ICS/SCADA Cybersecurity
From Air-Gapped Myths to Zero-Trust Reality: Defending the Physical World
Industrial Control Systems (ICS) were initially designed for longevity and physical safety, not network security. As IT and OT (Operational Technology) converge, legacy PLC protocols—often lacking authentication—are being exposed to modern threats. Defending these systems requires a multi-layered approach that prioritizes **deterministic physical integrity** over simple data confidentiality.
1. The Purdue Model: Defense-in-Depth Architecture
The **Purdue Model** (ISA-95) remains the single most important architectural blueprint for industrial security. Its power lies in segmentation: creating logical boundaries between the messy, unpatchable reality of the factory floor and the hyper-connected, vulnerable nature of corporate IT.
Purdue Model Architecture
ISA-95 Industrial Segmentation
Traffic Simulation
Standard Firewall Rules
Software-based security. Firewalls rely on Access Control Lists (ACLs). If a hacker finds a zero-day vulnerability in the firewall firmware or misconfiguration, they can traverse from Level 5 (Internet) down to Level 1 (Controllers).
2. IEC 62443: Security Levels (SL) & Foundational Requirements (FR)
The **IEC 62443** standard provides a framework for measuring the security capability of a system. It defines four **Security Levels (SL)** based on the sophistication of the potential attacker, underpinned by seven **Foundational Requirements (FR)**.
| Foundational Requirement (FR) | Technical Description | SL-3/4 Objectives |
|---|---|---|
| FR 1: IAC | Identification & Access Control | Hardware-based MFA for local and remote users. |
| FR 2: UC | Use Control | Session limits, account lockouts, and strict RBAC. |
| FR 3: SI | System Integrity | Secure Boot, code signing, and memory protection. |
| FR 4: DC | Data Confidentiality | Encryption of sensitive config data and passwords. |
| FR 5: RDF | Restricted Data Flow | One-way data diodes and air-gapped zone isolation. |
| FR 6: TRE | Timely Response to Events | Continuous monitoring (NDR) and tamper-proof logs. |
| FR 7: RA | Resource Availability | DoS resilience, high-availability (PRP/HSR), and offline backups. |
3. Network Segmentation: Zones & Conduits
Following **IEC 62443**, industrial networks must be divided into **Zones** (functional clusters) connected by **Conduits** (controlled communication paths).