walk-down at NCS found the most important item on this list: a small cellular router in panel MP-2 labelled "contractor backup access", installed two years earlier during a network outage and forgotten. It provided a second remote path to PLC-R2 that no firewall rule showed.

14.2 Interviews

Ask operators what they do when the HMI freezes, who calls the contractor, and what changed recently. Ask the contractor how they connect, what tools they use and where backups live. Open questions ("walk me through a remote support call") reveal more than yes/no checklists. Take notes with the interviewee's name, role and date; separate what they said from what you saw.

The interview with the contractor explained the MP-2 router in one sentence, recorded as I-04.

The contractor said the router was installed during a two-day internet outage so he could still reach PLC-R2, and nobody removed it.

14.3 Configuration review

Export configurations through supported interfaces with read-only accounts: firewall rule sets, switch VLAN settings, HMI user lists. Review exports on your own workstation, not on the device. Hash exports as in Chapter 9.

At NCS the firewall export came from FW-1's web interface using a read-only account, saved as fw1-0303.txt and hashed as E-014. The HMI-C user list came the same way, which is where the 11 accounts in Chapter 7 came from. Reviewing on Priya's workstation meant she could search and annotate the rule set without any risk of saving a change to FW-1 by accident, and the hash shows later that the file she reviewed is the file she exported.

14.4 Assembling findings

Each finding: title, evidence IDs, affected assets, scenario link, recommendation and owner. One finding per issue; combining unrelated issues makes them impossible to close.

Priya's finding F-07 follows this form: title, undocumented cellular router in MP-2; evidence, photo E-021 and interview I-04; affected asset, PLC-R2; scenario link, the contractor remote-access scenario, because it is a second remote path; recommendation, remove it, or keep it powered off and enabled only on request with the facilities manager's approval; owner, the facilities manager. It does not mention the shared HMI password, which is a separate finding with a separate owner and closing date, even though Priya found both in the same week.

Worked example (synthetic NCS)

During the walk-down Priya finds a small cellular router in panel MP-2 labelled "contractor backup access". The contractor explains it was installed during a network outage two years ago and forgotten. Priya records it as finding F-07, written up in the section above.

Synthetic case — Northgate Cold Storage. Panel and finding IDs are invented.

Errors and limits

Interviews reflect memory; confirm with evidence. Never power-cycle or unplug devices during a walk-down unless the owner asks and operations agree.

Exercises

EX040 — Three walk-down targets. List three things to look for in a control panel. Rubric: 3 = three relevant (modems, labels with passwords, unknown devices, connected laptops); 2 = two; 1 = one; 0 = none.
EX041 — An open interview question. Write one open question for the contractor about remote access. Rubric: 3 = open, specific to process; 2 = open but generic; 1 = yes/no; 0 = none.
EX042 — Writing finding F-07's recommendation options. Give two acceptable options for the cellular router and the condition for each. Rubric: 3 = remove; or off by default with approval-based enabling; conditions stated; 2 = options only; 1 = leave as is; 0 = none.

Synthesis

Walk-downs, interviews and read-only configuration reviews, tied together by evidence IDs, find the things diagrams never show.

Continue studying — chapter 14 of 30

← Chapter 13 (draft) · Course chapter index · Chapter 15 (draft) →