ICS/SCADA Security
Security for Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems. Covers OT vs IT differences, industrial protocols, safety system security, and defense-in-depth for critical infrastructure.
Understanding ICS/SCADA Security
Industrial Control Systems (ICS) and SCADA systems manage critical infrastructure—power grids, water treatment, manufacturing, oil refineries. These operational technology (OT) environments have fundamentally different security priorities than traditional IT.
ICS/SCADA components: • SCADA — Supervisory Control and Data Acquisition • HMI — Human-Machine Interface • PLC — Programmable Logic Controller • RTU — Remote Terminal Unit • DCS — Distributed Control System
Stuxnet (2010) destroyed Iranian nuclear centrifuges by targeting PLCs—the first known cyberweapon. Triton/TRISIS (2017) targeted safety systems at a petrochemical plant, designed to cause physical harm. These attacks proved ICS threats are real and potentially catastrophic.
ICS security requires understanding operational priorities and constraints that differ from IT security.
Why This Matters for the Exam
ICS/SCADA security is heavily tested on SY0-701 because critical infrastructure protection is a national security priority. Questions cover OT vs IT differences, industrial protocols, and defense strategies.
Understanding ICS security helps with critical infrastructure protection, OT/IT convergence, and incident response in industrial environments. Attacks on ICS can cause physical harm.
The exam tests awareness of OT-specific constraints and appropriate security approaches.
Deep Dive
What Are the Main Components of ICS/SCADA Systems?
Component Breakdown:
| Component | Function |
|---|---|
| SCADA | Centralized monitoring and control |
| HMI | Operator interface (screens, controls) |
| PLC | Automates industrial processes |
| RTU | Remote data collection/control |
| DCS | Distributed process control |
| Sensors | Measure process variables |
| Actuators | Control physical processes |
ICS Architecture:
How Do OT and IT Security Priorities Differ?
Priority Comparison:
| Priority | IT (CIA) | OT (AIC) |
|---|---|---|
| First | Confidentiality | Availability |
| Second | Integrity | Integrity |
| Third | Availability | Confidentiality |
Why Availability First in OT:
- •Downtime can cause physical damage
- •Process interruption may be dangerous
- •Equipment damage from improper shutdown
- •Environmental/safety hazards
- •Human safety at risk
OT vs IT Characteristics:
| Aspect | IT | OT |
|---|---|---|
| Lifecycle | 3-5 years | 15-25 years |
| Updates | Regular, automated | Infrequent, planned |
| Environment | Office/data center | Factory/field |
| Protocols | TCP/IP standard | Industrial protocols |
| Failure impact | Business disruption | Physical harm possible |
What Are the Security Risks of Industrial Protocols?
Protocol Security Comparison:
| Protocol | Security Level | Notes |
|---|---|---|
| Modbus | None | No authentication, no encryption |
| DNP3 | Optional (Secure Authentication) | Security extension available |
| OPC UA | Strong | Built-in security |
| BACnet | Optional | Security options available |
| Profinet | Optional | Security extensions |
Modbus Vulnerabilities:
Modbus (designed 1979): - No authentication (anyone can send commands) - No encryption (commands in plaintext) - No integrity checking - Designed for isolated networks
Protocol Protection Strategies:
- •Encrypt at network layer (VPN tunnels)
- •Industrial firewalls with protocol awareness
- •Protocol-aware IDS/IPS
- •Network segmentation
- •Application whitelisting
What Is the Purdue Model for ICS Security?
Purdue Enterprise Reference Architecture:
| Level | Name | Components |
|---|---|---|
| Level 5 | Enterprise | Business systems, internet |
| Level 4 | Business | Email, file servers |
| Level 3.5 | DMZ | Historian, patch servers |
| Level 3 | Operations | SCADA, engineering |
| Level 2 | Control | HMI, engineering workstations |
| Level 1 | Basic Control | PLC, RTU, DCS |
| Level 0 | Physical | Sensors, actuators, process |
Purdue Model Security:
What Security Controls Work for ICS/SCADA?
