IT vs. OT: The Priority Inversion

In a standard office network, the primary goal is protecting the data (Confidentiality). In a SCADA (Supervisory Control and Data Acquisition) environment, the primary goal is protecting the machine and the human operator (Safety).

The Purdue Model (Hierarchy of Control)

To secure industrial sites, we use the Purdue Enterprise Reference Architecture (PERA). This divides the network into logical levels:

• Level 0 (Physical Process): Sensors, actuators, and motors.
• Level 1 (Basic Control): PLCs (Programmable Logic Controllers) and RTUs.
• Level 2 (Area Supervisory): HMI terminals and engineering workstations.
• Level 3 (Site Operations): Historians and local site management.
• Level 3.5 (DMZ): The firewall barrier between the factory and the office.
• Level 4/5 (Business): The enterprise IT network and cloud services.

SCADA Protocols: Modbus, DNP3, and PROFINET

Old SCADA protocols were designed for serial lines and have zero security features. When wrapping these in Ethernet (Modbus TCP), they become highly vulnerable to spoofing.

Handover Checklist

• [ ] Verified all switches are Industrial-Grade (Extended Temp Range).
• [ ] Confirmed no direct internet routing to Level 0-3 assets.
• [ ] Documented all Modbus register maps and IP addresses.
• [ ] Tested redundant ring recovery (REP or MRP) under 50ms.