Analog Electronic & Cyberdefence

The Strategic Role of Analog Electronics in OT/ICS Cyber Defense

A doctrinal military essay with threat matrices, attack scenarios, and documented historical cases (energy, defense, hospitals, SCADA).

Scope & intent. This text focuses on cyber-physical resilience in Operational Technology (OT), Industrial Control Systems (ICS), and critical infrastructures. It argues that analog electronics are not “legacy leftovers” but a sovereign, non-software layer of authority that can constrain or outlast digital compromise.

Table of contents

• 1) Doctrinal thesis
• 2) A hybrid sovereign architecture (analog → digital → cyber)
• 3) Threat matrices for OT/ICS
• 4) Attack scenarios (operational narratives)
• 5) Documented historical cases
• 6) Operational implications & design principles
• References (numbered)

1) Doctrinal thesis

In military OT/ICS defense, the decisive contest is not only “who controls the network,” but who retains authority over physical outcomes. A software-centric posture is strategically fragile because digital systems can be deceived, coerced, or subverted at scale. Analog electronics contribute an asymmetric advantage: they implement security-relevant decisions in physics—not in code.

Doctrinal principle: Digital systems may command. Analog systems decide.
In a resilient design, the analog layer enforces physical thresholds and vetoes unsafe states—even if the cyber layer is compromised.

2) A hybrid sovereign architecture (analog → digital → cyber)

A military-grade cyber-physical posture benefits from a hierarchy of authority:

Layer	Role	Typical components	Why it matters in conflict
Analog authority	Physical truth, hard limits, fail-safe/fail-secure actions	Comparators, analog filters, protective relays, hardwired interlocks, mechanical cutoffs	Non-software “veto power” resists remote compromise and false-data operations
Digital control	Automation and control logic	PLCs, RTUs, DCS controllers, embedded firmware	High leverage: compromise can translate into physical effects
Cyber / network	Connectivity, telemetry, analytics, remote ops, AI	SCADA servers, historians, engineering workstations, remote access, SOC tooling	Largest attack surface; requires strict segmentation and constrained authority

The doctrinal goal is not to “replace digital” but to ensure that digital autonomy is bounded by analog constraints. This is how a force preserves operational continuity when cyber superiority is contested or temporarily lost.

3) Threat matrices for OT/ICS

3.1 Threat matrix (tactics → targets → physical outcomes)

Use this as a planning tool for risk owners (commanders, plant directors, CISOs) to align threat assumptions with engineering controls.

Threat / tactic	Primary target	Likely impact	Analog “authority” countermeasure	Digital / procedural countermeasure
False Data Injection (FDI) / sensor spoofing	Sensors, telemetry paths, HMI trust	Unsafe operations guided by false reality; delayed detection	Analog plausibility checks; hardwired thresholds; independent analog alarms	Sensor redundancy; cross-validation; anomaly detection; authenticated telemetry
Remote access misuse / credential theft	Engineering workstations, remote admin tools	Unauthorized setpoint changes, process drift	Hardwired interlocks; local-only physical enable switches	MFA; jump servers; time-bound access; logging; strict segmentation
PLC/DCS logic manipulation	Controllers, ladder logic, function blocks	Process sabotage; equipment damage; safety margin erosion	Analog protective relays; independent trip circuits; physical limiters	Change control; signed logic; backups; allowlisting; continuous verification
Safety system interference (SIS compromise)	SIS controllers / safety instrumented system	Catastrophic risk: explosion, toxic release, loss of life	Hardwired ESD where feasible; independent analog trips; mechanical relief devices	Strict SIS isolation; safety lifecycle governance; forensic monitoring; vendor hardening
Destructive malware / wiper in OT environment	SCADA servers, HMIs, historians	Loss of visibility/control; extended outage	Manual-analog fallback; local analog gauges/controls; non-networked safety cutoffs	Offline backups; rapid rebuild images; incident playbooks; network segmentation
EMI/EMP / signal interference (cyber-physical vector)	Instrumentation, comms, sensor front-ends	Erratic behavior; induced faults; hidden degradation	Analog filtering, shielding, grounding discipline, differential measurement	Hardening standards; monitoring; controlled zones; maintenance & inspections

3.2 “Analog authority” capability matrix (what to deploy, where, and why)

Analog capability	Best fit sectors	Stops / limits	Design note
Protective relays & hard trips	Energy generation, substations, heavy industry	Overcurrent, frequency excursions, unstable states	Ensure trip logic remains independent of SCADA/HMI authority
Hardwired interlocks & permissives	Defense platforms, refineries, chemical plants	Unsafe sequences and forbidden states	Require physical presence or keyed enable for critical actions
Independent analog alarms	Hospitals, utilities, water, process industries	Silent failure when dashboards are compromised	Separate power/paths; audible/visual alarms not dependent on network
Signal plausibility & filtering (analog front-end)	Air defense sensors, radar/sonar chains, smart instrumentation	Spoofed signals; physically impossible waveforms	Combine with digital analytics; treat analog as “truth anchor”
Mechanical relief & passive safety	Chemical, oil & gas, nuclear-adjacent processes	Overpressure, thermal runaway escalation	Not “cyber” per se, but decisive in cyber-induced unsafe conditions

4) Attack scenarios (operational narratives)

Note: The following scenarios are written for planning and training. They describe high-level attacker behavior and defensive decision points (not step-by-step instructions).

Scenario A — Energy: Substation/Distribution disruption via OT intrusion

Intent: disrupt power delivery and erode public confidence during crisis.

• Phase 1 (Access): attacker gains foothold through corporate IT and moves toward OT supervision (SCADA/HMI).
• Phase 2 (Control): unauthorized switching commands and setpoint manipulation attempt to create instability/outage.
• Phase 3 (Cover): attacker degrades operator visibility (HMI tampering, log wiping, comms disruption).
• Decisive defense point: analog protective relays and hard trips isolate unsafe electrical conditions even if the HMI is lying.

Analog authority play: keep protection logic and trip authority independent; train operators to trust local measurements and relay status over HMI visuals when compromise is suspected.

Scenario B — Petrochemical/Process: Safety Instrumented System (SIS) targeted

Intent: defeat safety shutdown capacity to enable catastrophic physical outcome.

