Introduction to ICS/SCADA Network Defense
What this domain tests
The exam tests whether you can separate IT security priorities from OT/ICS priorities and apply defense in depth to control systems. ICS covers DCS, SCADA, PLCs, RTUs, HMIs, historians, and safety instrumented systems (SIS). The governing priority is availability, integrity, and confidentiality-often shortened to AIC and usually the reverse of IT's CIA-because a control action or shutdown can affect safety, the environment, and production.
Core rules
- Know the Purdue model: Level 0 process, 1 basic control, 2 supervisory, 3 site operations, 3.5 DMZ, 4 enterprise, 5 external. Conduits between zones must be controlled.
- IEC 62443 zones and conduits and NIST SP 800-82 supply the reference architecture; segmentation, least privilege, and monitoring follow from them.
- Field protocols such as Modbus/TCP, DNP3, and EtherNet/IP were designed for function, not security. Assume weak authentication, clear text, and fragile devices.
- Safety and reliability outrank convenience. Do not scan, patch, or reconfigure production control equipment without a change window, rollback plan, and operations approval.
Worked example
A plant wants enterprise users to read PLC data. The naive fix is an ANY/ANY firewall rule from enterprise to the PLC subnet. Correct reasoning: place a replicated historian or data broker in a DMZ at Level 3.5. Allow only the enterprise-to-DMZ session required for the read. Allow only the broker-to-PLC port and function codes required, for example Modbus/TCP 502 read functions. That keeps the Purdue boundary intact and limits what an enterprise compromise can reach.
Traps
- Treating ICS as ordinary IT and applying CIA priority; the exam expects AIC.
- Routing SIS traffic through the business network instead of keeping safety systems independent.
- Assuming an air gap exists while remote support, USB, or wireless paths remain.
- Choosing a fix that requires rebooting a controller during production.