Chapter 17 — OT, IoT and cyber-physical security: tooling
Lesson map
Lesson 17 published. Map, example, EX049.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Passive first"]
N2["17.2 Setting up a capture"]
N3["17.3 Offline analysis"]
N4["17.4 Controlling tools"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX049"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Passive first"]
N2["17.2 Setting up a capture"]
N3["17.3 Offline analysis"]
N4["17.4 Controlling tools"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX049"]
[Learning outcomes]
|
v
[17.1 Passive first]
|
v
[17.2 Setting up a capture]
|
v
[17.3 Offline analysis]
|
v
[17.4 Controlling tools]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX049]
Learning outcomes
You will (1) choose safe tools for OT observation; (2) configure a passive capture on a mirror port; (3) use offline analysis tools on capture files; and (4) control tool use through permits and change records.
17.1 Passive first
Passive tools listen; active tools send. In OT, passive tools are the default because active probes can upset old devices. NIST SP 800-82r3 discusses the risk of active scanning in OT environments and the value of passive monitoring. A mirror (SPAN) port on the control-zone switch copies traffic to a monitoring laptop or sensor without changing the traffic itself.
Priya's capture used port 24 on control-zone switch SW-C, mirroring ports 1–8 where the PLCs, HMI-C and HIST connect.
Mirroring needed only a configuration change on SW-C, made by the network owner, with no device on ports 1–8 restarted.
17.2 Setting up a capture
Agree the switch port with the network owner; configure the mirror in a change window; connect a capture host whose network interface has no IP address, so it cannot transmit. Record start and end times, the switch, the mirrored ports and the packet-loss counters.
Priya's plan for NCS: SW-C port 24 mirrors ports 1–8, the capture host has IP disabled, and the capture runs 72 hours so that it includes a defrost cycle, when traffic patterns change. Loss counters are read at the start and the end, and the permit names the facilities manager as the person who can stop the work.
17.3 Offline analysis
Analyse captures on an isolated workstation: protocol decoders identify Modbus function codes, conversation lists show who talks to whom, and simple Python scripts like those in Chapters 11–12 compare results with the inventory and flow matrix.
Priya's 72-hour SW-C capture fed both the Chapter 11 inventory comparison and the Chapter 12 flow comparison. It also missed something: the historian's polling of PLC-R2 did not appear in the window, which is why HIST → PLC-R2 was missing from the flow matrix and the first firewall deployment in Chapter 27 had to be rolled back. Offline analysis can only report what the capture contains.
17.4 Controlling tools
Each tool used on site is listed in the work permit with its version and mode (passive only). Engineering tools from the contractor — PLC programming software — are not security tools; their use is the contractor's, under change control.
Priya's permit lists the capture tool and its version, passive mode only, and the switch configuration change for the mirror port, which the network owner makes.
It also lists the stop conditions: any HMI alarm the operators cannot explain, or a switch CPU warning, ends the capture, and the facilities manager is told first. A stopped capture is recorded in the evidence log with its duration.
Worked example (synthetic NCS)
Priya's capture plan: switch SW-C port 24 mirrors ports 1–8 (PLCs, HMI-C, HIST); capture host has IP disabled; 72-hour capture to include a defrost cycle; loss counters checked at start and end. The permit lists the capture tool and version and names the facilities manager as the person who can stop the work.
Synthetic case — Northgate Cold Storage. Ports and durations are invented.
Errors and limits
A mirror port can drop packets when overloaded; check counters before trusting "nothing seen". Capture files may contain sensitive data; store them encrypted and delete on schedule.
Exercises
- EX049 — Why no IP address? Explain why the capture host's interface has no IP address. Rubric: 3 = cannot transmit/accidentally interact with OT devices; 2 = partial; 1 = speed; 0 = none.
- EX050 — Why 72 hours? Justify the 72-hour capture duration. Rubric: 3 = include periodic events like defrost and shift changes; 2 = partial; 1 = arbitrary; 0 = none.
- EX051 — Handling the capture file. Write two handling rules for the capture file. Rubric: 3 = encrypted storage with limited access; deletion date; 2 = one; 1 = vague; 0 = none.
Synthesis
OT tooling is passive by default, configured through change control and documented so its results can be trusted and its risks contained.
Continue studying — chapter 17 of 30
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →