Introduction to ICS/OT Security

This blog introduces the fundamentals of ICS/OT security, including key industrial cybersecurity terminology, the differences between IT and OT environments. We’ll also explore core concepts and common components used in industrial systems.

$ ./greet.sh
Hey folks!! Param this side, your technical blog partner. 
I will be starting a blog series on ICS/OT security. 
If you are reading this then most probably you and I are on the same path and believe me I am too new to this domain and will be navigating my and your path through this. 
So my blog series will be covering notes, difficulties I faced, labs that I will do and much much more, I will keep this blog series raw as much as possible. 
Besides this blog series I will posting some blogs here and there, so do check them out. 

$ whoami 
I am Param, named after a supercomputer but not one!!, trying to learn and get better in this field everyday. 
I always say that if Morpheus appeared in my life and gave me an option to choose between blue pill and red pill, I would always choose blue pill, as I like to dwell into my illusion of protecting people in a SOC environment, ~ you saw what I did there ;) .

1. Basic Terminology

1.1 What is OT?

• Operational Technology (OT) is an umbrella term that refers to the hardware, software, and technology systems used to monitor, control, and manage physical devices, processes, and infrastructure in industrial and operational environments.
• Therefore, OT is actually a broad category that includes ICS as one of its major components, along with other technologies such as Industrial Internet of Things (IIoT) devices, smart sensors, robotics, asset management systems, predictive maintenance platforms, digital twins, and edge computing solutions.
• OT prioritizes availability, then integrity and then confidentiality; so CIA triad in reverse, more of a AIC triad.

1.2 What is ICS?

• Industrial Control System (ICS) is an umbrella term that is used to refer to the integrated hardware, software, and network system that are responsible for monitoring, automating and controlling physical industrial processes.
• Therefore, ICS is actually aggregate of a variety of a system types including process control systems (PCS), distributed control systems (DCS), supervisory control and data acquisition (SCADA) systems, safety instrumented systems (SIS), and many others.

Summary,
Everything that deals with the physical/operational world is OT and the control brains inside the OT world that actually make decisions to open/close valves, stop motors, adjust temperature comes under ICS.

Note -
All ICS is OT, but not All OT is ICS.

Fig 1.1: ICS cybersecurity architecture showing how IT and OT converge in modern industrial environments.

We have looked into how ICS and OT are different from each other, now let's cover how IT and OT are different from each other.

1.3 Difference between IT & OT

Feature	Information Technology (IT)	Operational Technology (OT)
Primary Focus	Data management and processing.	Physical process control and safety.
Core Priority (Triad)	Confidentiality, Integrity, Availability.	Availability, Integrity, Confidentiality.
System Lifespan	Short (3–5 years for hardware/OS).	Long (15–30 years of continuous operation).
System Updates	Frequent, automated, often forced.	Rare; requires scheduled, manual downtime.
Performance Needs	Flexible (jitter/latency is manageable).	Deterministic (real-time, microsecond precision).
Connectivity	Standard (Internet-exposed, cloud-ready).	Historically isolated; now increasingly networked.
Typical Hardware	Servers, PCs, Cloud, Mobile, Networking.	PLCs, RTUs, Sensors, Actuators, HMIs.
Failure Consequence	Loss of data, financial/reputational damage.	Physical damage, environmental harm, loss of life.

Fig 1.2: IT vs OT comparison showing the characteristics and focus areas of Information Technology versus Operational Technology.

1.4 What is an asset in ICS?

• An asset is a component that is used within an industrial control system.
• They can be classified broadly in two types, i.e., Physical and Logical
  • Physical Assets are tangible hardware devices used in industrial environments; often includes assets like workstation, server, n/w switch, PLC, sensors, actuators, or broadly anything that uses a micro-controller or a microprocessor.
  • Logical Assets are those assets that reside on the physical asset; such as process graphic, database, logic program, firewall rule, firmware, etc.