• Phase 1: attacker reaches the OT environment and pivots toward SIS engineering assets.
• Phase 2: attempts to modify SIS behavior so that unsafe conditions do not trigger shutdown.
• Phase 3: triggers process conditions that would normally cause emergency shutdown.
• Decisive defense point: independent hardwired ESD / analog trips + mechanical relief systems can still prevent escalation.

Analog authority play: preserve independent shutdown paths; ensure SIS isolation and continuous integrity monitoring; assume SIS is a primary strategic target.

Scenario C — Hospitals: IT ransomware cascades into clinical operations

Intent: paralyze services by denying access to records, scheduling, and diagnostics.

• Phase 1: ransomware compromises hospital IT, impacting admissions, imaging workflows, and coordination.
• Phase 2: emergency operations degrade; diversions and delays increase clinical risk.
• Decisive defense point: analog alarms, independent device fail-safes, and local controls keep core life-safety functions operating despite IT collapse.

Analog authority play: ensure critical devices have independent alarms and local control modes; maintain “downtime procedures” that explicitly rely on non-networked indicators and workflows.

Scenario D — Municipal Water: Remote access misuse alters chemical dosing

Intent: poison risk or public panic through chemical manipulation.

• Phase 1: attacker abuses remote access to an operator workstation.
• Phase 2: attempts a drastic chemical setpoint change.
• Decisive defense point: independent pH/quality instrumentation and hard constraints can block or rapidly detect unsafe dosing.

Analog authority play: enforce hard maximums, interlocks, and independent quality checks that cannot be overridden by a single digital interface.

5) Documented historical cases (what they teach doctrinally)

Each case below is widely cited in public reporting and illustrates how cyber operations intersect with physical systems. The “analog lesson” highlights how independent physical constraints and non-networked safeguards can determine outcomes.

Case 1 — Stuxnet (circa 2009–2010): sabotage via industrial control manipulation

• What happened: malware targeted centrifuge operations by manipulating control behavior and masking the effect from operators.
• Sector: industrial process control / nuclear-related enrichment operations.
• Doctrinal lesson: cyber capabilities can produce precise physical degradation while maintaining deceptive normalcy.
• Analog lesson: independent physical measurement and out-of-band monitoring reduce reliance on potentially manipulated digital telemetry.

Case 2 — Ukraine power grid (2015): cyber-induced outage against utility operations

• What happened: attackers compromised utility environments and executed actions that contributed to power outages, combined with operational disruption.
• Sector: energy / distribution utilities.
• Doctrinal lesson: utility OT is a strategic target in hybrid conflict; attacker objectives include both outage and psychological effect.
• Analog lesson: protection relays and local operational procedures remain decisive when supervisory systems are degraded.

Case 3 — TRITON/TRISIS (2017): malware targeted Safety Instrumented Systems

• What happened: malware targeted Schneider Electric Triconex SIS controllers—systems designed to trigger safe shutdown in emergencies.
• Sector: petrochemical / high-hazard industrial facilities.
• Doctrinal lesson: safety systems are strategic targets; compromise can elevate risk from “outage” to mass-casualty potential.
• Analog lesson: independent shutdown paths (including hardwired trips and passive/mechanical protections) are strategic life-safety controls.

Case 4 — German steel mill (2014): intrusion linked to physical damage

• What happened: attackers infiltrated networks and impacted control of industrial components, reportedly contributing to major physical damage.
• Sector: heavy industry.
• Doctrinal lesson: even “non-critical” industrial sites can be leveraged for strategic disruption; IT-to-OT movement is a recurring pattern.
• Analog lesson: independent protective systems, interlocks, and local instrumentation reduce the chance that loss of digital control becomes catastrophic.

Case 5 — Maroochy Shire sewage (Australia, 2000): SCADA manipulation causing environmental harm

• What happened: unauthorized access to SCADA controls caused pumping station malfunctions and sewage releases.
• Sector: municipal water/wastewater SCADA.
• Doctrinal lesson: insider/contractor knowledge and wireless/field interfaces can be exploited to produce real-world harm.
• Analog lesson: independent alarms, physical locks, and hard constraints can limit damage from malicious command injection.

Case 6 — Oldsmar, Florida (2021): attempted chemical dosing manipulation via remote access

• What happened: an attacker remotely accessed systems and attempted to raise sodium hydroxide levels; the change was noticed and reversed, and safety checks were relevant.
• Sector: water treatment.
• Doctrinal lesson: remote access paths (often deployed for convenience) can become strategic liabilities.
• Analog lesson: independent water-quality instrumentation and hard limits can prevent a single remote action from causing harm.

Case 7 — NHS WannaCry (2017): ransomware disruption with operational healthcare impacts

• What happened: ransomware affected NHS services, disrupting operations across hospitals and care delivery.
• Sector: healthcare (IT disruption cascading into clinical operations).
• Doctrinal lesson: healthcare is critical infrastructure; IT failure can create life-safety risk even without direct OT compromise.
• Analog lesson: independent device alarms and local fallback procedures are essential when digital coordination systems fail.

Case 8 — Düsseldorf hospital ransomware (2020): emergency diversion and fatal-risk debate

• What happened: ransomware disrupted hospital systems; emergency admission was impacted and a patient diversion raised serious concerns and legal scrutiny.
• Sector: healthcare (operational continuity).
• Doctrinal lesson: cyber incidents can create real-time emergency risk; the “battle rhythm” of response matters.
• Analog lesson: keep critical clinical functions able to operate under “digital darkness” with independent monitoring and clear downtime workflows.

6) Operational implications & design principles

6.1 Command-level priorities (OT/ICS)

• Constrain digital authority: SCADA/HMI should not be able to override safety-critical analog constraints.
• Design for “deception”: assume dashboards can be wrong; maintain out-of-band verification.
• Train for digital darkness: operators must rehearse fallback operations using local instrumentation and analog controls.
• Protect the safety layer: treat SIS as strategic terrain; isolate it, monitor it, and keep independent shutdown paths.
• Engineer sovereign fail-safe: ensure failures converge toward safe states, not merely “stopped” states.

6.2 Field checklist (high-level)

Objective	What “good” looks like
Analog authority preserved	Hard trips/interlocks cannot be overridden by remote commands; local-only enable for critical actions
Independent visibility	Local gauges / independent instrumentation available; procedures mandate cross-checking under suspicion
Safety layer isolation	SIS separated; engineering changes tightly controlled; monitoring and audit trails enforced
Downtime readiness	Regular drills for manual operation; paper workflows or offline methods for hospitals/utilities

References (numbered)

1. [1] Stuxnet facts and reporting on industrial sabotage (public analyses)
2. [2] Ukraine power grid cyberattack (2015) case documentation / analysis
3. [3] TRITON/TRISIS / HatMan targeting Triconex SIS (government advisories)
4. [4] German steel mill incident (2014) case documentation
5. [5] Maroochy Shire sewage/SCADA attack case study (public record summaries)
6. [6] Oldsmar water treatment compromise advisory and reporting
7. [7] UK National Audit Office report on WannaCry impact on the NHS
8. [8] Düsseldorf hospital ransomware reporting / case summaries

Reusable training prompt (for your staff college / exercises):
“Assume the HMI lies. Which analog measurements, trips, and interlocks can still prevent a catastrophic state? Which decisions require physical presence? Which safety actions are irreversible and must never be delegated to a remotely reachable system?”

Disclaimer: This article is for defensive planning, education, and resilience engineering. It is not operational guidance for wrongdoing.

Analog Electronics as Physical Root of Trust

Strategic Cyber-Physical Defense Doctrine for OT/ICS and Critical Infrastructure

1. Strategic Doctrinal Foundation

Modern cyber defense strategies have largely focused on software integrity, cryptographic assurance, and network security. However, in Operational Technology (OT), Industrial Control Systems (ICS), defense platforms, energy grids, and medical infrastructures, security cannot depend exclusively on digital logic.

Digital systems interpret reality.
Analog systems measure reality.

This distinction is foundational. A Physical Root of Trust (PRoT) is a layer of system authority grounded in physics, not firmware. Analog electronics serve as this root by enforcing physical constraints independent of software compromise.

2. Definition: Physical Root of Trust (PRoT)

A Physical Root of Trust is defined as:

• An independent hardware layer that measures physical variables directly
• Capable of enforcing irreversible safety constraints
• Immune to remote code execution
• Not dependent on firmware authenticity for operation

Unlike digital roots of trust (TPM, secure boot, signed firmware), the Physical Root of Trust operates outside logical abstraction. It cannot be patched, injected, or remotely reprogrammed.

3. Strategic Hierarchy of Authority

Layer	Authority Type	Vulnerability Surface	Strategic Role
Analog (Physical Root)	Physical Constraint	Minimal (requires physical access)	Final Veto / Fail-Safe
Digital Control	Logical Automation	Medium (firmware & configuration)	Operational Optimization
Cyber / Network	Remote Command & Data	High (external attack surface)	Coordination & Intelligence

Doctrine principle:

No cyber system shall possess authority to override a physical safety constraint.

4. Technical Conceptual Schematics

4.1 Signal Validation Architecture

[Physical Sensor]

      |

      v

[Analog Front-End Filtering]

      |

      v

[Analog Comparator Threshold]

      |

      +------> [Hardwired Trip Circuit] ----> [Physical Actuator Cutoff]

      |

      v

[ADC Conversion]

      |

      v

[Digital Control System / PLC]

Key principle: The analog comparator executes threshold validation before digital interpretation. If the signal exceeds safe bounds, the hardwired trip activates regardless of PLC state.

4.2 Physical Veto Logic (Fail-Safe Authority)

Condition A: Temperature > Safe Limit

Condition B: Pressure > Safe Limit

Condition C: Voltage Instability

Analog Logic:

IF (A OR B OR C) --> Trigger Emergency Shutdown (ESD)

Digital System:

Receives status but cannot suppress ESD signal

The veto path is electrically independent from digital communication buses. This ensures:

• No firmware update can alter shutdown behavior
• No network compromise can block safety activation
• No false telemetry can deceive the analog comparator

5. Application Domains

Energy Infrastructure

Protective relays and analog overcurrent detection isolate faults even if SCADA displays are manipulated. Frequency instability detection in analog domain prevents cascading grid collapse.

Defense Platforms

Weapon release systems integrate hardwired permissives. Signal plausibility filters at radar front-ends reject physically impossible waveforms before digital processing.

Hospitals

Ventilators and life-support systems include analog alarms independent of hospital IT networks. Power isolation systems remain purely physical and immune to ransomware.

Industrial & Chemical Facilities

Emergency Shutdown Systems (ESD) incorporate hardwired logic layers ensuring catastrophic escalation cannot occur solely through digital manipulation.

6. Strategic Risk Analysis Matrix

Threat Vector	Digital Impact	Without PRoT	With PRoT
PLC Logic Manipulation	Unsafe Process Behavior	Potential catastrophic failure	Analog trip isolates system
False Sensor Injection	Operator deception	Delayed detection	Analog plausibility check blocks signal
Ransomware	Loss of supervisory control	Operational paralysis	Manual-analog fallback available
SIS Compromise	Safety bypass	Mass-casualty risk	Independent shutdown path remains

7. Doctrinal Imperatives

• Maintain independent analog safety circuits in all critical infrastructure.
• Ensure safety interlocks cannot be disabled remotely.
• Implement signal plausibility validation before digital ingestion.
• Train operators for degraded digital environments.
• Design systems assuming cyber compromise is possible.

8. Strategic Conclusion

Cyber resilience is not achieved when software is hardened.
It is achieved when physics has veto power over software.

Analog electronics are not legacy artifacts. They are instruments of strategic sovereignty. In hybrid conflict environments, where cyber operations precede kinetic escalation, the Physical Root of Trust ensures continuity of mission, safety of population, and preservation of national critical capabilities.

This article is intended for defensive engineering, resilience planning, and strategic cyber-physical doctrine development.

Resilience Benchmark: Analog Electronics vs Digital Systems

OT/ICS, critical infrastructure, and military-grade cyber-physical doctrine

Purpose. This benchmark compares the resilience of analog electronics and digital systems across cyber, cyber-physical, operational, and human-factor dimensions in OT/ICS and critical infrastructures. The objective is not “analog vs digital”, but the doctrine of hybrid sovereign architecture where physics retains veto authority over software.

