ICS/SCADA Cybersecurity
Engineering Resilience for Critical Infrastructure
1. The Purdue Model (ISA-95)
The gold standard for ICS security is the Purdue Model, which establishes a strict hierarchy for network segmentation.
| Level | Layer | Function |
|---|---|---|
| Level 4-5 | Enterprise | Corporate IT, ERP systems, Internet connectivity. |
| Level 3.5 | DMZ | Security buffer between IT and OT. Patch management. |
| Level 3 | Operations | HMI, Historians, Domain Controllers. |
| Level 2 | Control | PLCs, Distributed Control Systems (DCS). |
| Level 0-1 | Process | Sensors, Actuators, Pumps, Valves. |
Purdue Model Architecture
ISA-95 Industrial Segmentation
Traffic Simulation
Standard Firewall Rules
Software-based security. Firewalls rely on Access Control Lists (ACLs). If a hacker finds a zero-day vulnerability in the firewall firmware or misconfiguration, they can traverse from Level 5 (Internet) down to Level 1 (Controllers).
2. Protocol Deconstruction: The Zero-Security Legacy
Industrial protocols like Modbus TCP and DNP3 were built for reliability in harsh environments, not security. They lack encryption, authentication, and even basic integrity checks.
Deconstructing a Modbus Attack
A standard Modbus TCP frame (Port 502) is unencrypted. An attacker with network access can inject a single packet to manipulate physical reality:
The command above (Function Code 0x05); forces a binary coil to "ON". If that coil controls a physical breaker, the attacker effectively has a remote-controlled mechanical shutoff.
3. Data Diodes: The Physics of One-Way Isolation
While a firewall is a logical barrier, a Data Diode (or Unidirectional Gateway) is a physical one. In critical infrastructure (nuclear, oil & gas), we must export data (historian logs) without allowing any ; return path for a remote exploit.
Physical Layer Isolation
The hardware utilizes a transmit-only LED on the source and a receive-only Photodiode on the destination. There is physically no wire or light path for return traffic, rendering Layer 2 protocols like ARP or TCP Handshakes impossible.
Protocol Proxies
Since TCP is bidirectional, the diode uses proxies on both sides. The "Send" proxy terminates the TCP session, extracts the data, pulses it through the light, and the "Receive" proxy reconstructs the TCP session on the high-security side.
Conclusion: Engineering Safe States
ICS cybersecurity is fundamentally a Mechanical Engineering problem solved with Digital Tools. If a digital system fails, the physical system must enter a "Fail-Safe" mode. By adhering to the Purdue Model and utilizing DPI-aware gateways, we build grids that are resilient as well as functional.