ICS/SCADA cheat sheet

Purdue Model levels: 0 process/physical, 1 basic controllers (PLCs, RTUs), 2 supervisory (HMI, SCADA servers), 3 operations (historians, OPC, patch/AV servers), 3.5 DMZ, 4 enterprise IT, 5 internet/cloud.

Security levels 0-2 hold availability as the top priority; levels 3-5 shift toward confidentiality and integrity, so controls differ by level.

The CIA triad is inverted in ICS: Availability > Integrity > Confidentiality, because a stopped process can injure people and damage equipment.

IT and OT differ on patching: IT patches in days/weeks, OT patches on maintenance windows measured in months or years because of uptime and vendor certification.

Protocols Modbus/TCP (502), DNP3 (20000), IEC 60870-5-104 (2404), EtherNet/IP (44818), S7comm (102) are largely unauthenticated and cleartext.

Zones and conduits (IEC 62443-3-3): group assets with common security requirements into zones and control all traffic between zones through defined conduits.

A safety instrumented system (SIS) must stay independent of the basic process control system; never route SIS traffic through the BPCS or shared switches.

Defense in depth means an adversary must cross multiple independent controls; a single perimeter firewall is not defense in depth.

TCP is connection-oriented: three-way handshake SYN, SYN-ACK, ACK; teardown uses FIN/ACK or RST.

TCP flags: SYN (open), ACK (acknowledge), FIN (graceful close), RST (abort), PSH (push data), URG (urgent).

UDP is connectionless with no handshake, no retransmission, and an 8-byte header; used by SNMP (161/162), DNS (53), NTP (123), and many ICS discovery protocols.

The IPv4 header is 20 bytes minimum; key fields are TTL, protocol (6 = TCP, 17 = UDP, 1 = ICMP), source/destination address, and header checksum.

Private ranges (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; link-local 169.254.0.0/16 indicates a failed DHCP request.

A /24 mask leaves 8 host bits = 256 addresses, 254 usable; /30 gives 2 usable hosts, common for point-to-point router links.

ARP resolves IPv4 to MAC inside a broadcast domain; ARP has no authentication and is the basis for ARP spoofing and MITM on flat OT LANs.

TCP ports 0-1023 are well known, 1024-49151 registered, 49152-65535 ephemeral; a client's source port is normally ephemeral.

Kill chain phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objective.

MITRE ATT&CK for ICS tactics include Initial Access, Discovery, Lateral Movement, Collection, Inhibit Response Function, Impair Process Control, Impact.

Scanning types: TCP connect (full handshake, logged), SYN/half-open (no completed handshake), FIN/NULL/XMAS (evade simple filters), UDP (slow, ICMP port-unreachable = closed).

Nmap -sS is a SYN scan; -sn is host discovery only; -sV does service/version detection; -O guesses the OS.

A reverse shell has the target connect outbound to the attacker, which often defeats inbound firewall rules; a bind shell listens on the target.

Pass-the-hash reuses an NTLM hash without cracking the plaintext; Kerberoasting requests service tickets and cracks them offline.

Privilege escalation splits into vertical (gain higher rights) and horizontal (move to another same-level account).

Covering tracks includes clearing logs, timestomping, and using living-off-the-land binaries (PowerShell, WMI, PsExec) that already exist on the host.

CVSS v3.1 base score ranges: 0.0 none, 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, 9.0-10.0 critical.

CVSS base metrics: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, Availability.

CVSS does not account for your asset's role; a 7.5 on an internet-facing HMI outranks a 9.8 on an isolated lab PLC.

CVE is the identifier, NVD is the enrichment database, and a vendor advisory maps the CVE to affected firmware versions.

Passive vulnerability assessment (SPAN/TAP traffic analysis) is preferred in sensitive OT cells because active scanning can crash legacy controllers.

Active scanning risks: Modbus/DNP3 devices may drop or reset on unexpected function codes; schedule scans in maintenance windows with vendor approval.