1) Resilience to cyber attacks (software-centric threats)

Threat category	Analog electronics	Digital systems	Operational takeaway
Malware / ransomware	Inherently immune (no code execution)	Highly exposed (endpoints, servers, firmware)	Analog layers preserve safety and minimal continuity during IT/OT disruption.
Zero-day exploitation	Not applicable	Possible (OS, services, libraries, protocol stacks)	Digital surfaces require continuous patching; analog does not “patch”.
Firmware backdoors / supply-chain implants	Limited relevance	Material risk (controllers, gateways, smart sensors)	Protect safety-critical authority from firmware trust assumptions.
Remote manipulation	Very difficult (typically requires physical access)	Feasible via network access paths	Remove remote override capability over safety constraints.

Benchmark verdict: Analog electronics provide structural cyber resilience because they are outside the software attack domain.

2) Resilience to cyber-physical and hybrid attacks

Hybrid attack vector	Analog electronics	Digital systems	Operational takeaway
False data injection (FDI) / sensor spoofing	Strong when using analog plausibility checks, thresholds, and independent alarms	Depends on algorithms and cross-validation; can be deceived at scale	Validate physical plausibility before digital ingestion.
Signal interference (EMI/EMP) & noise injection	Robust if engineered with filtering, shielding, grounding	May induce unstable states, timing faults, or undefined behavior	Analog front-end hardening is a first-order cyber-physical control.
Timing / synchronization attacks	Low sensitivity (no network clock dependence)	Higher sensitivity (clocks, comms, scheduling, protocol timing)	Keep safety logic independent of network timing assumptions.
Deception operations (HMI lies)	Analog gauges and alarms preserve “physical truth”	HMIs can be spoofed or blinded	Train operators to cross-check with out-of-band measurements.

3) Operational resilience in degraded environments (“digital darkness”)

Degraded condition	Analog electronics	Digital systems	Operational takeaway
Network loss / segmentation	Typically continues functioning locally	May lose supervision, coordination, remote control	Analog supports continuity of essential functions without connectivity.
SCADA/HMI outage	Local indicators remain available	Visibility and coordination degrade sharply	Maintain local instrumentation for safe manual operation.
IT collapse (ransomware, wiper)	Unaffected	Potential paralysis of workflows, diagnostics, planning	Hospitals/utilities must drill “offline” procedures anchored in physical indicators.
Manual operations	Natural fallback mode	Often requires reconfiguration and controlled fallback logic	Design for human-in-the-loop operation under cyber stress.

4) Human-factor resilience (errors, complexity, operational drift)

Human-factor risk	Analog electronics	Digital systems	Operational takeaway
Misconfiguration	Limited (few parameters)	Common (many settings, policies, services)	Complexity increases both error rate and attack surface.
Defective updates	Not applicable	Potentially critical	Safety authority should not rely on patch cycles.
Remote setpoint mistakes	Harder if physical presence is required	Easier (and riskier) at scale	Put safety-critical changes behind physical permissives or dual control.
System understanding	More transparent (physics-driven)	Harder to reason about (emergent behavior)	Maintain “explainable” controls in the safety layer.

5) Where analog is weaker (and why hybrid wins)

Capability dimension	Analog electronics	Digital systems	Design implication
Flexibility & rapid adaptation	Lower	High	Use digital for optimization; keep analog for constraints and veto power.
Scalability & orchestration	Limited	High	Digital excels at fleet/plant coordination and analytics.
AI/advanced analytics	Not applicable	High	AI should inform decisions, not override safety constraints.

Strategic conclusion: Analog electronics are not a substitute for digital systems. They are the sovereign safety authority that constrains and survives digital compromise.

6) Quantified summary (star rating)

Dimension	Analog electronics	Digital systems
Cyber resilience (software attacks)	★★★★★	★★☆☆☆
Hybrid/cyber-physical robustness	★★★★☆	★★★☆☆
Operational continuity under “digital darkness”	★★★★★	★★☆☆☆
Flexibility / reconfigurability	★★☆☆☆	★★★★★
Scalability / orchestration	★★☆☆☆	★★★★★
Explainability & deterministic safety	★★★★☆	★★★☆☆

7) Doctrinal model: Hybrid Sovereign Architecture

(1) Analog Authority Layer  --->  Physical truth + thresholds + hard trips + interlocks (veto power)

          |

          v

(2) Digital Control Layer   --->  PLC/DCS automation, closed-loop control, local optimization

          |

          v

(3) Cyber/Network Layer     --->  SCADA, remote ops, analytics, AI, coordination, SOC monitoring

    

Doctrine rule of thumb: If a failure mode can cause loss of life, catastrophic damage, or strategic outage, then the final permission to proceed must be constrained by non-networked and preferably non-reprogrammable controls.

Disclaimer: This article is for defensive engineering, resilience planning, and training. It does not provide operational guidance for wrongdoing.

OT/ICS Cyber Defense Glossary

Core terminology & acronyms (with concise definitions) for critical infrastructure and cyber-physical defense.

How to use: This table is designed for training briefs, SOP annexes, and staff-college style doctrine notes. Definitions are written to be practical and operational—not academic.

Term / Acronym	Full name	Definition (operational)	Typical context
OT	Operational Technology	Systems that monitor and control physical processes (plants, grids, transport, medical devices), often with real-time constraints.	Critical infrastructure
ICS	Industrial Control Systems	Umbrella term for control systems used in industry (PLCs, DCS, SCADA, RTUs) to automate and supervise physical processes.	Industry / Utilities
SCADA	Supervisory Control and Data Acquisition	Supervisory layer that collects telemetry and allows operator control across distributed industrial assets via HMIs and servers.	Grids / Water
PLC	Programmable Logic Controller	Industrial controller that executes control logic (e.g., ladder logic) to drive actuators based on sensor inputs.	Automation
DCS	Distributed Control System	Control architecture typically used in continuous processes (chemicals, refining) with distributed controllers and centralized supervision.	Process industry
RTU	Remote Terminal Unit	Field device that interfaces with sensors/actuators in remote sites and reports data to SCADA; often rugged and telecom-connected.	Remote sites
HMI	Human-Machine Interface	Operator interface used to visualize process status and issue commands; a frequent target for deception (fake displays / “HMI lies”).	Operations
SIS	Safety Instrumented System	Independent safety layer designed to bring a process to a safe state when dangerous conditions occur (separate from basic control).	High-hazard
ESD	Emergency Shutdown	Safety action or system that stops or isolates a process to prevent catastrophic escalation (trip logic, shutdown valves, cutoffs).	Safety
PRoT	Physical Root of Trust	Non-software authority anchored in physics (e.g., analog thresholds, hardwired trips) that enforces safety constraints even if digital layers are compromised.	Cyber-physical doctrine
RoT	Root of Trust	A trusted foundation that other security controls depend on; can be digital (TPM/secure boot) or physical (PRoT).	Security architecture
TPM	Trusted Platform Module	Hardware module used to protect keys and support measured/secure boot—helpful for integrity, but still within digital trust assumptions.	IT / Embedded
FDI	False Data Injection	Attack technique that injects or alters sensor/telemetry data to mislead operators or automation into unsafe decisions.	Deception
MITM	Man-in-the-Middle	Interception/alteration of communications between devices (e.g., PLC–SCADA), potentially enabling command or telemetry tampering.	Networks
Air Gap	Physical / logical isolation	Separation of OT from untrusted networks; often imperfect in practice due to maintenance links, data diodes, or remote access exceptions.	Segmentation
DMZ	Demilitarized Zone	Network segment that separates IT and OT to control and monitor traffic (jump hosts, historians, proxies) and reduce lateral movement.	Architecture
Jump Server	Bastion / Jump Host	Hardened intermediary used for controlled access into restricted networks (especially OT), with logging and MFA.	Access control
Allowlisting	Application allowlisting	Security control that permits only approved software to run—useful in OT where systems change infrequently.	Endpoint control
Defense-in-Depth	Layered defense	Security strategy using multiple independent layers so that failure of one control does not cause catastrophic compromise.	Doctrine
Safety vs Security	Functional safety vs cybersecurity	Safety prevents accidents and hazardous states; security prevents malicious actions. In OT, both must be designed to reinforce each other.	Governance
EMI	Electromagnetic Interference	Unwanted electromagnetic disturbance that can corrupt signals; mitigated via shielding, grounding, filtering, and robust analog front-ends.	Cyber-physical
EMP	Electromagnetic Pulse	High-energy pulse that can disrupt or damage electronics; resilience includes shielding, redundancy, and fail-safe design.	Strategic resilience
PLC “Logic Bomb”	Malicious embedded logic	Hidden or time-triggered code/configuration inside controllers that causes unsafe actions or disables safeguards at a chosen moment.	Sabotage
Historian	Industrial data historian	System that stores time-series OT data for operations and analytics; compromise can enable deception or hide drift over time.	Monitoring
IEC 62443	Industrial cybersecurity standard	International standard series for securing industrial automation and control systems, including zones/conduits and lifecycle practices.	Standards
NIST SP 800-82	ICS Security Guide	Guidance for securing ICS environments, including architecture, risk management, and recommended controls adapted to OT constraints.	Guidance
LOTO	Lockout/Tagout	Safety procedure to ensure equipment is de-energized and cannot be restarted during maintenance—also mitigates malicious reactivation risk.	Maintenance safety
Fail-Safe	Safe failure mode	Design principle where failures (or uncertainty) drive the system into a safe state (shutdown, isolation, inhibit) rather than continuing blindly.	Safety engineering
Fail-Secure	Secure failure mode	Design principle where failures preserve security properties (e.g., deny access) even if availability is reduced.	Security engineering
Digital Darkness	Degraded digital environment	Condition where networks, SCADA, or IT services are unreliable or unavailable; operations must rely on local controls and physical indicators.	Continuity

OT/ICS Protocol Acronyms & Military Doctrine Terms

Operational definitions aligned to cyber-physical and critical infrastructure defense.

These tables complement the OT/ICS cyber defense glossary and are designed for operational briefings, security architecture reviews, and doctrine annexes.

Table 1 — Industrial Protocol Acronyms

Protocol	Full Name	Operational Definition	Security Consideration
Modbus	Modicon Bus	Legacy industrial communication protocol used between PLCs and field devices; simple and widely deployed.	Typically lacks encryption and authentication; vulnerable to command injection and MITM attacks.
DNP3	Distributed Network Protocol	Protocol used in utilities (power, water) for communication between control centers and field devices.	Secure versions exist (DNP3-SA), but legacy deployments may be exposed to spoofing or replay attacks.
OPC UA	Open Platform Communications Unified Architecture	Modern industrial interoperability protocol supporting structured data exchange and secure communication.	Supports encryption and certificates; misconfiguration can still expose systems.
PROFINET	Process Field Network	Industrial Ethernet protocol for real-time automation communication in manufacturing environments.	Real-time dependency makes segmentation and deterministic network design critical.
EtherNet/IP	Ethernet Industrial Protocol	Industrial protocol based on CIP used for automation and motion control over Ethernet networks.	Requires proper segmentation and access control to prevent unauthorized command injection.
CIP	Common Industrial Protocol	Application-layer protocol supporting industrial automation communication across multiple network types.	Security depends on deployment architecture and authentication mechanisms.
IEC 61850	Substation Automation Standard	Communication standard for intelligent electronic devices (IEDs) in substations.	Critical for grid stability; requires strong network segmentation and monitoring.

