Securing the ICS network
What this domain tests
This domain tests practical network defense for control systems: segmentation, firewall and DMZ design, secure remote access, endpoint hardening, backups, and monitoring. The exam wants controls that preserve availability while shrinking the attack path from IT and the internet.
Core rules
- Segment by function and trust using IEC 62443 zones and conduits. Deny by default and permit only required source, destination, port, and protocol.
- Place shared services such as historians, patch repositories, and remote-access gateways in a DMZ. No direct internet path to Level 2 or lower.
- Use ICS-aware firewalls or deep packet inspection where protocol-level control is needed; a generic IT rule that allows all Modbus function codes is too broad.
- Harden assets: disable unused services and ports, change default credentials, apply least privilege, use application allowlisting, and control removable media.
- Remote access should go through a jump host or gateway with MFA, session logging, time limits, and an approved destination list. Vendor access must be enabled only when needed.
- Maintain tested offline backups and configuration exports. Monitor zone boundaries and control-network traffic; log and review changes.
Worked example
A vendor needs remote support for a PLC. The bad design is an always-on VPN from the vendor into the control network. The defensible design is a vendor access gateway in the DMZ, MFA, an approved session request, a time-bound account, session recording, and a firewall rule that permits only the vendor jump host to the specific PLC IP and required port. The vendor never gets a broad route to Level 2. Reasoning: each control removes a path or adds accountability while keeping support possible.
Traps
- Flat control networks with trusted internal hosts.
- Allowing a vendor permanent access because it is convenient.
- Relying on an IT firewall without protocol inspection or return-path review.
- Ignoring Layer 2 risks such as ARP spoofing and VLAN hopping.
- Backups that exist but have never been restored or tested.