Patch management cycle: inventory, assess, prioritize by risk, test in a lab or staging cell, deploy in a window, verify, and document compensating controls.

When patching is not possible, compensating controls include ACLs, network segmentation, IDS signatures, and disabling unused services or ports.

IEC 62443 defines security levels SL1-SL4 (protection against casual, intentional, sophisticated, and nation-state-level attacks) and four foundational requirements.

IEC 62443-4-1 covers the secure development lifecycle for product suppliers; 62443-4-2 covers component technical requirements; 62443-3-3 covers system requirements.

NIST SP 800-82 Rev. 3 is the guide to OT security; NIST CSF 2.0 functions are Govern, Identify, Protect, Detect, Respond, Recover.

NERC CIP applies to North American bulk electric systems; CIP-007 covers systems security management and CIP-005 covers electronic security perimeters.

ISO/IEC 27001 specifies an information security management system (ISMS) with risk assessment, treatment, and continual improvement via PDCA.

TSA Security Directives for pipelines require network segmentation, access control, continuous monitoring, and a cybersecurity implementation plan.

IEC 61511 and IEC 61508 govern functional safety and safety instrumented systems; security changes must not break the safety case.

Regulations set a minimum legal bar; standards and frameworks describe how to meet it. Compliance alone does not equal security.

Segment by function and trust: control cells, supervisory zone, DMZ, enterprise. Enforce inter-zone traffic with stateful firewalls and allowlists.

Industrial firewalls must understand OT protocols (Modbus, DNP3, IEC 104) to filter by function code, not just IP and port.

The IT/OT DMZ holds jump hosts, historian replicas, patch staging, and AV update servers so no direct enterprise-to-control traffic exists.

Disable or restrict unused services and default credentials on PLCs, HMIs, and switches; change vendor defaults before commissioning.

Use 802.1X or MAC-based port security on OT switches, and disable unused switch ports to block rogue device connections.

Remote access should require a VPN gateway in the DMZ, MFA, and session logging; vendor connections need a time-limited, monitored account.

Network monitoring: SPAN ports and TAPs feed IDS passively, avoiding inline failure risk in availability-critical cells.

Least privilege and role-based access: separate operator, engineer, and vendor accounts; log all configuration and program changes.

A true air gap means no physical or logical connection; USB media, wireless, and maintenance laptops are the common bridges that break it.

Data diodes enforce one-way data flow (hardware or optical), allowing telemetry out while physically preventing inbound traffic.

A data diode is not a firewall: it cannot be misconfigured to allow return traffic, which is why it is used for safety-critical egress.

Removable media controls: dedicated scanned USB devices, endpoint AV scanning, and a documented transfer procedure reduce the USB attack path.

Stuxnet crossed an air gap via infected removable media, showing that air gaps fail when human processes are unmanaged.

Cross-domain solutions (guards) allow controlled bidirectional transfer with content inspection and protocol break, unlike a diode.

Media transfer stations should be standalone hosts on a separate VLAN, reimaged periodically, with logging of every file transfer.

Verify the gap: asset inventories and network discovery must confirm no undocumented wireless, cellular, or dual-homed host bridges the zones.

NIDS monitors network traffic via SPAN or TAP; HIDS monitors host logs, files, and processes on the endpoint.

Signature detection matches known patterns (high accuracy, no zero-day); anomaly detection baselines normal behavior and flags deviations (more false positives).

An IDS is passive: it detects and alerts only. An IPS is inline and can drop or reset traffic, but adds latency and a failure point.

Inline IPS in availability-critical OT cells is risky; passive IDS with out-of-band alerting is the usual choice, or a bypass switch.

Deployment points: perimeter, IT/OT DMZ, and each control zone mirror port; sensor placement determines what you can see.

Common OT IDS signatures: unauthorized function codes, firmware writes, PLC program downloads, new device on the network, and scan patterns.

False positives in OT can be costly if they trigger automatic blocks; tune signatures to the baseline before enabling prevention.

Alert triage needs context: asset criticality, process state, and whether the source is an authorized engineering workstation.