Table 2 — Military Doctrine Terms (Aligned to OT/ICS Defense)

Acronym	Full Term	Operational Definition	Relevance to OT/ICS Defense
COA	Course of Action	Proposed operational approach to achieve mission objectives.	Used to evaluate cyber defense response strategies and infrastructure protection plans.
C2	Command and Control	Authority and direction exercised by commanders over assigned forces.	In cyber defense, refers to coordinated oversight of OT, IT, and incident response teams.
ROE	Rules of Engagement	Directives defining circumstances and limitations under which force may be used.	Defines thresholds for cyber countermeasures and defensive actions.
MOP	Measure of Performance	Metric assessing how well tasks are executed.	Used to evaluate implementation of cybersecurity controls in OT systems.
MOE	Measure of Effectiveness	Metric assessing the impact of actions relative to objectives.	Evaluates resilience improvements or reduction in cyber-physical risk.
EEFI	Essential Elements of Friendly Information	Critical information that must be protected from adversary collection.	Includes infrastructure vulnerabilities, network topology, and safety thresholds.
OPSEC	Operations Security	Process of identifying and protecting sensitive operational information.	Prevents exposure of OT architecture details and cyber defense posture.
CONOPS	Concept of Operations	Framework describing how capabilities are employed to achieve mission goals.	Defines integrated cyber-physical defense model for critical infrastructure.
ISR	Intelligence, Surveillance, Reconnaissance	Activities to collect and analyze information about adversaries.	Applied to cyber threat intelligence and infrastructure monitoring.
COOP	Continuity of Operations	Planning to ensure mission continuity under disruption.	Ensures critical OT systems function during cyber incidents (“digital darkness”).

These tables can be expanded into a full doctrinal annex integrating protocol security posture, physical root-of-trust controls, and military command principles for hybrid conflict scenarios.

Main Cybersecurity Stakeholders (Spain, France, Germany, Italy)

Focus: civil cybersecurity authorities & CSIRTs, national security governance, and military cyber defense commands—mapped into EU-level coordination (ENISA / CSIRTs Network / EU-CyCLONe) and NATO cyber structures (NCIA / NATO cyber defence).

Important note on “budgets” and “force size”.

• Some agencies publish clear annual budget + headcount (e.g., BSI; ANSSI activity report). Others publish partial figures (program budgets, funds, or statements by leadership).
• Military cyber force sizes are often not publicly disclosed; where unavailable, this page avoids guessing.

1) EU / NATO Governance Diagram (visual)

The diagram is intentionally “governance-level”: it highlights who coordinates whom, and how EU (ENISA / CSIRTs Network / EU-CyCLONe) and NATO (NCIA) connect to national ecosystems.

2) Who are the “main stakeholders” (by country)

Spain (ES)

• Strategic governance: National Cybersecurity Council (DSN) — support to the National Security Council structure.
• Civil / national capability: INCIBE + INCIBE-CERT (companies, citizens; coordination with other CSIRTs).
• Public sector / classified / strategic entities: CCN-CERT (CNI/CCN), incident response capability for public administration and sensitive systems.
• Military cyber defence: MCCE (Joint Cyber Space Command, EMAD) — plans/directs cyber operations for defense.

France (FR)

• Civil authority: ANSSI (national cybersecurity authority; prevention, response, support to essential entities).
• Strategic coordination: PM-level security coordination ecosystem (incl. SGDSN context).
• Military cyber operations: COMCYBER (MoD).

Germany (DE)

• Civil authority: BSI (federal cybersecurity authority; standards, incident handling support, warnings, KRITIS support).
• Military domain cyber: Bundeswehr CIR (cyber and information domain structures).
• Strategic/ministerial ownership: BMI internal security ecosystem as the civil anchor for many national cyber initiatives.

Italy (IT)

• Civil authority: ACN (Agenzia per la Cybersicurezza Nazionale).
• Strategic implementation: national strategy execution supported by dedicated cybersecurity funds and multi-year resourcing decisions (as documented in parliamentary dossiers).
• Military cyber: defense cyber structures exist under MoD; public details vary and are often limited.

3) EU-level integration points (ENISA) + NATO interconnections

• ENISA permanent mandate: the EU Cybersecurity Act establishes a strengthened ENISA with a permanent mandate and EU cybersecurity certification framework.
• Operational cooperation: ENISA supports the CSIRTs Network (Member States’ CSIRTs + CERT-EU) and provides secretariat/tooling.
• Crisis liaison: EU-CyCLONe is the EU cyber crisis liaison organisation network; ENISA supports information exchange and provides the secretariat.
• NATO link: NATO’s cyber defence focuses on protecting NATO networks and enabling operations; NCIA acts as NATO’s cyber defender and technological hub.

4) Budget & cyber force size (best publicly documented figures)

Country	Civil cybersecurity authority (budget)	Headcount / force size (publicly stated)	Notes (what the figure actually represents)
France	ANSSI: ~€29.6M (2024 budget, excluding payroll)	ANSSI: 656 agents (end of 2024)	Figures are from ANSSI’s 2024 activity report; the budget noted is “excluding payroll”.
Germany	BSI: €230.7M (2025)	BSI: “over 1,700 employees” (public recruiting statement)	Budget figure appears in Bundesrechnungshof material; staff size is stated by BSI in public job postings (“over 1,700”).
Spain	INCIBE: leadership statement indicates annual budget “over €130M” (recently increased vs ~€20M earlier)	INCIBE: “over 300 professionals” (reported for the León site)	These are leadership/media-reported figures; INCIBE also manages major program budgets (e.g., PRTR/NextGen calls) that can be separate from baseline transfers.
Italy	National cybersecurity funding: parliamentary dossier cites a dedicated cybersecurity management fund with €70M/year from 2025 (among other figures) and additional increments for ACN functioning	ACN: staffing growth is governed via regulation; public staffing targets are cited in secondary summaries and legal references	Direct ACN “Budget 2025” documents may be access-restricted in some environments; parliamentary dossier provides fund levels and incremental resourcing lines.

Tip: treat “budget” as apples-to-oranges unless you separate baseline ops vs program funds vs grants. Tip: treat “force size” for military cyber as sensitive; prefer official staffing numbers only.

