◇ OpenCyber Academy
Technologist · Chapter 27 · English

Chapter 27 — Deployment and validation

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 27 — Deployment and validation

Lesson map

Lesson 27 published. Map, example, EX079.

flowchart TD
  N0["Learning outcomes"]
  N1["27.1 The change"]
  N2["27.2 The plan"]
  N3["27.3 Validation checks"]
  N4["27.4 Recording"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX079"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["27.1 The change"]
  N2["27.2 The plan"]
  N3["27.3 Validation checks"]
  N4["27.4 Recording"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX079"]

[Learning outcomes]
    |
    v
[27.1 The change]
    |
    v
[27.2 The plan]
    |
    v
[27.3 Validation checks]
    |
    v
[27.4 Recording]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX079]

Learning outcomes

You will (1) plan the deployment of a security change in an OT site; (2) define validation checks and rollback; (3) coordinate with operations and contractors; and (4) record the deployment as evidence.

27.1 The change

NCS will deploy the new control-zone firewall rule set that replaces rule 9 with explicit flows. The change is small in text but large in effect: if a needed flow is missing, an HMI could lose its PLC values or the historian could stop recording.

Priya's first deployment proved the point: the matrix lacked the historian's polling of PLC-R2, and HIST lost those tags four minutes after the change.

The flow had not appeared during the 72-hour capture window, and nobody had listed it from memory. The rollback plan, rehearsed beforehand, is what turned that gap into a five-minute interruption instead of a lost morning of temperature records.

27.2 The plan

Pre-requisites: approved flow matrix (Chapter 12); rules reviewed by a second person; tested on a bench firewall with replayed traffic; maintenance window agreed for a low-load period; contractor on call. Steps: back up the current rule set; apply the new set; validate; monitor for 24 hours. Rollback: restore the backup, which takes two minutes and is rehearsed.

Priya's deployment used this plan on a Tuesday at 06:00. At 06:04 HIST stopped receiving PLC-R2 tags; she rolled back at 06:09 and values recovered. The missing flow was added with the historian vendor's confirmation, and the second deployment on Thursday passed all four validation checks.

27.3 Validation checks

Defined in advance and observable: HMI-C shows live values from both PLCs; HIST records new data points for every tag group; GW-LOG uploads succeed; the test from OFFICE-7 to PLC-R2:502 is refused and logged. Any failure in the first three triggers rollback unless fixed within ten minutes.

On the Tuesday attempt the second check failed: HIST stopped recording PLC-R2's tag group at 06:04. Because the failure was understood but not fixable within ten minutes, Priya rolled back at 06:09 rather than editing rules live. The fourth check is the security one; it passed both times, which shows that a rule set can be secure and still break operations.

27.4 Recording

Record times, who did what, the hash of old and new rule sets, validation results and any deviations. This record is evidence for the evaluation in Chapter 23 and for future audits.

Priya's record for the two deployments shows the value of this: the Tuesday entry lists the 06:04 failure, the 06:09 rollback and the missing HIST → PLC-R2 flow as the cause; the Thursday entry lists the corrected rule set's hash and four passed checks. The Chapter 23 evaluation cites both, and an auditor reading it later can see that the first attempt failed safely, which is itself evidence that the rollback works.

Worked example (synthetic NCS)

Deployment on Tuesday 06:00. At 06:04 HIST stops receiving PLC-R2 tags: the matrix listed HIST → PLC-R1 only, because historian polling of PLC-R2 had been missed in the observation window. Priya rolls back at 06:09, values recover, and the missing flow is added to the matrix with the historian vendor's confirmation. The second deployment on Thursday passes all four checks.

Synthetic case — Northgate Cold Storage. The timeline is invented.

Errors and limits

Bench testing cannot reproduce every device behaviour. Validation only covers what you thought to check; keep monitoring after the window.

Exercises

Synthesis

Deployment in OT is planned, validated against pre-defined checks, reversible within minutes and recorded as evidence — and rollback is a success, not a failure.

Continue studying — chapter 27 of 30

← Chapter 26 (draft) · Course chapter index · Chapter 28 (draft) →