Summary,
Hardware = Physical Asset and
Software/Data/Config = Logical Asset

1.5 Types of Control System Architectures

We will look into two primary ones for now -

1.5.1 Supervisory Control and Data Acquisition (SCADA)

• SCADA is a centralized system that supervises and collects data from many remote field devices spread over a large geographic area.
• Provides analytics to opertors .
• Operators can send control commands back to the field.

But why we need SCADA in the first place?
Before SCADA, industries with spread-out assets (like power lines or pipelines) relied on manual monitoring. People had to physically travel to remote sites to read gauges and operate equipment. This was slow, expensive, dangerous, and inefficient.
SCADA was developed to enable remote monitoring and supervisory control from a central location, reducing the need for on-site personnel.

1.5.2 Distributed Control Systems (DCS)

• DCS is a highly integrated, real time control system where multiple controllers are distributed throughout a single plant.
• The controllers communicate with each other and operator continuously.
• DCS excel at closed loop control - systems whose action depends on the measured output through a feedback path.

But why we need DCS in first place?
Large process plants (refineries, chemical plants) had thousands of control loops. Traditional centralized control using a centralized system was risky as if the central computer failed, the whole plant could shut down dangerously.
DCS was created to distribute control across many processors so that failure in one area doesn’t stop the entire plant. It also made complex, continuous automation easier and safer.

1.5.3 Difference between SCADA and DCS

Aspect	SCADA (Supervisory Control and Data Acquisition)	DCS (Distributed Control System)
Primary Purpose	Monitoring and supervisory control of geographically distributed systems	Precise, continuous, real-time process control within a plant
Geographic Scope	Wide-area operations spanning hundreds of kilometers	Single facility, plant, or industrial site
Control Speed	Relatively slower response (seconds to minutes)	Extremely fast response (milliseconds)
Control Style	Mostly supervisory or open-loop control	Closed-loop automatic process control
Number of I/O Points	Thousands of distributed I/O points	Tens of thousands of highly dense I/O points
Redundancy Level	Moderate to high redundancy for reliability	Very high redundancy for safety and uninterrupted operation
Typical Industries	Utilities, power transmission, water distribution, pipelines, railways, oil & gas transmission	Refineries, chemical plants, power generation, pharmaceuticals, pulp & paper industries
Typical Devices Used	RTUs, PLCs, master stations, communication networks, HMI systems	Distributed controllers, I/O modules, engineering stations, redundant servers
Communication Focus	Long-distance communication over WAN, radio, fiber, or satellite	High-speed local communication within plant networks
Risk if System Fails	Loss of monitoring visibility and delayed operator response	Potential plant shutdown, production loss, or major safety incidents
Scalability	Highly scalable across remote locations	Scalable mainly within a single industrial process facility
System Architecture	Centralized supervisory architecture with remote field devices	Distributed intelligence across multiple controllers
Data Handling	Event-driven data collection and monitoring	Continuous real-time process data handling
Cost	Generally lower implementation and maintenance cost	Higher cost due to redundancy, integration, and precision control

In today's world, lines between DCS and SCADA have almost blurred, nowadays we take a hybrid systems approach;
A large facility has DCS for precise control inside the plant while SCADA system sits on top to monitor the entire facility or multiple facilities from a central control room.

Fig 1.3: SCADA supervises remote field equipment, while DCS keeps control locally inside the plant for fast real-time action.

1.6 Field Components/System Assets

Field components are the physical devices and systems deployed in industrial environments that directly interface with processes, equipment, and infrastructure to enable monitoring, control, and automation. These form the backbone of any ICS architecture.