5) Sources (links)

1. ANSSI activity report (2024): headcount and budget (ex-payroll).
   ANSSI – Rapport d’activité 2024 (PDF)
2. Spain: MCCE mission (EMAD).
   EMAD – Mando Conjunto del Ciberespacio (MCCE)
3. Spain: National Cybersecurity Council (DSN).
   DSN – Consejo Nacional de Ciberseguridad
4. Spain: CCN-CERT mission (CNI/CCN).
   CCN-CERT – Mission and objectives
5. Spain: INCIBE-CERT role (Trusted Introducer / FIRST references).
   INCIBE – INCIBE-CERT press release (Trusted Introducer)
   FIRST – INCIBE-CERT team page
6. Germany: BSI budget reference (Bundesrechnungshof / Einzelplan).
   Bundesrechnungshof – Einzelplan 06 (PDF; includes BSI €230.7M)
7. Germany: BSI staffing (“over 1,700 employees”) – public posting.
   BSI – Job posting (mentions “over 1,700 employees”)
8. EU: ENISA mandate / Cybersecurity Act.
   ENISA – EU Cybersecurity Act context
9. EU: CSIRTs Network and EU-CyCLONe (ENISA).
   ENISA – CSIRTs Network
   ENISA – EU-CyCLONe
10. EU: NIS2 policy page referencing CSIRTs and EU-CyCLONe.
    European Commission – NIS2 Directive
11. NATO: NCIA cyber defence role.
    NCIA – Cyber Defence
    NATO – Cyber defence topic page
12. Italy: Parliamentary dossier on ACN resourcing and cybersecurity funds (budget lines and annual fund levels).
    Senato (IT) – Dossier n. 244 (ACN measures & funding lines)
13. Spain: INCIBE budget growth and staffing (leadership statement reported by radio).
    Cadena SER (Radio León) – INCIBE staffing and budget statement

Spain–France Cyber Crisis Tabletop Exercise (TTX)

Attack on dam-related power networks + river flow control + drinking water/wastewater SCADA — with an “Analog-First” resilience doctrine

Scope & intent (defensive). This document is a planning and training template for national and cross-border crisis management. It describes high-level response actions, decision points, and coordination mechanisms. It does not include operational attack instructions.

1) Scenario Overview

During an extreme weather period (flood risk) and heightened geopolitical tension, anomalies emerge across: (a) dam gate and spillway control, (b) hydropower substation protection and switching, and (c) municipal water treatment (chemical dosing + pumping stations) in a river basin with cross-border implications between Spain and France.

Operators observe contradictions: HMI dashboards show “normal” while field personnel and independent readings report instability. The suspected pattern combines: False Data Injection (FDI) + PLC/DCS logic tampering + remote access abuse + grid switching disruption.

Doctrinal anchor: Assume the HMI can lie. When digital trust is uncertain, authority shifts to the physical root of trust: analog thresholds, protective relays, hardwired interlocks, mechanical limits, and local-only permissives.

2) Analog-First Preventive Model (Why analog matters)

2.1 “Authority hierarchy”

(1) Analog Authority Layer  --->  Physical truth + thresholds + hard trips + interlocks (veto power)
          |
          v
(2) Digital Control Layer   --->  PLC/DCS closed-loop automation, local optimization
          |
          v
(3) Cyber/Network Layer     --->  SCADA, remote ops, analytics, coordination, SOC monitoring
    

2.2 Minimum viable “physical root of trust” (PRoT) controls for dams & water

Asset	Analog / physical controls (PRoT)	Purpose	Non-negotiable rule
Dams / gates / spillways	Mechanical opening limits; keyed local enable switches; hardwired emergency stop (ESD); independent level sensors (non-networked); local analog indicators	Prevent unsafe opening/closing even under digital compromise	Remote commands must never override mechanical/analog constraints
Hydropower substations	Protective relays (overcurrent/frequency); independent trip circuits; manual switching procedures; local relay status verification	Isolate faults and prevent cascading instability	Protection logic must be independent of SCADA visibility
Water treatment (chemicals)	Hard maximum dosing limits; independent pH/ORP sensors; local-only setpoint changes under dual control; physical lockouts	Prevent toxic dosing and ensure rapid detection	No single remote interface may change dosing beyond safe bounds
Pumping stations / wastewater	Local fallback operation; independent level/flow alarms; physical lockout/tagout (LOTO) discipline	Maintain continuity during “digital darkness”	Operators must be trained and drilled to operate without SCADA

3) Detailed Response Timeline Matrix (T0 to T+72h)

Exercise rule: The facilitator may inject “HMI deception” at any time. Teams must demonstrate out-of-band validation.

Time	Observed indicators	Immediate actions (site + operators)	National / strategic actions (Spain–France)	Analog-first decisive points
T0 Detection	SCADA alarms fluctuate; contradictory levels/flows; relay trips sporadic; remote sessions detected	Freeze non-essential changes; switch to “safe mode”; snapshot logs; confirm with local gauges and independent sensors; stop remote maintenance	Notify national CSIRT channels; start cross-border notification mechanism for shared basin operators; activate crisis liaisons	Initiate independent level verification; confirm relay status locally; block remote override paths
T+30m	HMI indicates stability but field reads rising levels; chemical setpoints show unusual drift	Enforce local-only permissions for gates and dosing; enable hard maximums; isolate suspect network segments	Spain: national coordination cell convenes; France: national coordination cell convenes; start joint situation report (SITREP)	Activate hardwired interlocks; confirm mechanical limits; verify water quality via independent instrumentation
T+1h	Attempted gate actuation; substation switching anomalies; remote credential misuse suspected	Physical presence at critical nodes; disable remote control where safe; implement manual switching procedures; start controlled shutdown of non-essential automation	Joint Spain–France “basin operator coordination call” (technical + crisis); law enforcement and intelligence liaison begins	“Analog veto”: hard trips and permissives block unsafe actuation; local analog indicators become primary truth source
T+3h	FDI suspected; operators receive conflicting dashboards across multiple sites	Treat telemetry as untrusted; rely on local measurements; rotate to offline checklists; preserve evidence; maintain safe water supply	Cross-border public communication alignment (avoid panic); decide whether to request EU crisis liaison activation (EU-CyCLONe style)	Out-of-band validation: analog plausibility checks; independent sampling; manual confirmation of gate position
T+6h	Partial loss of supervisory control; attackers attempt to blind operator visibility	“Digital darkness” drill: operate locally, minimize complexity, enforce safety margins; fallback comms (radio/phone)	Spain–France joint coordination: mutual assistance request options (technical teams, spare relays, field engineers)	Keep protection relays autonomous; maintain mechanical/analog constraints as final authority
T+12h	Stabilization begins; forensic indicators suggest compromised engineering workstation	Continue safe-state operations; start controlled restoration plan; verify each digital restoration step with physical checks	Approve restoration COA; align incident classification; coordinate cross-border river-flow management decisions	“No restore without verify”: each setpoint restoration validated by analog readings and independent sampling
T+24h	Containment achieved; some automation remains offline by choice	Gradual re-enable automation; rekey credentials; rebuild golden images; update network segmentation; run integrity checks	Joint after-action conference scheduling; decide joint communiqué; consider EU-level info sharing	Preserve analog safeguards; ensure digital cannot override hard limits post-incident
T+48–72h	Recovery; lessons learned; monitoring for re-entry	Patch/mitigate; improved monitoring; train operators; implement permanent analog veto enhancements	Spain–France joint remediation plan for the basin; shared procurement of critical spare parts; joint exercise roadmap	Institutionalize PRoT: governance rule that safety authority stays non-networked and locally verifiable

