How security differs in this industry
These scenarios model electric power and cooling water utility operations supporting Meridian's launch test stands using general NIST SP 800-82 Rev. 3 OT principles; electricity and water subsectors have distinct statutory requirements and site safety rules.
Cyber actions have kinetic and physical consequences
Substations, cryogenic cooling plants, and water treatment facilities rely on programmable logic controllers (PLCs) and supervisory control and data acquisition (SCADA) loops that govern physical pressure, voltage, and flow. An automated endpoint quarantine or active port scan that is harmless on an enterprise laptop can trip a physical relay or blind a control-room operator.
Field assets run multi-decade lifecycles
An enterprise bastion host and a twenty-year-old substation relay have fundamentally different patching and cryptographic capabilities. Asset inventories must map physical process functions, safety interlocks, upstream dependencies, and approved plant outage windows so vulnerability remediation never compromises operational safety.
Electric and water subsectors answer to distinct authorities
Bulk electric generation and transmission, local power distribution, drinking water, and wastewater treatment operate under separate regulatory statutes and oversight bodies. Always identify the physical service class and statutory authority before citing a compliance requirement; EPA water guidance does not govern bulk power system reliability.
How to use this path
Read each situation, inspect the synthetic evidence, and choose a response. Every answer explains its tradeoffs. Follow the linked foundation lessons when you need a concept explained, then mark the decision practiced when you are ready.
All organizations, people, events, and evidence in these exercises are fictional. The controls stay in the browser.
APPLIED LESSON 1 / 7 MIN
Approve a bounded OT maintenance session
Enforce jump-host mediation, named attribution, and control-room supervision for remote vendor diagnostics.
A power substation feeding Meridian's propulsion test stand experiences intermittent telemetry dropouts on a transformer monitoring unit. The equipment vendor requests persistent, unmonitored VPN access into the operational technology (OT) zone until their engineers diagnose the fault. Propulsion Lead Priya Nair and Principal Architect Vera Vance reject the standing access request: operational urgency never justifies opening an unmonitored, shared-credential bridge into a live control network. Before any remote session begins, the team pins down the target asset, the exact read-only diagnostic commands required, the named vendor engineer, and the control-room operator on shift.
The control-room lead authorizes a time-bounded session through an intermediate jump host in the industrial DMZ, enforcing multi-factor authentication and session recording tied to a single named technician. Permissions are restricted strictly to diagnostic log retrieval on the target telemetry unit, with any firmware or setpoint modification requiring a separate engineering change authorization. Throughout the window, the control-room operator retains a physical and logical kill switch, while SOC analysts refrain from running active vulnerability scans or endpoint resets against live substation controllers.
Which access architecture best supports the vendor diagnostic task without endangering substation safety?
CONNECT TO THE FUNDAMENTALS
APPLIED LESSON 2 / 7 MIN
Corroborate operational telemetry and configuration logs
Correlate HMI anomalies and configuration audit events across unsynchronized clocks without perturbing the physical process.
At Meridian's closed-loop cooling water facility, a human-machine interface (HMI) dashboard displays an abrupt pressure step-change at 09:12 UTC, while a configuration management monitor logs a ladder-logic parameter edit on an upstream controller at 09:10 UTC. While the two events appear linked, Vera Vance cautions the analyst against jumping to conclusions or touching the process controls: HMI telemetry can suffer from polling lag, sensor drift, or stale cache rendering, and industrial controllers frequently suffer from NTP clock skew. The analyst's job is disciplined evidentiary correlation, while physical process evaluation belongs to the licensed plant operator.
The plant operator cross-checks the HMI reading against independent hardwired pressure gauges and physical relief-valve indicators, while the security analyst preserves the controller audit logs, configuration checksums, and NTP offset telemetry. By accounting for a two-minute clock lag on the controller, the team determines the true chronological sequence and checks the plant maintenance register for authorized work orders. No setpoint adjustments or controller reboots occur outside the plant's formal safety operating procedure.
What is the most rigorous initial response to the conflicting telemetry and configuration records?
CONNECT TO THE FUNDAMENTALS
APPLIED LESSON 3 / 7 MIN
Rehearse OT recovery with the operational owner
Validate that backup artifacts, firmware baselines, and startup sequences meet operator-defined safety acceptance criteria.
An audit of Meridian's utility resilience plan reveals that while engineering workstation backups exist in cold storage, the most recent tabletop drill only tested restoring a corporate file server. Recovering a physical utility environment requires far more than an intact archive file: teams need exact controller firmware revisions, validated ladder-logic project files, hardware key dongles, startup sequencing rules, and licensed operators who understand safe physical bring-up states. A green backup checksum does not prove a substation or water plant can be cold-started safely.
To close the gap, Kael Cho and Priya Nair schedule an offline recovery rehearsal on a non-production test bench that mirrors the field controllers. During the exercise, the plant operator compares the restored project file against the master configuration register and discovers that a safety-critical tuning parameter approved last month is missing from the backup archive. The team updates the backup pipeline to trigger after every approved engineering change and documents explicit operator stop-gates before any recovered configuration can be loaded onto live equipment.
What must the team complete before relying on this OT recovery procedure for production incidents?
CONNECT TO THE FUNDAMENTALS
Standards & scope
These are signposts for further study. The examples use U.S. regulatory context where noted; applicability depends on your organization, jurisdiction, services, and data.
NIST SP 800-82 Rev. 3 ↗
OT security guidance considers performance, reliability, and safety; adapt it to the actual system and approved operational procedures.
EPA water-sector cybersecurity resources ↗
Resources support cybersecurity planning and response for drinking water and wastewater systems; the resource collection is not itself a new universal legal requirement.