Chapter 5 — Security literacy | Technologist OT, IoT and cyber-physical security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 What matters at NCS"]
  N2["5.2 Threat sources"]
  N3["5.3 Reading an advisory"]
  N4["5.4 ATT&CK for ICS"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 What matters at NCS"]
  N2["5.2 Threat sources"]
  N3["5.3 Reading an advisory"]
  N4["5.4 ATT&CK for ICS"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 What matters at NCS]
    |
    v
[5.2 Threat sources]
    |
    v
[5.3 Reading an advisory]
    |
    v
[5.4 ATT&CK for ICS]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain safety, availability, integrity and confidentiality for a cold-storage site; (2) describe common OT threat sources; (3) read a public advisory and extract what matters; and (4) use ATT&CK for ICS identifiers correctly.

5.1 What matters at NCS

The worst outcome at NCS is an ammonia release — a safety event handled by separate gas detection and emergency ventilation. Next comes loss of cooling and condemned stock. Then integrity of temperature records, which customers and food-safety inspectors rely on. Confidentiality matters for customer contracts and camera footage. The order guides where to spend effort first.

Priya's ranking follows this order: ammonia safety stays with the gas-detection system and the refrigeration engineer; her security work starts with the paths that could stop cooling or falsify temperature records.

5.2 Threat sources

Most OT incidents are not elite attacks. They include commodity ransomware that spreads from office networks onto Windows HMIs, misused vendor remote access, mistakes during maintenance, and devices exposed to the internet with default passwords. CISA advisory AA21-042A, on a water treatment facility, describes access through desktop-sharing software combined with weak passwords — a pattern that fits many small sites.

Priya found all four patterns at NCS: a desktop-sharing tool on HMI-C, a shared HMI password on a sticky note, a forgotten cellular router and a camera exposed to the internet.

5.3 Reading an advisory

From any advisory extract: affected product and versions, the weakness, whether exploitation has been seen, and the recommended mitigations. Then ask whether NCS has that product (your asset table answers this) and whether the mitigation is feasible.

Priya applied this to AA21-042A and found three NCS parallels: the contractor's desktop-sharing tool on HMI-C, an HMI operating system near end of support, and a shared HMI password written on a sticky note. Her asset table answered the first question; the mitigation, supervised sessions instead of an always-on tool, was feasible because the contractor visits only a few times a month.

5.4 ATT&CK for ICS

MITRE ATT&CK for ICS gives names and IDs to observed adversary behaviour. T0886 Remote Services covers using remote-access services to reach control systems; T0883 Internet Accessible Device covers devices reachable from the internet. Use the IDs to label findings consistently, not to claim completeness.

Priya labels the contractor's always-on desktop-sharing tool on HMI-C as T0886, and the dock camera reachable from the internet as T0883. Neither label says the site has been attacked; each says which kind of observed behaviour the finding would enable. When a CISA advisory later cites T0886 for a product family, she can search her findings for that ID and know at once which NCS items are relevant.

Worked example (synthetic NCS)

Priya reads AA21-042A and notes three NCS parallels: the refrigeration contractor uses a desktop-sharing tool on HMI-C; HMI-C runs an operating system near end of support; and the shared HMI password is on a sticky note. She labels the first finding T0886 and proposes removing the always-on tool in favour of supervised sessions.

Synthetic case — Northgate Cold Storage. The parallels are invented; the advisory is real.

Errors and limits

Advisories describe one situation; do not copy their mitigations without checking fit. Gas-detection safety systems are outside a security technologist's authority to modify.

Exercises

EX013 — Ranking NCS concerns. Put in order of priority: camera footage leak, ammonia release, falsified temperature records, loss of cooling.
Show marking criteria
Rubric: 3 = release, cooling, records, footage with reasons; 2 = order only; 1 = partly right; 0 = none.
EX014 — Four facts from an advisory. List the four items to extract from an ICS advisory.
Show marking criteria
Rubric: 3 = product/versions, weakness, exploitation status, mitigations; 2 = three; 1 = two; 0 = none.
EX015 — Labelling a finding. Which ATT&CK for ICS ID fits "contractor reaches HMI-C through desktop-sharing software"?
Show marking criteria
Rubric: 3 = T0886 Remote Services; 2 = right name, no ID; 1 = T0883; 0 = none.

Synthesis

Security literacy means ranking consequences honestly, recognising everyday threat sources, and reading advisories and ATT&CK labels with care.

Continue studying — chapter 05 of 30

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →