<figure><img src="image_1.png" /></figure>

HAL
open science

# Cyber Security Awareness Requirements for Operational Technology Systems

Tim Ellis, David Balenson, Michael Locasto

► To cite this version:

Tim Ellis, David Balenson, Michael Locasto. Cyber Security Awareness Requirements for Operational Technology Systems. 15th International Conference on Critical Infrastructure Protection (ICCIP), Mar 2021, Virtual, United States. pp.23-44, 10.1007/978-3-030-93511-5_2 . hal-05300050

HAL Id: hal-05300050

https://inria.hal.science/hal-05300050v1

Submitted on 6 Oct 2025

**HAL** is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_3.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_4.png" /></figure>

Chapter 2

CYBER SECURITY AWARENESS
REQUIREMENTS FOR OPERATIONAL
TECHNOLOGY SYSTEMS

Tim Ellis, David Balenson and Michael Locasto

**Abstract** Recent events have demonstrated that critical infrastructure assets operated by networked industrial control systems are vulnerable to cyber attacks. The first step to addressing the threats is to establish and maintain reliable monitoring of the cyber security health of systems so that their true cyber security states are known. For current operational technology systems, there is growing, but limited, availability of technologies and tools that provide the needed cyber security awareness. This chapter summarizes recent efforts conducted in collaboration with members of the U.S. natural gas distribution sector to develop a set of recommended functional requirements for cyber security health monitoring and awareness of operational technology systems. The design-driven process is described and the resulting nine key recommendations for securing operational technology systems are presented.

**Keywords:** Operational technology, cyber security health, monitoring tools

# 1. Introduction

Cyber actors have demonstrated their willingness to target critical in-
frastructure by exploiting Internet-accessible industrial control systems
and other operational technology assets. These attacks, including spear
phishing, ransomware, control logic modification and denial of service,
have caused significant interruptions, loss of visibility and/or control
of operational technology systems as well as potential damage. In re-
sponse, the National Security Agency (NSA) and Cybersecurity and
Infrastructure Security Agency (CISA) recently issued an alert to the
critical infrastructure community to take specific actions to strengthen
operational technology defenses and monitoring [1]. A recent study iden-
tified a broad range of failure scenarios in the natural gas distribution infrastructure and provides a framework for evaluating potential system threats and mitigations [11].

The first step in addressing cyber threats is to establish and maintain reliable monitoring of the cyber health of a system, so that the true cyber security state of the system is known. The Transportation Security Administration (TSA) Pipeline Security Guidelines provide baseline cyber security measures that pipeline owners and operators should deploy at all facilities, including technical and/or procedural controls for cyber intrusion monitoring and detection [19]. For current operational technology systems, there is growing, but still limited, availability of monitoring technologies and tools that could provide cyber security awareness.

The authors of this chapter have worked collaboratively with a consortium of natural gas distribution utilities to develop requirements and recommendations for a monitoring tool called the Cyber Analytics Dashboard for Operational Technology (CADOT) that could be deployed in natural gas distribution systems to enhance monitoring and cyber security awareness. The CADOT tool is intended to provide initial indications of potential cyber security threats and, in coordination with existing operational technology tools, quickly and effectively distinguish malicious events from common electrical and mechanical malfunctions, ensuring that the proper and most efficient responses can be conducted.

Drawing on the CADOT experience, this chapter describes the efforts to gather and define cyber security awareness needs and capabilities to enable industrial control system owners and operators to effectively monitor and assess the cyber security states of their operational technology systems. The process used to collect and develop the operational technology cyber security awareness recommendations are presented, along with the recommendations themselves.

## 2. CADOT Concept

Figure 1 presents the CADOT monitoring concept. CADOT is intended to provide a means for connecting and monitoring cyber-related data and processing activities across an operational technology system, potentially at physically-distributed substations, and aggregating and displaying the information for cyber security analyses by operational technology personnel. The CADOT design includes trusted monitoring capabilities embedded in the operational technology fabric of distributed substations. The capabilities would leverage embedded software agents in programmable logic controllers (PLCs) and remote terminal units (RTUs) to monitor processing, memory and communications, function-
<figure><img src="image_5.png" /><figcaption>Figure 1. CADOT monitoring concept.</figcaption></figure>

ality embedded in sensors and actuators, and network tools (e.g., serial test access points (TAPs) and network switch port analyzers (SPANs)) to monitor message traffic. The cyber data would be combined by a local collector at each substation and sent via secure channels to a central operations center. At the operations center, the substation cyber data would be aggregated and analyzed for possible alert conditions and displayed on a dashboard for operations personnel.

## 3. Related Work

This research focuses on the design of a reliable operational technology cyber security health monitoring and awareness capability for natural gas distribution systems. A number of government and commercial activities are aligned with this effort.

As mentioned above, the Transportation Security Administration has provided comprehensive risk-based security guidelines for natural gas
pipeline systems, which include a recommendation for establishing tech-
nical and procedural controls for cyber intrusion monitoring and detec-
tion [19].

CISA's industrial control systems strategy commits to working with
critical infrastructure owners and operators to institute industrial control
system security capabilities. The strategy is built around four pillars.
One pillar calls for technological developments that harden the cyber
security defenses of legacy control systems, build security into new in-
dustrial control devices during the development stage and increase lower-
level data visibility [2].

The CISA Cyber Security Evaluation Tool (CSET) is designed to
perform cyber security assessments of enterprise and industrial control
systems [3, 4]. It helps asset owners and operators identify vulnerabili-
ties and improve their organizations' overall cyber security postures by
guiding them through a series of questions that cover network security
requirements and best practices. Self-assessment tools like CSET can
lead organizations to cyber security health monitoring and awareness
capabilities, the critical first step in risk management.

The U.S. Department of Energy’s Cybersecurity for Energy Deliv-
ery Systems (CEDS) R&D Program leverages partnerships between in-
dustry, universities and national laboratories to research, develop and
demonstrate advanced technologies and tools for operational technology
systems in the energy sector [15–17]. Several CEDS projects are ex-
ploring advanced monitoring and situational awareness capabilities for
operational technology systems in the electric grid and, in some cases,
natural gas pipeline systems. The Schweitzer Engineering Laborato-
ries Project Ambassador is developing a capability to manage trust and
data sharing between multiple software applications to improve aware-
ness and visualization of enterprise and operational technology systems
in electric utilities [7]. The Texas A&M CYPRES Project is designing a
next-generation cyber-physical energy management system intended to
detect and prevent malicious events by fusing cyber and physical data
and to facilitate online control actions that couple cyber and physical
systems [5]. The Dragos Neighborhood Keeper Project seeks to develop
a no-trust, low cost, interconnected sensor network for the rapid sharing
of non-sensitive threat information from operational technology networks
across multiple enterprises [6]. The GE Research Cyber-Physical Protec-
tion for Natural Gas Compression Project is developing a cyber-physical
protection capability deployed at the edge to provide near real-time as-
set protection and situational awareness focused on prime mover, control
and compressor systems [14]. The CADOT concept is well positioned to
leverage or align with the novel capabilities resulting from these projects.
The 2017 Liberty Eclipse Exercise brought together energy suppliers, trade associations and government agencies to review plans, policies and procedures for responding to and recovering from a cyber incident that affects the energy infrastructure in a major region of the United States. The results of the exercise highlighted the need to improve information sharing and coordination during emergencies and incidents [18]. The CADOT effort intends to provide high-quality information to feed such activities.

In 2017, Idaho National Laboratory conducted a survey to identify tools that could be used to prevent, detect, mitigate and investigate cyber attacks in industrial control environments and to show the coverage of applicable tools [10]. While the survey found a growing number of tools suitable for industrial control systems, it identified gaps related to controller local area networks and field input/output devices, partial coverage for network traffic anomaly detection devices and very few or untested tools for outlier analysis, log reviews and system artifact reviews. The survey identified several multi-purpose tools with network and system monitoring functions; the current generations of many of these tools are considered in this work. However, the efforts did not test the tools for suitability or verify vendor claims. Many tools for industrial control environments have been developed in recent years and the community would greatly benefit from a new study that identifies security tools and evaluates their coverage and suitability.

Responding to the need for a more comprehensive approach to situational awareness with (near) real-time cyber security monitoring, the National Institute of Standards and Technology (NIST) National Cybersecurity Center of Excellence (NCCoE) developed and documented an exemplar solution targeted at the electric grid [13]. The solution uses commercial products, including network intrusion detection systems in the operational technology space, to provide a converged view of sensor data across the information technology, operational technology and physical access control systems in a utility. While the solution is focused on the electric grid, the underlying concepts are applicable to natural gas distribution pipelines and could help realize the desired CADOT capability.

Finally, several current commercial technologies and tools can be leveraged to address the recommended CADOT requirements and design features. These technologies and tools and their coverage of the CADOT recommendations are discussed later in this chapter.
# 4. Cyber Security Awareness Requirements

A collaborative design-driven approach was employed to identify gaps in cyber security monitoring capabilities for industrial control systems and to gather key CADOT functional requirements. The design-driven approach, developed at the Hasso Plattner Institute of Design at Stanford University [9], begins with an assessment of the desired user experience to determine user-facing needs for a product. Next, it combines requirements engineering processes to establish and maintain feasibility and product viability. Finally, it uses a collaborative agile development paradigm to iteratively prototype and evolve the product features and functions. This industry-standard process enabled the collective expertise of national gas distribution operations personnel to be leveraged in identifying the CADOT functional requirements.

The Gas Technology Institute (GTI) administers the Operations Technology Development (OTD) Cybersecurity Collaborative, a partnership between the U.S. Department of Homeland Security and industry to identify and mitigate cyber security capability gaps in the natural gas distribution sector. The collaborative seeks to address high-priority cyber security issues faced by members through focused outreach and education coupled with technology evaluation and transfer activities [8]. Company representatives in the collaborative include experienced engineers, researchers, system operators and security staff.

The process employed in this research began by conducting a survey of members of the collaborative. The survey questionnaire covered the following topical areas to establish general requirements guidelines:

* Overall CADOT objectives, constraints and utility participation interest (nine questions).

* Cyber security situational awareness needs and requirements (five questions).

* System integration requirements (two questions).

* Open question to collect unsolicited ideas (one question).

The survey results indicated strong agreement among the respondents for a centralized dashboard that can process, communicate and store the cyber security status of operational technology systems to improve cyber security awareness and trust during operations. In particular, there was general agreement for operators to be able to:

* Assess, analyze and maintain awareness of the cyber security state, including data and operations confidentiality, integrity and availability.
* Collect, analyze and monitor cyber security state properties, including higher-level synthesis (fusion) for improved understanding.

* Discover new and potentially useful correlations between cyber security state properties.

* Provide an active topological map of networks and devices, including dynamic active/inactive states of devices and components and their vulnerabilities to cyber attacks.

In addition, the survey respondents expressed a strong desire to leverage commercial technologies and tools where available, minimize lifecycle costs and take advantage of industry advancements.

The survey results were used in a live, interactive ideation workshop to develop the CADOT requirements. The workshop focused on four areas related to the CADOT requirements:

* **Users and Tasks:** Identify relevant cyber security actors and their associated roles.

* **Cyber Security Monitoring Rhythms:** Define cyber monitoring priorities and frequencies.

* **Malicious Scenarios:** Define cyber use cases to be detected and mitigated.

* **Normal Operations:** Establish normalcy baselines for cyber security monitoring.

In the workshop, personnel responsible for system operations and security (including cyber security) participated and provided first-person perspectives on the capability needs and gaps. Due to COVID-19 pandemic safety concerns, the ideation workshop was conducted virtually using the StormBoard collaborative tool and Zoom conferencing application. StormBoard provided a means for remote collaborative brainstorming to capture, organize and prioritize ideas. The Zoom breakout room feature was used to dynamically divide the participants into small working groups to foster interactions and idea creation before meeting as a single group to share and review incremental progress.

## 5. Key Recommendations

The ideas, concepts and requirements generated in the workshop were assessed and distilled into a set of recommended functional requirements for cyber security health monitoring and awareness of operational technology systems. Table 1 lists the nine key recommendations, which are summarized in the following subsections.
<table><caption>Table 1. Key recommended functional requirements.</caption><tr><td>Recommendation 1:</td><td>CADOT should accommodate three high-level types of users or personnel.</td></tr><tr><td>Recommendation 2:</td><td>CADOT should provide multiple views into a potential cyber security situation based on the analytic needs of the moment.</td></tr><tr><td>Recommendation 3:</td><td>CADOT should operate with the notion of a baseline that expresses normal functioning.</td></tr><tr><td>Recommendation 4:</td><td>When a baseline deviation occurs, CADOT should attempt to provide information about possible external factors or influences.</td></tr><tr><td>Recommendation 5:</td><td>Some (mostly static) state information should be made visible immediately because it could signal important alert situations.</td></tr><tr><td>Recommendation 6:</td><td>CADOT should provide a means to interactively query the various interfaces and components.</td></tr><tr><td>Recommendation 7:</td><td>CADOT should provide a means to plug in arbitrary data streams.</td></tr><tr><td>Recommendation 8:</td><td>CADOT should provide a means to set arbitrary running rules for alerts.</td></tr><tr><td>Recommendation 9:</td><td>CADOT should be designed to accommodate the computational, power, network bandwidth and availability constraints on operational technology devices.</td></tr></table>

## 5.1 CADOT User Types

The first recommendation relates to CADOT user types:

* **Recommendation 1:** CADOT should accommodate three high-level types of users or personnel.

Different organizations have varying titles and responsibilities for their operational technology personnel. The three general user types identified are: (i) monitoring personnel responsible for continuously monitoring system operations from control rooms (remote and central), (ii) response personnel responsible for engineering maintenance, fixes and upgrades in the field as well as in control rooms and (iii) analytics personnel responsible for longer-term collection, analysis and planning of system configurations and operations. Note that these descriptions are
<table><caption>Table 2. Summary of CADOT user types.</caption><thead><tr><th></th><th>Users</th></tr></thead><tbody><tr><td><strong>Roles</strong></td><td><strong>Monitoring:</strong> SCADA administrator, field technician, operational technology cyber analyst<br><strong>Response:</strong> Local engineer, central engineer, operations/ incident manager (controller), cyber security investigator<br><strong>Analytics:</strong> Technical analyst, policy and compliance analyst</td></tr><tr><td><strong>Responsibilities</strong></td><td><strong>Monitoring:</strong> Monitor health and configuration of SCADA systems, setup, configure and monitor controllers and electronic devices, analyze cyber security of operational technology systems<br><strong>Response:</strong> Assess status and causes of incidents in the field and control center, manage operations, measurements and incident resolution, coordinate mitigation actions, verify resolutions, investigate anomalous incidents<br><strong>Analytics:</strong> Analyze logs and after-action reviews, Prepare safety and security reports, verify compliance, provide decision support for workforce and operations policies</td></tr><tr><td><strong>CADOT Usage</strong></td><td><strong>Monitoring:</strong> Monitor, validate and coordinate cyber settings changes, verify cyber mitigation actions<br><strong>Response:</strong> Identify and respond to cyber incidents, verify cyber security mitigations<br><strong>Analytics:</strong> Review device performance and stability, capture cyber baselines, maintain vendor device ratings</td></tr></tbody></table>

generalizations of the information provided by the workshop participants and may not reflect specific titles or staff positions at their organizations.

Table 2 summarizes the roles and responsibilities and the cyber-specific usage that the roles and responsibilities need from a CADOT capability. CADOT should provide cyber-specific capabilities to augment operational capabilities for the three types of system users.

The monitoring roles include SCADA administrator responsible for health monitoring and configuration validation of supervisory control and data acquisition (SCADA) systems. From a CADOT cyber security perspective, a SCADA administrator validates and coordinates field setting changes, and watches for unplanned changes to system operations. Another monitoring role is field technician responsible for the setup and configuration of controllers, including programmable logic controllers and remote terminal units, and other electronic measurement and in-
strumentation devices. From a CADOT cyber security perspective, a field technician monitors planned or unplanned changes to the aforementioned devices. The third monitoring role is cyber analyst (operational technology cyber security analyst) responsible for cyber security analysis of operational technology systems. This role focuses on detecting and investigating anomalous or malicious cyber activities as well as verifying the effectiveness of mitigation actions.

The response roles include local and central engineers responsible for assessing the status and causes of incidents in the field and at operations centers, respectively. The engineers' cyber-specific responsibilities include identification, response and follow-up monitoring of anomalous incidents. Another response role is operations manager, incident manager or simply controller responsible for managing operations, measurements and incident resolution activities. The cyber-specific responsibilities include monitoring operating trends and response times, coordinating with field personnel and verifying responses to mitigation actions. The third response role is cyber security (forensic) investigator responsible for identifying and investigating cyber security anomalies and verifying the effectiveness of mitigation actions.

The analytics roles have a longer-term perspective into meta-forensics and strategic reviews. One analytics role is technical analyst responsible for forensic analyses of digital logs and after-action reviews. The cyber-specific responsibilities include reviewing and assessing the performance and stability of systems and devices over time, understanding and capturing systemic cyber security state baselines and issues, and creating and maintaining cyber scores for rating vendors on operational and cyber security reliability. The second analytics role is policy and compliance analyst responsible for safety and security reporting, compliance verification and decision support to system managers about workforce and operations policies. The cyber-specific responsibilities include assessing and summarizing system downtime and cyber events related to system and component failures.

## 5.2 CADOT Data Access and Display Needs

The second recommendation relates to data access and display needs:

* **Recommendation 2:** CADOT should provide multiple views into a potential cyber security situation based on the analytic needs of the moment.

Monitoring and response personnel attempt to understand if something is different from the normal (baseline) operational state. The CADOT system should provide active and passive monitoring tools that
provide information about the system state: pushed (active) notifications if something is abnormal and query-based (passive) requests for supporting investigative operations. When something appears to be abnormal, personnel need the capability to drill into the data to understand what has gone wrong and why (i.e., root cause determination). The investigation role can be part of the monitoring and response roles. However, analytics personnel require a longer-term view of the cyber security state and need data at multiple levels of temporal granularity (hours, days, weeks, months and years). The analytics role is more focused on helping make long-term decisions about equipment and operations, and the effectiveness of security policies. However, it is important not to add complexity to an already complex system. Therefore, an integrated systems approach to use and augment existing practices and tools is appropriate and preferred for CADOT, instead of simply adding more applications and displays that must be checked.

## 5.3 CADOT Cyber Security Baseline

The third recommendation relates to a cyber security baseline:

* **Recommendation 3:** CADOT should operate with the notion of a baseline that expresses normal functioning.

The concepts of baseline, system stability and normal operations are foundational to the CADOT concept. These could include historically-derived operational and performance levels over time for controllers and devices and should be further parameterized by vendor or manufacturer and include historical maintenance log data.

Baselines need to capture recurring rhythms of activity at multiple levels of temporal granularity for dynamic component data. For example, energy usage and network activity baselines could consider per-day variations in usage during a typical day, per-week variations that account for weekend versus weekday usage, and per-year variations that account for seasonal influences. The baselines might also consider environmental factors such as weather and component lifecycle phases. The baselines could be considered as windows of acceptable or normal variability captured as rolling averages or historical visualizations over time.

Figure 2 depicts a notional example of this concept. Historical baseline temporal patterns can provide more effective indicators of possible trouble while minimizing false positives. It would take time to establish these baselines because up to six months, or even one year, of historical baseline data may be needed to accurately establish baselines. Additionally, baselines may be multi-faceted and complex, involving multiple sensor inputs to establish meaningful metrics. However, the workshop
<figure><img src="image_6.png" /><figcaption>Figure 2. Notional use of historical baseline temporal patterns.</figcaption></figure>

participants also cautioned that too many data sources or metrics should not be aggregated into one “all OK” sensor because it would be difficult to calibrate and would provide less meaningful information in investigations.

## 5.4 Relevant Additional Information

The fourth recommendation relates to deviations from the cyber security baseline:

* **Recommendation 4:** When a baseline deviation occurs, CADOT should attempt to provide information about possible external factors or influences.

Ideally, given a potential cyber security alert, CADOT should identify correlating events based on monitoring, and the SCADA management and control system. This would help determine the relevant issues and guide the investigation into possible causes. Additional relevant data could include device operational status, history and health, system operational and maintenance status, current and seasonal weather conditions, and other related historical or environmental data. This aspect admittedly implies a level of smarts that will need to be designed, developed and refined over time due to its inherent multi-variable nature. Potential external influences on deviations may be obvious or semi-predictable, and CADOT should do its best to provide this information immediately when possible.

The workshop participants preferred a three-level protocol for CADOT alerts when potentially harmful situations occur: green representing system OK, yellow representing a possible issue and red representing critical. This simple protocol would help operators prioritize responses.
Note also that a single root cause could cause multiple alerts, possibly at different levels and at different parts of a system.

Additionally, the workshop participants suggested that it would be very helpful if the CADOT system could guide the compliance process, such as the suggested or required order of responses, notifications and mitigation actions.

## 5.5 CADOT Monitoring Frequencies

The fifth recommendation relates to monitoring frequencies.

* **Recommendation 5:** Some (mostly static) state information should be made visible immediately because it could signal important alert situations.

The CADOT monitoring capability must be configurable to accommodate the urgency and importance of various cyber security situations. The workshop consensus was that general monitoring timeframes should be considered. For example, slow-changing items such as system configurations and logs may need long-term monitoring frequencies of days to weeks. More dynamic information, such as the health status of systems, networks and devices would need more frequent, short-term monitoring of minutes to hours. The health and status of critical devices and networks would need continuous, real-time monitoring in order to identify dangerous trends quickly. In the case of data that is typically unchanged except under controlled circumstances, such as device IDs, firmware versions and remote system logins, any change could indicate a serious problem and the CADOT tool must immediately issue alerts about these types of falling or rising changes. Finally, data that is only needed during investigations may not have to be monitored on a regular basis, but it should be available via interactive queries.

Table 3 summarizes the monitoring timeframes suggested for various data types. Note that some data items are listed in multiple timeframes due to differences in organizational policies and priorities. Therefore, the CADOT monitoring timelines must be configurable.

## 5.6 CADOT Query Support

The sixth recommendation relates to interactive query support:

* **Recommendation 6:** CADOT should provide a means to interactively query the various interfaces and components.

The CADOT system must provide an interactive query capability to support incident investigations and analyses. Query requests for data
<table><caption>Table 3. Suggested timeframes for monitoring data.</caption><thead><tr><th>Timeframe</th><th>Data Type</th></tr></thead><tbody><tr><td>Long Term<br>(Days/Wks.)</td><td>Boolean: Firewall status, device integrity check<br>Discrete: Device firmware number, last maintenance date, device last maintenance/inspection date<br>Scalar: SCADA device baselines, SCADA safety system compromise indicators, network/bus states, device response latency<br>Model: Weather conditions, maintenance logs, network changes, source/configuration changes, operating system artifacts, active/inactive attack surface</td></tr><tr><td>Short Term<br>(Mins./Hrs.)</td><td>Boolean: Device availability, device integrity check, device performance level, device operation OK, device memory valid<br>Discrete: Weather conditions, device performance level, last message from network device, device last login<br>Scalar: Trend comparison with historical data, system operational status, network/bus states, device response latency<br>Model: Weather conditions, device health</td></tr><tr><td>Immediate<br>(Real Time)</td><td>Boolean: Device operation OK, device memory valid<br>Discrete: Last message from network device<br>Scalar: Device health, device operational status</td></tr><tr><td>On-Change</td><td>Boolean: Vendor/manufacturer diagnostic channels, device availability, device memory valid<br>Discrete: Asset ID, device last login, device firmware last updated date<br>Scalar: Device response latency<br>Model: Device health, device firmware signature</td></tr><tr><td>On-Demand</td><td>Boolean: Device memory valid<br>Discrete: Asset ID, device firmware version, device firmware last updated date<br>Scalar: Trend comparison with historical data<br>Model: Maintenance logs, weather conditions</td></tr></tbody></table>

vary based on response payload size and processing requirements. To avoid burdening the overall system, CADOT users will need assistance mechanisms to make decisions about interactively querying various interfaces and components depending on their needs. The assistance should enable users to create the most effective and efficient queries. Also, safe-
guards should be implemented to ensure that inadvertent large queries do not degrade system performance. CADOT query requirements depend on the root cause determination scenarios and processes that will have to be developed over time.

## 5.7 CADOT Data Extensibility

The seventh recommendation relates to data extensibility:

* **Recommendation 7:** CADOT should provide a means to plug in arbitrary data streams.

Sensors and devices continually evolve. Therefore, CADOT should future-proof itself as much as possible by considering sensor message handling for classes of data streams based on urgency and update frequency, nature of data and protocols, cost and benefit tradeoffs, and push versus pull data access. CADOT and its user interface should be able to handle new data streams that adhere to established rules, such as reusable widgets for similar data types, even if the sources differ. Other considerations include data interface type, temporal needs, API protocol and bus and network dependencies.

## 5.8 Configurable CADOT Alerting

The eighth recommendation relates to configurable alerts during deviations from baselines:

* **Recommendation 8:** CADOT should provide a means to set arbitrary running rules for alerts.

It is anticipated that operators will come to understand important nuances about what constitutes normal and emergency situations in their operational technology systems regardless of the level of automation employed by a mature CADOT implementation. Therefore, CADOT should include the ability to set customizable running rules that operators can define and manage interactively.

Figure 3 shows notional examples of user-definable running rules that alert based on simple one-metric thresholds (left) or more complex if-then rules based on multiple input metrics (right). The output alert levels are also definable.

## 5.9 CADOT Design Constraints

The ninth recommendation relates to accommodating device constraints:
<figure><img src="image_7.png" /></figure>

<figure><img src="image_8.png" /><figcaption>*Figure 3. Notional examples of user-definable running rules.*</figcaption></figure>

* **Recommendation 9:** CADOT should be designed to accommodate the computational, power, network bandwidth and availability constraints on operational technology devices.

The heterogeneous nature of operational technology systems and devices means that their capabilities (or lack of capabilities) vary greatly. For example, devices with limited processing capacity may not be able to support encryption and authentication. Connections with network communications carriers may have downstream dependency implications on other parts of the networks. Devices also vary in their ability to communicate rapidly or continuously, which will require a range of update frequencies to be accommodated, from real-time/continuous to intermittent (e.g., hourly or daily) to on-demand only. CADOT should also define and leverage device interfaces to maximize compatibility and reuse.

# 6. CADOT Key Design Features

The nine recommended requirements summarized above contributed to the specification of the following key design features to achieve an effective CADOT cyber security situational awareness capability:

* CADOT should strive to streamline operations and incident response with consistent cyber information. Duplication in monitoring displays and functionality should be avoided. Integration with existing tools and infrastructure should be maximized. Customizable groupings of related events and alerts should be provided.

* To render CADOT effective and adaptable, it should be able to establish and maintain baseline normal operation metrics of historical trends and cyber security metrics, establish normal limit thresholds and interactively manage user-defined running rules.
* CADOT displays and analysis support should be specialized for different user roles. This means that the CADOT user interface will have to be customizable, if not composable, by users. CADOT should support multiple temporal scales and user-defined running rules based on alerts, logs and associated data. To support near-term visual analytics until more advanced machine learning features can be developed, visualizations of current cyber security state data against historical trends and patterns at selectable temporal scales should be provided.

* Active (push-based information and alerts) and passive (query-based) monitoring should be implemented. CADOT users need the ability to drill down into issues from multiple perspectives. CADOT should provide access to all relevant data (e.g., environmental, associated metrics and historical context) that could help identify, assess and mitigate cyber security incidents.

* Future CADOT capability enhancements should support integration with an asset management system for associating devices with cyber events and a case management system for event tracking. However, a decision to evolve CADOT into a full security information and event management (SIEM) tool should be balanced against the potential complexity and utility of leveraging existing tools in this space.

# 7. Commercially-Available Technologies

The next step in the CADOT design process is to review available technologies and tools that can be leveraged to address the recommended CADOT requirements and design features. Figure 4 shows a mapping of an initial sampling of commercially-available operational technology cyber security products (namely, Claroty, CyberX, Cynalytica, Dragos, Perspecta Labs, Tenable, SRI International (TIGR) [12] and Siemplify/Anomali) to accommodate the nine CADOT requirements. The pie charts indicate the degrees to which the commercial tools provide full, partial and no (missing) coverage of the CADOT requirements.

The initial sampling of commercial products appears to address many of the CADOT requirements. However, two CADOT requirements are not supported adequately by the sampled products. The ability to provide relevant associated or environmental data along with anomaly alerts to enable investigators to understand possible causes, and even whether alerts should be a priority, are largely non-existent at this time. Another CADOT requirement that is not well covered by commercial offerings
<figure><img src="image_9.png" /><figcaption>Figure 4. Mappings of cyber security technologies to meet CADOT needs.</figcaption></figure>

is the ability to create user-defined running rules. This requirement is not well handled by the automated, historically-based-signature and pre-configured approaches of current products.

Additionally, while many cyber security products created for operational technology systems employ network-level monitoring, there is a growing, and currently unmet, need for operational technology devices, including programmable logic controllers, remote terminal units, bus devices, serial and analog devices, and other embedded electronic devices, that provide improved, built-in cyber awareness functionality. The needed vendor-provided device improvements include:

* Ability to continuously monitor the cyber security health of operational technology devices, especially internal memory and process control flow integrity.

* Ability to monitor network activities between system components.
* Ability to deflect or block adversarial attacks such as device memory injections, altered device control flows and unauthorized configuration modifications.

* Authentication framework for standardized, trusted and secure mediation and forensic analyses.

These improved devices and tools must be based on standardized protocols to ensure interoperability across vendors. They must also be compatible with commercially-available cyber security analytical tools and displays for effective and reliable integration in industrial control system environments. The new cyber-aware devices must operate under the unique environmental constraints imposed on operational technology devices, including small form factors, low power requirements, intermittent or limited communications bandwidth, and remote operation with limited physical monitoring and maintenance.

While operational technology vendors have attempted to address the need for cyber-aware and cyber-secure operational technology systems and devices, there is more to be done. The capability requirements discussed in this chapter represent the most important gaps that should be addressed to provide adequate awareness of the cyber security states of operational technology systems. Future work will continue the evaluation of cyber security products for addressing the requirements. The consortium of natural gas distribution utilities will work with vendors to define needed cyber security enhancements, collaborate on their development and provide independent testing and validation. These are the important next steps to provide operational technology asset owners and operators with the means to identify cyber security issues in a timely manner and address them before the physical assets they monitor and control are damaged.

# 8. Conclusions

Operational technology systems that manage and control critical infrastructure assets are vulnerable to cyber attacks. It is necessary to establish and maintain reliable monitoring of the cyber security health of these systems and continually provide operators with awareness of the true states of their systems. There is growing, but limited, availability of technologies and tools that provide the needed cyber security awareness.

This chapter has summarized collaboration efforts with members of the natural gas distribution sector on developing a set of recommended functional requirements for operational technology-based cyber security health monitoring and awareness systems. The design-driven process
is reviewed and the nine key recommendations for securing operational technology systems are discussed.

An initial review of commercially-available products suggests that they address many of the recommended requirements. However, while the operational technology community has invested considerable effort in developing cyber-aware and cyber-secure systems and devices, much more remains to be done. Future work will continue the collaboration with the natural gas distribution sector and the operational technology community to continue to advance the state of the art in this domain that is vital to critical infrastructure protection.

Any opinions, findings, conclusions or recommendations expressed in this chapter are those of the authors and do not necessarily reflect the views of the U.S. Department of Homeland Security, Gas Technology Institute or individual utilities, and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of the U.S. Department of Homeland Security, U.S. Government, Gas Technology Institute or individual utilities.

## Acknowledgements

This research was sponsored by the U.S. Department of Homeland Security Science and Technology Directorate (DHS S&T) under Contract No. HSHQDC-16-C-00034. The authors thank DHS S&T Program Manager, Mr. Gregory Wigton, for his guidance and support. The authors also thank Dr. Tony Tang from the University of Toronto for his assistance in coordinating and facilitating the CADOT ideation workshop. Additionally, the authors thank Mr. Matthew Manning from the Gas Technology Institute and the utility representatives who completed the CADOT survey and/or participated in the CADOT ideation workshop.

## References

[1] Cybersecurity and Infrastructure Security Agency, Alert (AA20-205A) NSA and CISA recommended immediate actions to reduce exposure across operational technologies and control systems, Arlington, Virginia (www.us-cert.cisa.gov/ncas/alerts/aa20-205a), October 24, 2020.

[2] Cybersecurity and Infrastructure Security Agency, Securing Industrial Control Systems: A Unified Initiative, FY2019-2023, Arlington, Virginia (www.cisa.gov/sites/default/files/publications/Securing_Industrial-Control_Systems_S508C.pdf), 2020.
[3] Cybersecurity and Infrastructure Security Agency, Assessments, Arlington, Virginia (us-cert.cisa.gov/ics/Assessments), 2021.

[4] Cybersecurity and Infrastructure Security Agency, Downloading and installing Cyber Security Evaluation Tool (CSET), Arlington, Virginia (us-cert.cisa.gov/ics/Downloading-and-Installing-CSET), 2021.

[5] K. Davis, Texas A&M: CYPRES, Cybersecurity for Energy Delivery Systems Peer Review, Texas A&M Engineering Experiment Station, College Station, Texas (www.energy.gov/ceser/cybersecurity-energy-delivery-systems-2020-peer-review-presentations), October 6-7, 2020.

[6] Dragos, Dragos: Neighborhood Keeper, Cybersecurity for Energy Delivery Systems Peer Review, Hanover, Maryland (www.energy.gov/ceser/cybersecurity-energy-delivery-systems-2020-peer-review-presentations), 2020.

[7] D. Gammel, Schweitzer Engineering Laboratories: Ambassador, Cybersecurity for Energy Delivery Systems Peer Review, Schweitzer Engineering Laboratories, Pullman, Washington (www.energy.gov/ceser/cybersecurity-energy-delivery-systems-2020-peer-review-presentations), 2020.

[8] Gas Technology Institute, Identifying and Addressing High-Priority Cybersecurity Issues, Des Plaines, Illinois (www.gti.energy/identifying-and-addressing-high-priority-cybersecurity-issues), 2021.

[9] Hasso Plattner Institute of Design, Getting Started with Design Thinking, Stanford University, Stanford, California (www.dschool.stanford.edu/resources/getting-started-with-design-thinking), 2021.

[10] C. Hurd and M. McCarty, A Survey of Security Tools for the Industrial Control System Environment, INL/EXT-17-42229 Revision 1, Idaho National Laboratory, Idaho Falls, Idaho, 2017.

[11] M. Locasto and D. Balenson, A comparative analysis approach for deriving failure scenarios in the natural gas distribution infrastructure, in *Critical Infrastructure Protection XIII*, J. Staggs and S. Shenoi (Eds.), Springer, Cham, Switzerland, pp. 19–50, 2019.

[12] M. Locasto and D. Balenson, Threat intelligence for grid recovery, presented at the *More Situational Awareness for Industrial Control Systems (MOSAICS) Industry Day* (www.rdp21.org/wp-content/uploads/2020/11/MOSAICS-Industry-Day-SRI-TIGR-v3-1.pdf), 2020.
[13] J. McCarthy, O. Alexander, S. Edwards, D. Faatz, C. Peloquin, S. Symington, A. Thibault, J. Wiltberger and K. Viani, Situational Awareness for Electric Utilities, NIST Special Publication 1800-7, National Institute of Standards and Technology, Gaithersburg, Maryland, 2019.

[14] M. Nielsen, General Electric: Natural Gas Compression, Cybersecurity for Energy Delivery Systems Peer Review, GE Research, Niskayuna, New York (www.energy.gov/ceser/cybersecurity-energy-delivery-systems-2020-peer-review-presentations), 2020.

[15] Office of Cybersecurity, Energy Security and Emergency Response, 2020 Cybersecurity for Energy Delivery Systems Peer Review, U.S. Department of Energy, Washington, DC (www.energy.gov/ceser/articles/2020-cybersecurity-energy-delivery-systems-peer-review), 2020.

[16] Office of Cybersecurity, Energy Security and Emergency Response, Cybersecurity for Energy Delivery Systems 2020 Peer Review Presentations, U.S. Department of Energy, Washington, DC (www.energy.gov/ceser/cybersecurity-energy-delivery-systems-2020-peer-review-presentations), 2020.

[17] Office of Cybersecurity, Energy Security and Emergency Response, Cybersecurity Research, Development and Demonstration (RD&D) for Energy Delivery Systems, U.S. Department of Energy, Washington, DC (www.energy.gov/ceser/activities/cybersecurity-critical-energy-infrastructure/cybersecurity-research-development-and), 2020.

[18] Office of Electricity, Liberty Eclipse Energy Cyber Incident Exercise, Exercise Summary Report, U.S. Department of Energy, Washington, DC (www.energy.gov/sites/default/files/2017/05/f34/LE%20FINAL%20Exercise%20Summary%20May2017-Public%20Doc.pdf), 2017.

[19] Transportation Security Administration, Pipeline Security Guidelines, Springfield, Virginia (www.tsa.gov/sites/default/files/pipeline_security_guidelines.pdf), 2021.