1.6.1 Programmable Logic Controller (PLC)

• PLCs are specialized industrial grade computers designed to perform repetitive control tasks in harsh environments with high reliability.
• Unlike desktop computers, PLCs are physically hardened making them suitable for production environment.
• Instead of using a commercial OS, PLCs rely on specific application programs that allow the PLC to function automatically generating output actions (e.g. to pump motors) in response to specific inputs (e.g. from sensors) with as little overhead as possible.
• PLCs were originally designed to replace electromechanical relays.
• Very simple PLCs may be referred to as programmable logic relays (PLRs).
• They execute logic programs written in languages like Ladder Logic, Sequential Function Charts, Structured Text, or Function Block Diagrams.
• Common IEC 61131-3 PLC programming languages include:
  • Ladder Diagram (LD): Visual rung-based logic that looks like electrical ladder wiring.
  • Function Block Diagram (FBD): Blocks with inputs and outputs wired together for modular control.
  • Structured Text (ST): High-level text code similar to Pascal for math and advanced logic.
  • Sequential Function Chart (SFC): Step-based charts used for batch and sequential operations.
• PLCs are ideal for discrete control applications (manufacturing, assembly lines) with deterministic, repetitive operations.
• Typical lifespan: 15-30+ years; require scheduled maintenance but can run continuously.
• Examples: Siemens S7 series, Allen-Bradley CompactLogix, BECKHOFF CX series.

Fig 1.5: PLC hardware and I/O modules, showing the physical control device used in many industrial systems.

1.6.2 Remote Terminal Unit (RTU)

• RTUs are ruggedized, autonomous control devices deployed at remote field sites to collect sensor data, execute pre-programmed logic, and communicate with master SCADA systems.
• They are optimized for wide-area communication and can function independently if the master station fails.
• Often used in power distribution, water systems, oil/gas pipelines, and utilities where sites are geographically spread out.
• Examples: Schweitzer Engineering RTUs, GE Automation RTUs, Woodward RTUs.

Fig 1.6: Remote Terminal Unit (RTU) hardware showing the modular architecture used in remote field deployments for autonomous data collection and control.

1.6.3 Intelligent Electronic Device (IED)

• IEDs are smart field devices that combine sensing, processing, and communication capabilities to perform localized control and protection functions.
• Common in power systems: protective relays, meters, circuit breakers, and reclosers that can make local decisions and communicate status.
• More autonomous than basic sensors; capable of executing protection logic without central coordination.
• Examples: Merlin Gerin Micom, ABB REL670, Schneider Electric Sepam relays.

Fig 1.7: Intelligent Electronic Device (IED) showing protective relay with sensing and communication capabilities for localized control in power systems.

1.6.4 Human Machine Interface (HMI)

• HMIs are the graphical and operational interfaces through which human operators monitor system status, visualize real-time process data, and issue control commands.
• Typically run on industrial PCs, tablets, or touch-screen panels.
• Display: process flows, equipment status, alarms, historical trends, operator dashboards.
• Modern HMIs integrate with SCADA/DCS systems to provide real-time visualization across multiple facilities.
• Examples: Wonderware, GE DigitalWorks, Siemens WinCC, Ignition SCADA.

Fig 1.8: Human Machine Interface (HMI) displaying real-time process visualization, status indicators, and operator control dashboard.

1.6.5 Supervisory Workstations

• Supervisory Workstations are engineering or operator workstations running software for system configuration, monitoring, diagnostics, and remote troubleshooting.
• Used by system engineers to program PLCs, configure RTUs, analyze historical data, and update firmware.
• Higher privilege levels than standard operator consoles; critical for maintaining system integrity.
• Often air-gapped or restricted to internal networks for security.
• Examples: Engineering Workstations (Siemens TIA Portal), DCS Configuration Stations.

1.6.6 Data Historian

• Data Historians are specialized database systems that continuously record, archive, and provide access to time-series operational data collected from field devices.
• Enable trend analysis, root cause analysis, compliance reporting, and predictive maintenance.
• Store massive volumes of sensor readings, alarms, events, and operator actions over years.
• Critical for process optimization and regulatory compliance (e.g., FDA, EPA requirements).
• Examples: OSIsoft PI, Wonderware Historian, Influx DB, Aspen InfoPlus.21.

1.6.7 Other Assets

• Engineering Workstations: Systems used to develop, compile, and test control logic before deployment.
• Network Infrastructure: Industrial switches, routers, firewalls, gateways designed for reliability and determinism.
• Sensors & Actuators: Analog and digital devices (pressure transmitters, temperature probes, solenoid valves, motors).
• Safety Modules: Redundant computing units dedicated to safety-critical functions.
• Wireless Devices: Industrial IoT sensors, mobile RTUs, wireless mesh networks in modern OT environments.

1.7 System Operations

System operations describe how ICS components interact, execute control logic, respond to process changes, and maintain operational continuity.

1.7.1 Control Loops

• A control loop is a sequence of operations where a system continuously measures a process variable, compares it to a desired setpoint, and adjusts an output to minimize the difference.
• Open-Loop Control: System executes a pre-programmed sequence without feedback; no automatic correction if conditions change. (Example: A timer-based pump that runs for exactly 30 minutes regardless of actual water level.)
• Closed-Loop Control: System continuously monitors output, compares to setpoint, and adjusts to maintain desired state. (Example: Temperature control where a thermostat measures temperature and adjusts heater output to maintain setpoint.)
• Closed-loop is more precise but more complex; open-loop is simpler but less adaptive.

Feedback Loop Process State

Fig 1.4: Closed-loop control structure showing measurement, decision, actuation, and feedback.

1.7.2 Control Processes

• Continuous Process Control: Maintains a process variable at a constant target value over time (e.g., maintaining reactor temperature at 150°C).

  • Uses analog signals and proportional/integral/derivative (PID) algorithms.
  • Common in refineries, chemical plants, power plants.

• Discrete/Batch Process Control: Executes a series of sequential operations to produce a product or complete a task (e.g., pharmaceutical batch processing, filling bottles, assembly steps).

  • Uses digital signals and state machines.
  • Common in manufacturing, packaging, food production.

• Hybrid Control: Combines continuous and discrete elements (e.g., a chemical plant that continuously controls temperature while performing discrete batch transitions).

1.7.3 Feedback Loops & Feedback Systems

• Negative Feedback: Output of a system is fed back and compared against input; deviations trigger corrective actions to restore equilibrium.

  • Most common in industrial control; provides stability.
  • Example: If pressure rises above setpoint, feedback triggers valve closure to reduce pressure.

• Positive Feedback: Output reinforces the input, causing the system to diverge further from equilibrium.

  • Rarely intentional in ICS; typically indicates a malfunction.
  • Example: A failing temperature sensor that causes heater to keep increasing temperature.

1.7.4 Production Information Management (PIM)

• PIM Systems are higher-level software systems that manage production scheduling, resource allocation, quality control, and coordination across multiple OT systems.
• Sit above SCADA/DCS layer; interface with enterprise planning systems.
• Track production metrics: throughput, downtime, yield, energy consumption, material usage.
• Enable traceability and compliance documentation (batch serialization, audit trails).
• Examples: MES (Manufacturing Execution Systems), Production Planning Software.

1.7.5 Business Information Management (BIM) & Integration

• BIM Systems are enterprise-level software (ERP, analytics, business intelligence) that consume aggregated OT data for business decision-making, financial reporting, and strategic planning.
• Connected to PIM and MES systems via data feeds and APIs.
• Enable KPI monitoring, cost analysis, ROI calculation, supply chain optimization.
• Bridge between operational technology and information technology domains.
• Examples: SAP, Oracle ERP, Microsoft Dynamics, Tableau/Power BI analytics.

1.8 Process Management

Process Management in ICS refers to the systematic approach to designing, monitoring, optimizing, and maintaining industrial processes to ensure safety, efficiency, quality, and compliance.

Key Components:

• Process Design & Documentation: Engineering specifications, process flow diagrams (PFDs), piping & instrumentation diagrams (P&IDs) that define how a process should operate.