Defense-in-Depth for ICS:
| Layer | Controls |
|---|---|
| Network | Segmentation, industrial firewalls |
| Communication | Encryption, protocol filtering |
| Endpoint | Whitelisting, hardening |
| Monitoring | OT-aware SIEM, anomaly detection |
| Access | Strong authentication, least privilege |
| Physical | Perimeter security, access control |
Data Diodes:
- •One-way data transfer (OT → IT only)
- •Physically impossible to send data back
- •Used for safely exporting monitoring data
- •Protects OT from IT network attacks
How Do Safety and Security Interact in ICS?
Safety Systems (SIS):
- •Designed to prevent harm
- •Must function when needed
- •Take precedence over security
- •Examples: Emergency shutdown systems
Safety vs Security Conflicts:
| Situation | Safety Need | Security Impact |
|---|---|---|
| Emergency access | Immediate access required | May bypass authentication |
| System shutdown | Fail-safe state | May leave in vulnerable state |
| Testing | Regular functional tests | May expose attack surface |
| Updates | Minimal changes | Patching may be delayed |
Key Principle:
- •Security controls must not compromise safety. Fail-safe vs fail-secure decisions must favor safety.
How CompTIA Tests This
Example Analysis
Scenario: A water treatment facility connects their SCADA network to the corporate network for remote monitoring. Six months later, ransomware spreads from a phishing email to the SCADA system, taking the HMI offline. Operators can't see or control water treatment processes.
Analysis - ICS/IT Convergence Failure:
Attack Path:
- 1.Phishing email compromises IT workstation
- 2.Ransomware spreads through corporate network
- 3.No segmentation between IT and OT
- 4.SCADA/HMI systems infected
- 5.Operators lose visibility and control
Violations of ICS Security Principles:
| Principle | Violation |
|---|---|
| Availability first | System unavailable |
| Network segmentation | IT/OT connected directly |
| Purdue Model | No DMZ between levels |
| Defense in depth | Single point of failure |
Proper Architecture:
[Corporate IT]
|
[Industrial Firewall]
|
[Industrial DMZ] ─── Historian (read-only)
|
[Industrial Firewall]
|
[SCADA Network]
|
[PLCs/RTUs]Recommended Controls:
1. Network Segmentation: - Air gap or industrial DMZ - Data diodes for one-way flow - Industrial firewalls
2. Access Control: - Separate credentials for OT - No direct IT-to-OT access - Jump servers with MFA
3. Monitoring: - OT-specific IDS - Protocol-aware monitoring - Anomaly detection
4. Incident Response: - OT-specific IR plan - Manual operation procedures - Backup HMI capabilities
Key insight: IT/OT convergence requires careful architecture. Direct connections without proper segmentation turn IT compromises into OT disasters.
Key Terms
Common Mistakes
Exam Tips
Memory Trick
OT vs IT Priority Memory:
IT = Corporate Information Assets → CIA (Confidentiality first) OT = Always Industrial Control → AIC (Availability first)
"In a factory, if machines stop, people might get hurt. Data leaking is bad, but explosion is worse."
Modbus Memory: "Modbus is Modern... if you're in 1979" Zero security: No auth, no encryption, no integrity
Purdue Model Levels: "0-1-2 on the floor (physical, PLCs, HMIs) 3 operations door 3.5 DMZ for the store 4-5 enterprise, nothing more"
Data Diode: "Data flows ONE way, like a video camera—you can watch but can't talk back" OT → IT = OK (monitoring) IT → OT = Physically blocked
ICS Malware: "Stuxnet stux centrifuges (PLCs)" "Triton targeted tripping safety systems"
Test Your Knowledge
Q1.What is the PRIMARY security priority difference between IT and OT environments?
Q2.Which industrial protocol has NO built-in security features?
Q3.What security device allows monitoring data to flow from OT to IT while preventing any data from flowing back?
Want more practice with instant AI feedback?
Continue Learning
Ready for the Exam?
See exactly where you stand on this concept and 182 others.
99% pass rate · Pass guarantee