Category: Industrial Network Security

1. “Security isn’t necessary; our ICS is air‑gapped.”


Very few industrial networks are truly air‑gapped anymore, and most have some form of connectivity to business networks, remote vendors, or cloud services. Even if you were fully isolated, threats can still enter through infected laptops, USB drives, engineering workstations, and supply-chain compromises. Treating “air‑gapped” as a security strategy creates blind spots and leads to underinvestment in basic controls like monitoring, segmentation, and access management.

2. “Proper security is impossible; we can’t use AV or patch regularly.”


It’s true that traditional IT practices like weekly patch cycles and generic antivirus on every endpoint often don’t fit OT realities. But that doesn’t make security impossible—it just means you need an OT‑aware approach. Compensating controls such as strict network segmentation, whitelisting, secure remote access, protocol‑aware inspection, and rigorous change management can meaningfully reduce risk even when patches are delayed and AV is limited.

3. “Security is someone else’s job; it belongs purely to IT.”


Industrial cybersecurity sits at the intersection of IT and OT, so neither side can handle it alone. IT teams understand networks, identity, and infrastructure, but OT teams understand the processes, safety constraints, and what “normal” looks like on the plant floor. Effective security requires shared responsibility: joint risk assessments, coordinated change control, and clear roles so that cyber decisions are made with both operational and security impacts in mind.

4. “ICS security is the same as enterprise IT; the same tools and strategies will work.”


Industrial networks have different priorities (safety and availability first), protocols, and operating constraints than office IT environments. Approaches that work fine in IT—like aggressive network scans or frequent reboots—can cause outages or safety risks in OT. While some technologies overlap, ICS security strategies must be tailored: think deterministic traffic baselines, Purdue-model segmentation, protocol‑aware inspection, and change controls aligned to maintenance windows, not just copying IT playbooks.

Asset
Any physical or software component used in an industrial control system.

Industrial Control System (ICS)
An automation system that monitors and controls industrial or manufacturing processes.

Building Control System (BCS)
A type of ICS that automates building functions like HVAC, lighting, and access control.

Industrial Protocols
Protocols used for ICS communications, often originally serial and now carried over TCP or UDP (for example, Modbus/TCP).

Routable Network
A network that uses IP-based protocols (such as TCP/IP or UDP/IP) so traffic can be routed between segments.

Business Network
The IT network that supports business systems like email, file sharing, and enterprise applications.

Critical Asset
A facility, system, or equipment essential to safe and reliable operation (such as key substations or control centers).

Critical Cyber Asset
A networked device that supports a Critical Asset and, if compromised, could affect operations (often using routable protocols or dial-up access).

Bulk Electric System (BES)
The large-scale power generation and transmission system that delivers electricity over a wide area.

Zone
A group of assets with similar function or security needs, treated as a single protected area.

Conduit
A controlled communication path between zones that enforces who and what can access resources.

Electronic Security Perimeter (ESP)
The logical boundary around critical cyber assets where network access is tightly controlled.

Demilitarized Zone (DMZ)
A buffer network that exposes limited services to less-trusted networks while protecting internal control networks.

Firewall
A device or software that filters network traffic based on rules, such as IP address, port, or protocol.

Deep Packet Inspection (DPI)
Analysis of the actual contents of network traffic to understand protocols and detect suspicious behavior.

Intrusion Detection System (IDS)
A system that monitors activity and alerts on suspected attacks but does not block traffic.

Intrusion Prevention System (IPS)
A system that detects suspicious activity and can automatically block or modify traffic.

Unified Threat Management (UTM)
An appliance or application that combines multiple security functions, such as firewall, DPI, and intrusion prevention, into one platform.

In the world of operational technology (OT) and industrial control systems (ICS), threats aren’t all created equal. Each type of attacker brings different motivations, tools, and capabilities — and together they form what we call the risk curve.

The risk curve helps us understand how the likelihood and consequence of cyberattacks change as threat actor capability evolves.

How the Risk Curve Works

• As capability increases, the likelihood of an attack generally decreases.
• As capability increases, the consequence of an attack increases.

Why?

More skilled actors invest significant time and resources in reconnaissance, exploit development, and operational discipline. They conduct passive and active enumeration of targets, learning network behaviors, asset dependencies, and safety constraints. Building custom toolkits or zero-day exploits takes months or years — meaning advanced attackers strike less often.

But when they do, the results are far more severe. Advanced threat actors can trigger wide-scale process disruption, damage physical assets, or even cause cascading safety effects. In OT and ICS environments, those consequences jump quickly from the digital to the real world — production loss, environmental harm, or human safety risks.

The Three Groups of Threat Actors

• Group 1: Everyone — “Script Kiddies” and Opportunists
: Actors with minimal skills who rely on public tools or leaked exploit kits. Their attacks are frequent and noisy but usually low-impact — scanning exposed HMIs or attempting weak default passwords. Consequences are often limited to nuisance-level disruptions.

• Group 2: Organized Groups
: These are cybercriminal collectives or ideologically aligned organizations that conduct targeted, profit-driven attacks. They may use known ICS vulnerabilities, commodity malware, or adapted tools. While less frequent than Group 1, their attacks can result in operational downtime, data theft, or financial loss — moderate consequence, medium likelihood.

• Group 3: Nation-State or State-Sponsored Actors
: The pinnacle of capability and consequence. These adversaries invest in custom ICS malware, covert persistence, and sophisticated delivery methods. Attacks from this group are rare but strategically devastating — think production outages, physical damage to assets, or deliberate targeting of critical infrastructure. Low likelihood, extremely high consequence.

Why It Matters for OT/ICS Defenders

Understanding the balance between likelihood and consequence across the risk curve helps organizations apply their defenses efficiently.
Most day-to-day alerts will come from low-skill attackers (high likelihood, low consequence), but your preparedness must scale up to anticipate those rare, high-consequence events driven by top-tier adversaries. Effective OT security programs build layered defenses, combining continuous monitoring and basic hygiene for lower-tier threats with segmentation, detection engineering, and incident response playbooks for advanced ones.