Chapter 21 — OT, IoT and cyber-physical security: service integration

Lesson map

Lesson 21 published. Map, example, EX061.

flowchart TD
  N0["Learning outcomes"]
  N1["21.1 Business wants data"]
  N2["21.2 Patterns"]
  N3["21.3 API security"]
  N4["21.4 Dependencies"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX061"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["21.1 Business wants data"]
  N2["21.2 Patterns"]
  N3["21.3 API security"]
  N4["21.4 Dependencies"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX061"]

[Learning outcomes]
    |
    v
[21.1 Business wants data]
    |
    v
[21.2 Patterns]
    |
    v
[21.3 API security]
    |
    v
[21.4 Dependencies]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX061]

Learning outcomes

You will (1) integrate OT data with business services without opening control paths; (2) design one-way or brokered data transfers; (3) secure API connections to cloud services; and (4) document integration dependencies.

21.1 Business wants data

Customers want temperature certificates for their stored goods; finance wants compressor energy use; the logistics system wants dock door states. Each request tempts someone to connect a business system straight to a PLC. The integration principle is: business systems read copies in the DMZ or cloud, never the control zone directly.

OFFICE-7's energy macro was this temptation in practice: it read compressor run hours straight from PLC-R2 until Priya moved it to the replica.

The macro's polling also added load on PLC-R2 at times nobody had planned for.

21.2 Patterns

Historian replication pushes data from the control zone to a DMZ replica (Chapter 8). For stronger guarantees, a data diode or one-way gateway allows traffic in one direction only by hardware design. For cloud services, the gateway initiates outbound TLS connections and never accepts inbound ones. Integration through files — a nightly CSV export to a shared folder — is acceptable if the share lives in the DMZ and is write-only from the control side.

At NCS, HIST pushes to the DMZ replica, and GW-LOG reaches the vendor cloud outbound only through rule 21.

21.3 API security

Customer certificate generation uses the logger vendor's cloud API. Use a dedicated API key per integration with least privilege (read temperatures for specific rooms), store it in a secrets vault, rotate it, and log its use. Never embed keys in spreadsheets or scripts on shared drives.

For NCS's customer certificates, the key would be scoped to reading temperatures for the rooms that customer's goods occupy, held in the vault entry referenced from the asset table, rotated at least yearly and on any staff change, and logged so that an unusual pattern, such as reads for every room, shows up. A key found in a spreadsheet on the shared drive would give anyone with the drive every room's history.

21.4 Dependencies

Write each integration's dependencies: the vendor cloud, DNS, certificates, the API key, the DMZ share. When one breaks, you know what else stops.

For the certificate integration at NCS: the logger vendor's cloud and its API, DNS for the cloud's name, the TLS certificate chain, the API key in the vault, and the DMZ share where the generated certificates land. LOG-03's expired certificate in Chapter 22 is a reminder that a dependency can fail quietly: the logger stopped uploading on 5 October, and the customer's certificate for that room would have had a seven-day gap without the PLC probe history in HIST.

Worked example (synthetic NCS)

The finance team's energy macro (Chapter 12) is rebuilt: HIST pushes hourly compressor run-hours to the DMZ replica; finance's report reads the replica over HTTPS with a read-only account. The customer-certificate tool uses an API key scoped to read-only temperature data for rooms with active contracts, rotated every 90 days.

Synthetic case — Northgate Cold Storage. The integrations are invented.

Errors and limits

"Read-only" protocols can still overload a device if polled too often; poll the historian, not the PLC. Data diodes need careful configuration for protocols that expect acknowledgements.

Exercises

• EX061 — Choosing a pattern. Logistics wants dock door states every minute. Which pattern and why?
  Show marking criteria

  Rubric: 3 = historian/DMZ replica or one-way push, no direct PLC access; 2 = pattern only; 1 = direct poll; 0 = none.
• EX062 — Scoping an API key. Write the scope for the certificate tool's API key.
  Show marking criteria

  Rubric: 3 = read-only, specific rooms/customers, no write/admin, rotation; 2 = partial; 1 = full access; 0 = none.
• EX063 — An integration dependency list. List four dependencies of the customer-certificate integration.
  Show marking criteria

  Rubric: 3 = four relevant; 2 = three; 1 = one or two; 0 = none.

Synthesis

Integration gives the business its data through copies, one-way paths and scoped credentials — never through new doors into the control zone.

Continue studying — chapter 21 of 30

← Chapter 20 (draft) · Course chapter index · Chapter 22 (draft) →