• Standard Operating Procedures (SOPs): Written procedures that operators must follow during normal operations, startups, shutdowns, and emergency situations.

• Performance Monitoring: Continuous tracking of KPIs such as throughput, energy efficiency, product quality, asset utilization, and safety metrics.

• Preventive & Predictive Maintenance: Scheduled maintenance based on equipment age/hours (preventive) or equipment condition data/anomalies (predictive) to minimize unexpected failures.

• Change Management: Formal processes to evaluate, approve, test, and implement changes to process logic, equipment, or procedures to minimize risk of unintended consequences.

• Regulatory Compliance & Auditing: Ensuring operations meet industry standards (IEC 61508, IEC 61511, NIST, NERC-CIP, EPA, FDA) and conducting regular audits and inspections.

Why Process Management Matters:
Industrial processes involve significant capital investment, safety risks, and regulatory obligations. Uncontrolled or poorly managed processes lead to equipment failures, safety incidents, environmental violations, production losses, and financial penalties. Structured process management minimizes these risks while optimizing output.

1.9 Safety Instrumented Systems (SIS)

Safety Instrumented Systems are specialized, independent control systems designed to automatically detect hazardous conditions and execute fail-safe actions to prevent accidents, equipment damage, or environmental harm.

Key Characteristics:

• Independence: SIS operates independently from the main control system; if main DCS/SCADA fails, SIS continues to protect.
• Deterministic Response: SIS must respond to detected hazards within a specified time; performance cannot degrade.
• Redundancy: Critical SIS functions use redundant sensors, logic solvers, and actuators to eliminate single points of failure.
• Fail-Safe Logic: In case of system failure, SIS defaults to the safe state (e.g., close emergency shutdown valve, stop pump, raise alarm).
• Validation & Certification: SIS is designed, tested, and certified to safety integrity level (SIL) standards (SIL 1-4, where SIL 4 is highest safety criticality).

Common SIS Applications:

• Emergency shutdown (ESD) systems in oil/gas processing.
• Pressure relief systems (Pressure Safety Valves - PSVs).
• Temperature or flow alarms triggering automatic shutdowns.
• Fire detection and suppression systems.
• Personnel safety systems (interlocks preventing operator access to hazardous zones).

Fig 1.11: Safety Instrumented System showing independent logic solver and shutdown mechanisms for fail-safe protection of critical processes.

Why SIS is Critical:
Main control systems can fail or be compromised. SIS exists as a final, independent layer of protection to prevent catastrophic events—explosions, toxic releases, loss of life. It's not optional; it's mandated by safety standards in high-risk industries.

1.10 Smart Grid

Smart Grid is a modernized, digitally integrated electrical grid that uses advanced sensors, communication networks, and automation to optimize the generation, distribution, and consumption of electricity in real-time.

Components:

• Advanced Metering Infrastructure (AMI): Smart meters that record energy consumption at granular intervals (e.g., every 15 minutes) and communicate wirelessly to utilities.
• Phasor Measurement Units (PMUs): High-speed sensors that capture grid voltage, current, and frequency 30+ times per second for real-time grid health monitoring.
• Distributed Energy Resources (DERs): Renewable energy sources (solar, wind), battery storage, and microgrids connected to the grid.
• Demand Response Systems: IoT-enabled devices and systems that can adjust consumption (e.g., reduce air conditioning during peak demand) based on grid signals.
• Communication Networks: Fiber optics, cellular, and wireless mesh networks enabling bidirectional communication between grid components and control centers.
• Grid-Level Automation: SCADA and advanced control systems that optimize power flow, prevent blackouts, and balance supply/demand.

Fig 1.12: Smart Grid infrastructure showing modernized electrical distribution with sensors, automation, and bidirectional communication for optimized power management.

