Technotron
Elite member
Elite member
Leave a like and a rep+
Hidden Content
The systems running power grids, water treatment plants, oil pipelines, and factory floors run on protocols designed in an era when nobody imagined they'd ever be reachable from the internet. Modbus, DNP3, S7comm, EtherNet/IP, these are the languages of industrial control systems, and they have no authentication in most deployments, no encryption, and no concept of a malicious actor on the network. Understanding this world is one of the most valuable and least crowded areas in all of security.
Modbus is the oldest and simplest, a protocol from 1979 for PLCs, programmable logic controllers, to talk to each other. It's a simple read and write of registers, and there's no authentication whatsoever. Any device that can reach a Modbus TCP port, which is port 502, can read any register or write any register. There are thousands of Modbus devices exposed to the public internet right now, findable on Shodan in seconds, and writing a register on a PLC is functionally sending a command to physical machinery.
S7comm is the Siemens protocol for their S7 series PLCs, which run a huge portion of the world's manufacturing and critical infrastructure. It got famous because Stuxnet used it, but the protocol itself is the bigger story, because the authentication model was effectively nonexistent in legacy deployments, and even modernized deployments use shared passwords and cleartext in many cases.
The way an industrial network is actually structured is a hierarchy of zones. The enterprise IT network at the top, then a DMZ, then the supervisory layer with SCADA servers and historians, then the control network with PLCs and RTUs, then the physical sensors and actuators at the bottom. The security model historically relied on the assumption that the control network was unreachable, which was true when it was designed and is not true now. The IT OT convergence, operational technology meeting information technology, is the term for what's happened over the last two decades, and it broke the assumption permanently.
The threat model here is different from corporate networks in every way that matters. Availability beats confidentiality. A power plant can tolerate someone reading data for a while, it cannot tolerate someone writing to the wrong register. Patching is rare, systems run for decades, and a PLC running firmware from 2005 in a water plant is completely normal. Rebooting a control system has physical consequences, so the standard patch and restart cycle of IT doesn't apply. And safety systems, the things designed to prevent explosions and overdoses and physical damage, are often separate systems with their own logic, and understanding where safety ends and control begins is the critical question in any ICS security assessment.
The documented attacks tell the story of capability progression. Stuxnet in 2010 was the first to cause physical destruction, sabotaging centrifuges by subtly speeding them up and down while showing operators normal readings on their displays, a man in the middle attack against the sensors themselves. Industroyer in 2016, also called Crash Override, actually shut down part of the Kyiv power grid using native ICS protocols, meaning the malware spoke Modbus and IEC 104 fluently enough to operate breakers directly. TRITON in 2017 targeted the safety instrumented systems themselves, which is the escalation that keeps ICS security people up at night, because it means the attacker was preparing to disable the safety layer before doing something destructive.
The defense approach is architectural, not tooling. Network segmentation with real air gaps or data diodes between IT and OT. Asset inventory, because most organizations cannot list what PLCs they have and what firmware they run, which is the starting point for everything. Passive monitoring, since active scanning of control networks can crash fragile devices, and tools like the open source Grassmarlin or the commercial passive taps exist for this. And the growing field of ICS honeypots, which are devices pretending to be water pumps or power breakers to detect and study attackers, Conpot is the open source standard.
The people who work in this field are few, the demand is enormous, and the consequences of failure are measured in physical damage and human safety rather than data loss. If you're looking for the security specialty with the highest ratio of real world importance to number of qualified practitioners, this is it, and the entry path is understanding Modbus and setting up a virtual PLC lab with OpenPLC on a Raspberry Pi, which costs almost nothing and teaches you more than any certification course.
@Techn0tron
Hidden Content
The systems running power grids, water treatment plants, oil pipelines, and factory floors run on protocols designed in an era when nobody imagined they'd ever be reachable from the internet. Modbus, DNP3, S7comm, EtherNet/IP, these are the languages of industrial control systems, and they have no authentication in most deployments, no encryption, and no concept of a malicious actor on the network. Understanding this world is one of the most valuable and least crowded areas in all of security.
Modbus is the oldest and simplest, a protocol from 1979 for PLCs, programmable logic controllers, to talk to each other. It's a simple read and write of registers, and there's no authentication whatsoever. Any device that can reach a Modbus TCP port, which is port 502, can read any register or write any register. There are thousands of Modbus devices exposed to the public internet right now, findable on Shodan in seconds, and writing a register on a PLC is functionally sending a command to physical machinery.
S7comm is the Siemens protocol for their S7 series PLCs, which run a huge portion of the world's manufacturing and critical infrastructure. It got famous because Stuxnet used it, but the protocol itself is the bigger story, because the authentication model was effectively nonexistent in legacy deployments, and even modernized deployments use shared passwords and cleartext in many cases.
The way an industrial network is actually structured is a hierarchy of zones. The enterprise IT network at the top, then a DMZ, then the supervisory layer with SCADA servers and historians, then the control network with PLCs and RTUs, then the physical sensors and actuators at the bottom. The security model historically relied on the assumption that the control network was unreachable, which was true when it was designed and is not true now. The IT OT convergence, operational technology meeting information technology, is the term for what's happened over the last two decades, and it broke the assumption permanently.
The threat model here is different from corporate networks in every way that matters. Availability beats confidentiality. A power plant can tolerate someone reading data for a while, it cannot tolerate someone writing to the wrong register. Patching is rare, systems run for decades, and a PLC running firmware from 2005 in a water plant is completely normal. Rebooting a control system has physical consequences, so the standard patch and restart cycle of IT doesn't apply. And safety systems, the things designed to prevent explosions and overdoses and physical damage, are often separate systems with their own logic, and understanding where safety ends and control begins is the critical question in any ICS security assessment.
The documented attacks tell the story of capability progression. Stuxnet in 2010 was the first to cause physical destruction, sabotaging centrifuges by subtly speeding them up and down while showing operators normal readings on their displays, a man in the middle attack against the sensors themselves. Industroyer in 2016, also called Crash Override, actually shut down part of the Kyiv power grid using native ICS protocols, meaning the malware spoke Modbus and IEC 104 fluently enough to operate breakers directly. TRITON in 2017 targeted the safety instrumented systems themselves, which is the escalation that keeps ICS security people up at night, because it means the attacker was preparing to disable the safety layer before doing something destructive.
The defense approach is architectural, not tooling. Network segmentation with real air gaps or data diodes between IT and OT. Asset inventory, because most organizations cannot list what PLCs they have and what firmware they run, which is the starting point for everything. Passive monitoring, since active scanning of control networks can crash fragile devices, and tools like the open source Grassmarlin or the commercial passive taps exist for this. And the growing field of ICS honeypots, which are devices pretending to be water pumps or power breakers to detect and study attackers, Conpot is the open source standard.
The people who work in this field are few, the demand is enormous, and the consequences of failure are measured in physical damage and human safety rather than data loss. If you're looking for the security specialty with the highest ratio of real world importance to number of qualified practitioners, this is it, and the entry path is understanding Modbus and setting up a virtual PLC lab with OpenPLC on a Raspberry Pi, which costs almost nothing and teaches you more than any certification course.
@Techn0tron
Attachments
Technotron's signature