4) NATO-Style Tabletop Exercise (TTX) Structure with Defined Roles

4.1 Exercise objectives

• Demonstrate rapid shift from digital trust to physical-root-of-trust operations when deception is suspected.
• Validate cross-border coordination for a shared basin: water flow decisions + public messaging + technical assistance.
• Test decision-making under uncertainty: balancing safety, continuity, and forensic integrity.
• Confirm that “analog veto” controls can prevent catastrophic outcomes even when SCADA/PLC layers are degraded.

4.2 Roles (cells) and responsibilities

Cell / Role	Core responsibilities	Key decisions	Success indicators
Strategic Coordination (Spain) National security coordination cell	National situational awareness, crisis level, inter-ministerial coordination, national communications	Classification level; escalation; mutual aid requests; public warning thresholds	Clear SITREP cadence; coherent national posture; no contradictory messaging
Strategic Coordination (France) National security coordination cell	Mirror function; coordinate with basin entities; align measures and communications	Escalation and prioritization; cross-border operational constraints	Timely decisions; alignment with Spain on shared-basin safety outcomes
Military Cyber Liaison Defense cyber representation	Assess hybrid threat; protect defense-related dependencies; support with specialized capabilities where legally appropriate	Threat attribution thresholds for posture; protection of critical defense-adjacent nodes	Effective support without disrupting civil command chain; precise threat framing
National CSIRT / Gov CERT Liaison	Technical triage; indicators; containment guidance; coordination with sectoral SOC/CSIRTs	Containment vs continuity trade-offs; evidence preservation approach	Actionable guidance; reduced uncertainty; minimal recurrence
Critical Infrastructure Operator Cell Dam + grid + water utility ops	Operate the system safely; enforce analog veto; manage local response and restoration	Switching to manual; isolating OT; restoring automation step-by-step	No unsafe actuation; stable water quality; controlled restoration without regression
Public Information / Crisis Comms	Risk communication, rumor control, coordinated updates, cross-border alignment	When to inform the public; what to disclose; how to advise operators/citizens	Trust preserved; panic avoided; consistent Spain–France narrative
Legal / Regulatory Cell	Ensure lawful authorities, reporting obligations, cross-border information sharing constraints	Data handling; evidence chain; emergency powers and operator directives	Compliance maintained; decisions traceable; minimal legal friction

4.3 TTX flow (facilitator “injects”)

• Inject 1: “SCADA shows stable levels; field reports rising levels.” (Test out-of-band verification)
• Inject 2: “Remote session appears on engineering workstation.” (Test containment + evidence)
• Inject 3: “Chemical dosing setpoint jumps beyond normal.” (Test hard maximums + local-only changes)
• Inject 4: “Grid switching anomalies and protective relay trips.” (Test relay independence + manual switching)
• Inject 5: “Media rumors about dam failure.” (Test comms alignment Spain–France)
• Inject 6: “Second site shows same pattern.” (Test scaling and prioritization)

5) Spain–France Cooperation Adaptation (Shared Basin Playbook)

5.1 Cross-border coordination principles

• Single shared “truth process”: agree on which measurements are authoritative (independent sensors, field verification, sampling).
• Joint operational constraints: gate decisions upstream affect downstream safety; flow changes require coordinated timing.
• Mutual assistance: pre-arranged rapid deployment of field engineers, relay specialists, and portable instrumentation.
• Aligned public communications: avoid contradictory messages that amplify panic and undermine trust.
• Shared restoration rules: no return to remote operation until analog veto paths are verified and local control is demonstrated.

5.2 Cross-border “SITREP” template (one-page)

SITREP #__  |  Basin: ______  |  Timestamp (UTC): ______
1) Safety status:  (Dams) ___  (Grid) ___  (Water quality) ___  (Wastewater) ___
2) Authoritative measurements (out-of-band): _________________________________
3) Suspected attack pattern (high level): ____________________________________
4) Actions in place:
   - Analog veto enabled?  YES/NO  |  Local-only permissions? YES/NO
   - Remote access disabled? YES/NO |  OT segmentation status: ____________
5) Cross-border impacts (downstream/upstream): _______________________________
6) Immediate decisions needed (next 2 hours): ________________________________
7) Public comms alignment: message line(s) ___________________________________
8) Requests for assistance (teams/equipment): _________________________________
    

6) Evaluation Criteria (MOP / MOE)

Metric type	Definition	Example indicators
MOP (Measure of Performance)	How well tasks were executed	Time to isolate OT segment; time to disable remote access; evidence capture completed; SITREP cadence maintained
MOE (Measure of Effectiveness)	Whether objectives were achieved	No unsafe gate movement; no toxic dosing; grid stability preserved; public trust maintained; cross-border flow safety preserved

Key learning objective: The exercise is “won” when teams prove that even if digital systems are compromised, the analog-first safeguards (relays, interlocks, hard limits, local-only permissives, independent sensors) prevent catastrophic outcomes.

Disclaimer: Training and defensive planning material only. Adapt to your legal framework, sector regulations, and operator SOPs.

Disclaimer

Author: Ryan KHOUJA.

Copyright notice: No partial or full reproduction, distribution, translation, or reuse of this content is permitted without the author’s prior written consent.

Conceptual scope: This text is provided strictly as a conceptual and high-level framework. It does not constitute professional advice, operational guidance, or instructions of any kind.

Limitations & integrity statement: The writing may intentionally contain errors, ambiguities, spurious biases, and factual inaccuracies to reduce the risk of misuse by third parties. Any use, interpretation, or implementation is at the reader’s sole responsibility.