🎓 Lesson 17
D5
ROC Cybersecurity Penetration Testing Scope
Penetration testing for a Mine Remote Operations Center (ROC) is like a controlled 'fire drill' where cybersecurity experts safely try to break into the ROC’s systems to find and fix weaknesses before real hackers do.
🎯 Learning Objectives
- ✓ Explain the legal and operational constraints that define a valid pentest scope for a mine ROC
- ✓ Analyze network segmentation diagrams to identify out-of-scope assets (e.g., safety shutdown systems)
- ✓ Apply ISA/IEC 62443-3-3 zone/conduit models to design a compliant pentest boundary
- ✓ Document scope exclusions using standardized terminology from NIST SP 800-115 Rev. 1
📖 Why This Matters
A single unsecured remote access point into a mine’s ROC can allow attackers to manipulate haul truck dispatch, disable ventilation controls, or falsify gas sensor readings—risking lives, production, and environmental compliance. Unlike generic IT systems, ROCs integrate life-critical OT (Operational Technology) with corporate IT; mis-scoped pentests have caused unintended PLC resets or SCADA lockouts. Understanding scope isn’t bureaucracy—it’s the foundational safety gate before any test begins.
📘 Core Principles
Scope definition in ROC pentesting rests on three pillars: (1) Asset criticality classification (per ISA/IEC 62443-3-2), distinguishing Safety Instrumented Systems (SIS) from non-safety automation; (2) Logical and physical segmentation (zones/conduits), where only assets in the 'Remote Monitoring & Control' zone may be tested; and (3) Rules of Engagement (RoE) that explicitly exclude live safety loops, emergency stop networks, and redundant comms paths. Scope must align with mine-specific Operational Risk Assessments (ORA) and be approved by both ROC Operations Lead and Cybersecurity Governance Board—not just IT.
📐 Scope Boundary Index (SBI)
The Scope Boundary Index quantifies the permissible attack surface ratio relative to total ROC assets, ensuring tests remain focused and low-risk. It guides scoping decisions during pre-engagement planning.
Scope Boundary Index (SBI)
SBI = (N_in_scope / N_total) × 100Quantifies percentage of ROC assets authorized for testing; used to enforce risk-based scope limits.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| N_in_scope | Number of in-scope assets | count | Assets formally approved for testing, verified to reside outside safety-critical zones |
| N_total | Total ROC networked assets | count | All hardware/software components with network interfaces connected to ROC infrastructure |
Typical Ranges:
High-integrity ROC (gold, uranium): 15% - 35%
Greenfield ROC with validated segmentation: 25% - 40%
💡 Worked Example
Problem: A copper mine ROC hosts 218 total networked assets: 42 are Tier-0 safety-critical (SIS, ESD), 67 are Tier-1 operational (PLC controllers, HMI servers), 89 are Tier-2 support (engineering workstations, reporting DB), and 20 are Tier-3 corporate (email, HR). Per ISA/IEC 62443-3-3, only Tier-1 and Tier-2 assets may be included if isolated from Tier-0 via validated air gaps or unidirectional gateways. Validate SBI against the 35% maximum allowable scope threshold.
1.
Step 1: Identify in-scope assets = Tier-1 + Tier-2 = 67 + 89 = 156
2.
Step 2: Calculate SBI = (In-scope assets / Total assets) × 100 = (156 / 218) × 100 = 71.56%
3.
Step 3: Compare to safe limit: 71.56% > 35% → Invalid scope. Must apply strict segmentation: exclude Tier-2 assets sharing VLANs or firewalls with Tier-0, reducing in-scope count to 67 (Tier-1 only). Revised SBI = (67 / 218) × 100 = 30.7%
Answer:
The revised SBI is 30.7%, which falls within the safe range of ≤35% for ROC pentests per IEC 62443-3-3 Annex D guidance.
🏗️ Real-World Application
At Newmont’s Boddington ROC (Western Australia), a 2023 pentest was halted after Day 1 when testers attempted credential spraying against an engineering workstation co-located on the same OT VLAN as the primary SIS gateway. The scope had incorrectly included 'all ROC engineering assets' without validating network isolation. Post-incident, the scope was redefined using ISA/IEC 62443-3-3 zone mapping: only assets in Conduit C2 (ROC-to-Mine-WiFi telemetry) were authorized, excluding all VLANs tagged 'SIS-PROTECTED'. This reduced in-scope assets from 142 to 29 and enabled successful, zero-downtime validation of remote access MFA controls.
📋 Case Connection
📋 Coal Mine ROC Cybersecurity Hardening in Appalachia
Legacy PLCs exposed to corporate IT network with no segmentation; failed NIST SP 800-82 audit