Chapter 7 — Identity and access foundations
Lesson map
Lesson 07 published. Map, example, EX019.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Shared passwords"]
N2["7.2 Roles"]
N3["7.3 Contractors"]
N4["7.4 Multi-factor authentication"]
N5["7.5 Reviews"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX019"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Shared passwords"]
N2["7.2 Roles"]
N3["7.3 Contractors"]
N4["7.4 Multi-factor authentication"]
N5["7.5 Reviews"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX019"]
[Learning outcomes]
|
v
[7.1 Shared passwords]
|
v
[7.2 Roles]
|
v
[7.3 Contractors]
|
v
[7.4 Multi-factor authentication]
|
v
[7.5 Reviews]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX019]
Learning outcomes
You will (1) replace shared accounts with named accounts and roles; (2) design contractor access with time limits; (3) apply multi-factor authentication where it fits OT; and (4) review access regularly.
7.1 Shared passwords
At many sites one HMI password is shared by every shift and known to former staff. It cannot tell an investigator who changed a freezer setpoint, and it cannot be revoked for one person. Named accounts restore both attribution and revocation. IEC 62443-3-3 makes unique identification of human users a system requirement under its first foundational requirement.
Priya's access review at NCS found exactly this: one shared "shift" account among 11 HMI accounts, plus two accounts belonging to former staff.
A shared account also makes the evidence log weaker: an alarm acknowledged as "shift" cannot be tied to a person.
7.2 Roles
NCS needs three HMI roles: viewer (night security guard checking temperatures), operator (acknowledge alarms, adjust setpoints within limits) and engineer (change limits and alarm settings). The contractor's laptop that programs PLC-R1 is a separate privilege again, controlled by possession of the laptop and its project password.
The viewer role matters more than it looks. NCS's night security guard checks freezer temperatures on HMI-C during rounds; with a shared operator login, the guard could also have acknowledged alarms or changed a setpoint. A viewer account removes that by design. The contractor's programming laptop sits outside these roles because PLC-R1's project file, not HMI-C, controls what can be downloaded to the controller.
7.3 Contractors
The refrigeration contractor needs access a few times a month. Give the contractor named accounts that are disabled by default, enabled for a ticket and a time window, and reviewed afterwards. Remove the always-on remote-access tool identified in Chapter 5.
At NCS the two contractor accounts were always enabled. Priya set them to disabled-by-default; the facilities manager enables one for a ticket and a time window, and the session goes through the jump host, which records it. After the visit the account is disabled again, and the session record is filed with the ticket. The contractor visit pack in Chapter 25 turns these steps into a one-page form that takes four minutes.
7.4 Multi-factor authentication
Use MFA for remote access and for engineering tools. On the control-room HMI, a slow MFA prompt during an alarm can be harmful; physical security of the room and short screen-lock times may be the better balance. Document the choice.
Priya's choice at NCS: MFA on the jump host for contractor sessions and on the engineering tools, but not on HMI-C itself. The control room is locked, HMI-C locks after a short idle period, and operators log in with named accounts. An MFA prompt that delays an operator acknowledging a high-temperature alarm on Freezer-2 would create a worse risk than the one it removes, and that reasoning is written in the access policy.
7.5 Reviews
Every quarter, list enabled accounts and compare with the staff and contractor list. Disable leavers the same day HR notifies you.
At NCS this review found 11 HMI accounts: 6 current staff, 2 former staff, 1 shared "shift" account and 2 contractor accounts that were always enabled. The two former-staff accounts were disabled the same day; the shared account was replaced with named operator accounts within a month; the contractor accounts became disabled-by-default. The next quarter's review should start from that list and confirm that none of the four problems has returned, for example a new contractor account created during an emergency visit and never disabled.
Worked example (synthetic NCS)
Priya's access review finds 11 HMI accounts: 6 current staff, 2 former staff, 1 shared "shift" account and 2 contractor accounts always enabled. Actions: disable the 2 former-staff accounts today; replace "shift" with named operator accounts within a month; set contractor accounts to disabled-by-default with ticket-based enabling.
Synthetic case — Northgate Cold Storage. Counts are invented.
Errors and limits
Account lockout on control-room screens can block an operator during an emergency; prefer alerting and delays. Some legacy PLCs have no user accounts at all; protect them through network controls.
Exercises
- EX019 — Choosing a role. The night guard must check freezer temperatures on HMI-C. Which role and why? Rubric: 3 = viewer, least privilege, no setpoint changes; 2 = role only; 1 = operator; 0 = engineer.
- EX020 — Contractor access design. Write three rules for contractor HMI accounts. Rubric: 3 = named, disabled by default, enabled per ticket/window with review; 2 = two; 1 = one; 0 = none.
- EX021 — Where MFA fits. Name one NCS access path that must have MFA and one where you would document an alternative. Rubric: 3 = remote access/engineering path; control-room HMI with physical control; 2 = one; 1 = MFA everywhere without thought; 0 = none.
Synthesis
Named accounts, matched roles, time-boxed contractor access and regular reviews give OT identity both accountability and safety.
Continue studying — chapter 07 of 30
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →