ICS/SCADA case studies
ICS/SCADA · Put your knowledge to work in context.
The ICS/SCADA Cybersecurity offering from EC-Council is a hands-on training course built around defending industrial control and supervisory control and data acquisition environments. The vendor frames ICS/SCADA security as a higher priority than traditional IT security because an attack can affect the physical safety of communities, employees, or customers, and it points to malware such as Triton/TRISIS and Stuxnet as evidence that threats capable of disrupting operational technology already exist. The ICS/SCADA case studies are 5 cases and about 3,486 words.
1Historian Bridge Under Pressure
Northline Water Alliance runs 14 drinking-water treatment sites. Its corporate IT network and OT network are separated by a firewall, but a historian server is dual-homed: one NIC in IT, one in the OT distribution VLAN.
752 words, about 4 min2Intermittent Modbus Timeouts After a Wireless Bridge
At a 60 MW solar site, 42 string inverters and three trackers communicate over Modbus TCP to a SCADA server. The OT LAN is one flat VLAN, 10.20.8.0/24, with static addresses.
673 words, about 3 min3Four-Hour Patch Window on a Packaging Line
Meridian Pharma runs a packaging line with three Windows 7 HMIs, two PLCs, and one OPC UA gateway. A quarterly scan found: (A) CVSS 9.8 unauthenticated remote code execution in the OPC UA service on all three HMIs, reachable from the flat OT LAN and from a vendor VPN that terminates on the same VLAN; (B) CVSS 8.1 PLC firmware flaw requiring a project file upload, with no public exploit; (C) missing Windows 7 patches from 2020, including SMBv1; (D) low-risk SNMP community string 'public' on a switch.
682 words, about 3 min4Audit Evidence for Shared OT Accounts
Lakeshore Electric, a registered NERC CIP entity with medium-impact BES Cyber Systems, received a draft audit report. The auditor found: 17 shared local administrator accounts on HMIs across two substations; 14 accounts belonging to former contractors still enabled; no documented security patch evaluation for nine months on the EMS jump host; and vendor remote access through a shared VPN account with no session logging.
684 words, about 3 min5Inline IPS on a Batch Mixing Line
GreenField Foods has a batch mixing line with six PLCs, two HMIs, and a batch controller on one OT VLAN. A passive IDS mirrors the core switch and produces about 300 alerts per day; the OT engineer estimates only 12 are true security events.
695 words, about 3 min