Chapter 18 — OT, IoT and cyber-physical security: controls
Lesson map
Lesson 18 published. Map, example, EX052.
flowchart TD
N0["Learning outcomes"]
N1["18.1 Matching controls to scenarios"]
N2["18.2 Operational effects"]
N3["18.3 Compensating controls"]
N4["18.4 Recording controls"]
N5["18.5 Prioritising with limited budget"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX052"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["18.1 Matching controls to scenarios"]
N2["18.2 Operational effects"]
N3["18.3 Compensating controls"]
N4["18.4 Recording controls"]
N5["18.5 Prioritising with limited budget"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX052"]
[Learning outcomes]
|
v
[18.1 Matching controls to scenarios]
|
v
[18.2 Operational effects]
|
v
[18.3 Compensating controls]
|
v
[18.4 Recording controls]
|
v
[18.5 Prioritising with limited budget]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX052]
Learning outcomes
You will (1) select controls for NCS's top scenarios; (2) map them to IEC 62443-3-3 foundational requirements; (3) check each control's effect on operations; and (4) plan compensating controls where devices cannot be fixed.
18.1 Matching controls to scenarios
Scenario 1 (contractor remote tool misused): replace the always-on tool with supervised sessions through a jump host (FR 1 identification and authentication; FR 5 restricted data flow), and record sessions (FR 6 timely response to events). Scenario 2 (office ransomware reaches HMI-C): remove rule 9 (FR 5), allow-list applications on HMI-C (FR 3 system integrity), and keep offline backups (FR 7 resource availability).
Priya's first register entry is C-04, supervised contractor sessions, linked to scenario 1 only: it does nothing for the office-ransomware or camera scenarios, which need their own controls. Its test, an attempted session without approval that must be refused, is concrete enough for the facilities manager to repeat without her.
18.2 Operational effects
Ask of each control: what happens on a bad day? Supervised sessions mean the contractor waits for approval at 3 a.m.; NCS needs an on-call approver. Allow-listing may block an emergency diagnostic tool; keep a documented, monitored exception process.
NCS answered the first question with an on-call approver rota, which later went on the first page of the contractor visit pack. When the night operator tested version one of the pack, she could not find the approver's number at all, so the rota became the single most important line in it. For allow-listing, the exception process names who can approve an emergency tool and how the use is logged and reviewed afterwards.
18.3 Compensating controls
The temperature loggers' radio link is unencrypted and cannot be changed (Chapter 16). Compensate: compare logger data with PLC probes (detect falsification); alert on sudden step changes; ask the vendor about encrypted models at the next purchase. PLC-R2 cannot authenticate Modbus clients; compensate by allowing only HMI-C and HIST to reach it.
Priya's mini-study in Chapter 24 tests the first compensating control: on four synthetic weeks with ten injected falsifications, the two-probe comparison flagged all ten within 10 minutes.
The cloud's own alert flagged none, because the falsified values stayed within range.
18.4 Recording controls
A control register lists control, scenario, foundational requirement, owner, test method and last test date. Untested controls are listed as "assumed".
Priya's register lists C-04, supervised contractor sessions, as tested on 2026-04-02 and passed. Removing rule 9 is listed with its test, an attempted connection from OFFICE-7 to PLC-R2:502, expected refused. Allow-listing on HMI-C is listed as "assumed" until the vendor-tested policy is deployed and a blocked test executable is recorded. The "assumed" label keeps the register honest: management can see that the plan has more controls than evidence. Chapter 23 converts most of the assumed entries into tested ones, and one of them fails its first test.
Worked example (synthetic NCS)
Priya's register row: "C-04 Supervised contractor sessions via jump host — scenario 1 — FR 1/FR 5/FR 6 — owner facilities manager — test: attempt session without approval, expect refusal — last test 2026-04-02 passed."
Synthetic case — Northgate Cold Storage. Register entries are invented.
18.5 Prioritising with limited budget
NCS cannot buy everything at once. Priya orders controls by how many scenarios each one reduces and how cheap it is: removing rule 9 costs one maintenance window and reduces two scenarios, so it goes first; allow-listing needs vendor testing and goes second; replacing the loggers with encrypted models waits for the normal replacement cycle, with the compensating comparison check in place meanwhile.
The order is visible in Priya's evaluation six months later: rule 9 gone, supervised sessions tested, certificates automated, loggers not yet replaced.
Errors and limits
Mapping to foundational requirements shows coverage, not adequacy. A control that is bypassed "temporarily" for months is not a control.
Exercises
- EX052 — Mapping allow-listing. Which foundational requirement does HMI application allow-listing support? Rubric: 3 = FR 3 system integrity with reason; 2 = FR only; 1 = FR 4; 0 = none.
- EX053 — A bad-day check. Describe the bad-day effect of supervised sessions and its mitigation. Rubric: 3 = night delay; on-call approver; 2 = one; 1 = vague; 0 = none.
- EX054 — Compensating for PLC-R2. List two compensating controls for PLC-R2's lack of authentication. Rubric: 3 = restrict sources to HMI-C/HIST; monitor writes from other hosts; 2 = one; 1 = "add password"; 0 = none.
Synthesis
Controls are chosen for scenarios, checked against bad days, compensated where devices cannot change, and recorded with tests.
Continue studying — chapter 18 of 30
← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →