CYBRARY Unit 2 — Security levels and protection profiles
13 minWriting a zone's protection profile
Target level, the requirements it is argued from, what must hold, and the one finding that takes the zone out of profile.
By the end you can
- Read a protection profile and say what would breach it.
- Write the must-hold statements for a zone in the plant's own words.
- Recognize an out-of-profile finding from a log record.
What a profile contains
A protection profile is short on purpose. It names the zone, the target level, the requirements the argument rests on, the statements that must hold while the plant runs, and the single finding that takes the zone out of profile.
| Zone profile | Argument and breach |
|---|---|
| Z-SAFETY — target SL3 | Argued on FR2, FR3, FR7. Out of profile: Any writable state on the safety controller during a run. The safety system is watched, never commanded. |
| Z-CONTROL — target SL3 | Argued on FR1, FR2, FR3, FR6, FR7. Out of profile: A write the register cannot account for, or two masters contesting the same controller. |
| Z-OPS — target SL2 | Argued on FR1, FR4, FR6. Out of profile: Bulk archive reads, a new egress destination, or a program download sourced anywhere else. |
| Z-DMZ — target SL2 | Argued on FR1, FR5, FR6. Out of profile: A plant-side session with no matching DMZ leg — a conduit nobody declared. |
| Z-ENTERPRISE — target SL1 | Argued on FR1, FR5. Out of profile: A dual-homed host, which is an undeclared conduit wearing a laptop. |
Must-hold statements, zone by zone
These are written the way an operator would say them, not the way a standard would. That is deliberate: a statement nobody on shift can check is not a control.
| Zone | Must hold |
|---|---|
| Z-SAFETY | The key switch sits in RUN for the whole production run. |
| Z-SAFETY | No force is active on an interlock, and no force survives a keep-alive. |
| Z-SAFETY | A trip point reached is a trip taken — nothing suppresses it. |
| Z-CONTROL | Every address speaking control protocol is in the asset register. |
| Z-CONTROL | Write function codes come only from the panel that owns the process. |
| Z-CONTROL | One master per controller, and the commanded value matches the trend. |
| Z-OPS | The historian collects and never commands. |
| Z-OPS | Batch records and archives are read inside a reporting window, at a familiar volume. |
| Z-OPS | The engineering workstation is the licensed one, and program downloads come from it alone. |
| Z-DMZ | Every session from business IT terminates in the DMZ and is brokered onward. |
| Z-DMZ | The replica serves the reads; nothing reaches the plant behind it. |
| Z-DMZ | Remote access into the control room arrives by the sanctioned path or not at all. |
| Z-ENTERPRISE | Business IT is treated as untrusted by everything below it. |
| Z-ENTERPRISE | No office host holds an address on a plant network at the same time. |