OT Data Needs Process Context

Before you start with packets, logs and security events, you need to understand what the process is doing.

In Labshock we use Eastwater to teach this.

It is a water treatment process with pumps, valves, sensors, PLC logic and HMI.

What One Engineer Said

One engineer with 25 years of experience told me, after seeing it:

For us, this is important proof.

A Value Alone Is Not Enough

A changed value alone is not enough.

You need to understand where that value comes from, what unit it uses, what equipment depends on it, and what the controller should do next.

Same with a stopped pump. You need to know what process comes after it, and what impact you should expect.

Where I Started

My first OT system was an oil drilling rig.

I remember the driller telling me before we arrived:

At that time I was a telecom engineer.

I still use the same principle today.

First understand the process.

Then test the security around it.

OT security must be testable.

Try It Yourself

• Before touching packets or logs, map what the process actually does — inputs, outputs, dependencies.
• Work Eastwater yourself and see the same water treatment process this engineer recognised: github.com/zakharb/labshock
• Read the six-area framework for connecting an event to what it means: labshocksecurity.com/news/ot-security-context-cheat-sheet
• Talk process with other people doing the same thing: discord.gg/bpmaQFfW76