Benefits:

• Efficiency: Reduces energy losses in transmission and distribution.
• Reliability: Faster detection and isolation of faults; reduced outage duration.
• Sustainability: Integrates renewable energy; supports electric vehicle charging infrastructure.
• Demand-Side Management: Consumers get real-time visibility into consumption; utilities can optimize load balancing.
• Resilience: Decentralized architecture and redundancy make grids more resistant to failures and cyberattacks.

Why Smart Grid Matters:
Traditional electrical grids are centralized, reactive (responding after faults occur), and inflexible. Smart grids are distributed, predictive (detecting issues before they escalate), and adaptive. As renewable energy, electrification of transport, and climate concerns intensify, smart grids are essential to meeting future energy demands safely and sustainably.

2. Industrial Network Fundamentals

2.1 Routable and Nonroutable Networks

Routable Networks:

• Networks that use protocols like TCP/IP and can communicate across multiple network segments via routers and gateways.
• Enable direct communication between distant systems and remote monitoring/control capabilities.
• More flexible but introduce higher attack surface as they connect to enterprise IT networks and potentially the internet.
• Example: Modern SCADA systems using industrial Ethernet over TCP/IP.

Nonroutable Networks:

• Networks that use proprietary protocols (e.g., serial communications, Modbus, Profibus) and do not support standard IP routing.
• Historically isolated by nature; cannot directly communicate across network boundaries without protocol conversion.
• Simpler architecture and lower complexity, but limited remote capabilities.
• Example: Legacy PLCs communicating via RS-485 serial lines or Profibus networks.

---

2.2 Zones and Enclaves

Security Zones:

• Logical or physical groupings of ICS components with similar trust levels and security requirements, separated from other zones by controlled access points.
• Help enforce the principle of least privilege and compartmentalize risk.
• Example zones: Field Device Zone, Control Zone, Supervisory Zone, Enterprise Zone.
• Zones allow organizations to apply different security policies based on criticality and sensitivity.

Enclaves:

• Self-contained network segments within a zone or spanning multiple zones, designed to isolate mission-critical or sensitive operations.
• Typically protected by firewalls, network segmentation, and access control lists (ACLs).
• Enable defense-in-depth by reducing lateral movement if one segment is compromised.
• Example: A power generation enclave within a utility's broader SCADA network.

---

2.3 Network Perimeters and Electrical Security Perimeters (ESP)

Network Perimeters:

• The boundary or demarcation line between one security zone and another, or between the ICS and external networks (enterprise IT, internet).
• Controlled through firewalls, gateways, and monitoring points.
• All traffic crossing perimeters should be inspected, authenticated, and logged.
• Critical for preventing unauthorized access and lateral spread of threats.

Electrical Security Perimeters (ESP):

• The conceptual or physical boundary that defines which devices and systems are critical to the safe and reliable operation of industrial processes.
• Defined by NERC CIP standards for the power industry.
• All access points (physical and logical) to the ESP must be monitored and controlled.
• Systems outside the ESP have fewer security requirements but may still impact overall security posture.
• Example: A power plant's control center, servers, and critical field devices form the ESP, while administrative offices may fall outside.

---

3. Common Misperceptions About Industrial Network Security

3.1 Air Gaps are Completely Secure

Reality: USB devices, wireless access, and contractors can bypass air gaps. Physical separation helps but isn't a complete security strategy.

---

3.2 Security is Impossible in Control Environments

Reality: Compensating controls (segmentation, firewalls, monitoring) can provide strong security without traditional patching. Defense-in-depth works in ICS.

---

3.3 Security is IT's Responsibility

Reality: Both IT and operations must collaborate. Operations understands risk tolerance and process constraints; IT provides technical tools.

---

3.4 Enterprise Security Tools Work for ICS

Reality: Enterprise tools often cause unacceptable latency or fail on industrial protocols. ICS requires purpose-built solutions respecting Availability > Confidentiality priority.

---

Key Takeaway: Industrial security is distinct from enterprise security. Success requires collaboration, acknowledgment of constraints, and purpose-built solutions.