Chapter 6 — Operating systems and virtualization | Technologist OT, IoT and cyber-physical security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 6 — Operating systems and virtualization

Lesson map

Lesson 06 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 The HMI as a Windows host"]
  N2["6.2 Virtualized historians"]
  N3["6.3 Snapshots are not backups"]
  N4["6.4 Least privilege on hosts"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 The HMI as a Windows host"]
  N2["6.2 Virtualized historians"]
  N3["6.3 Snapshots are not backups"]
  N4["6.4 Least privilege on hosts"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX016"]

[Learning outcomes]
    |
    v
[6.1 The HMI as a Windows host]
    |
    v
[6.2 Virtualized historians]
    |
    v
[6.3 Snapshots are not backups]
    |
    v
[6.4 Least privilege on hosts]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) identify OS-level risks on HMIs and historians; (2) explain what virtualization changes for OT servers; (3) plan snapshots and backups that actually restore; and (4) respect vendor support constraints when hardening.

6.1 The HMI as a Windows host

HMI-C runs a long-term-servicing edition of Windows with the refrigeration vendor's HMI software. Its risks are ordinary: unpatched services, shared local accounts, USB sticks, and remote-desktop tools. Its constraints are not: the vendor certifies specific OS builds, and an untested update can stop the HMI runtime. Hardening therefore goes through a test unit or a vendor-approved list.

At NCS that means the vendor's approved patch list for HMI-C is checked before each maintenance window, and anything not on it is first tested on the contractor's test unit.

6.2 Virtualized historians

NCS runs HIST as a virtual machine on a small host in the comms room. Virtualization helps recovery — a VM can be restored from a snapshot in minutes — but concentrates risk: compromise or failure of the hypervisor affects every VM on it. Management interfaces for the hypervisor belong on an isolated management network, never on the office VLAN.

Priya's review of HIST found the hypervisor console reachable from the office VLAN; her plan moved it to the management VLAN, where only the OT management host can reach it.

6.3 Snapshots are not backups

A snapshot lives on the same storage as the VM; if the storage fails or ransomware encrypts it, both go. A backup is a separate copy, ideally offline or immutable, with a tested restore. Record the restore test date — an untested backup is a hope.

HIST had one snapshot, eight months old, and no separate backup. Priya's plan adds a nightly backup of the VM to a NAS on the OT management VLAN with an offline weekly copy, and a restore test into an isolated network next month.

6.4 Least privilege on hosts

Operators use a named, non-administrator account; the vendor runtime uses a service account that cannot log in interactively; administrator rights are granted per task and logged.

At NCS this replaced the shared "shift" login on HMI-C: operators now log in with named accounts that cannot install software, and the refrigeration vendor's runtime runs under a service account with no interactive logon. When Priya needed administrator rights to apply the allow-listing policy, she requested them for that change ticket, and the elevation was logged against the ticket number. The vendor's HMI runtime kept working because its service account, not an operator, owns the processes that talk to PLC-R1 and PLC-R2.

Worked example (synthetic NCS)

Priya reviews HIST: one snapshot from eight months ago, no separate backup, hypervisor console reachable from the office VLAN. Her plan: nightly backup of the HIST VM to a separate NAS on the OT management VLAN with an offline weekly copy; move the hypervisor console to the management VLAN; perform and record a restore test into an isolated network next month.

Synthetic case — Northgate Cold Storage. Findings are invented.

Errors and limits

Restoring a VM onto the live network may create a duplicate host that conflicts with the original; test restores in isolation. Some vendor HMIs are not supported in virtual machines.

Exercises

EX016 — Snapshot or backup? Explain why HIST's eight-month-old snapshot does not count as a backup. Rubric: 3 = same storage, not independent, stale, never restored; 2 = two reasons; 1 = one; 0 = none.
EX017 — Moving the hypervisor console. State the risk of the console being reachable from the office VLAN. Rubric: 3 = office malware/user could control or destroy all VMs; 2 = partial; 1 = vague; 0 = none.
EX018 — A safe restore test. Describe how to test-restore HIST without disturbing operations. Rubric: 3 = restore into isolated network, verify data and services, record date; 2 = two; 1 = restore over live VM; 0 = none.

Synthesis

OS and virtualization security in OT is mostly disciplined basics — least privilege, isolated management and backups proven by restore — inside vendor constraints.

Continue studying — chapter 06 of 30

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →