Fieldbus, Industrial Networks and Cybersecurity
Fieldbus, Industrial Networks and Cybersecurity tests how field devices, controllers and supervisory systems communicate, and how those networks are segmented and defended. The exam expects protocol knowledge plus IEC 62443-style security reasoning, not just IT firewall rules.
Core rules and concepts
- HART is a digital signal superimposed on 4-20 mA, mainly for configuration and diagnostics. Foundation Fieldbus H1 is a digital, powered, multi-drop bus at 31.25 kbit/s with typically up to 32 devices per segment and segment-length limits; it supports publisher/subscriber and client/server communication.
- Profibus DP is a deterministic master/slave fieldbus; Profibus PA serves process instruments. Modbus is simple request/response and has no built-in security or time synchronisation. Profinet, EtherNet/IP and IEC 61850 run over Ethernet; BACnet and KNX are common in building services.
- Determinism depends on protocol, cycle time, switch configuration and network load. Redundant ring or media redundancy improves availability but must be tested for reconfiguration time.
- IEC 62443 uses zones and conduits. The Purdue model separates field, control, supervisory and enterprise layers; a DMZ between control and enterprise prevents direct traversal. Apply defence in depth, least privilege, asset inventory, patching, backups, monitoring and multifactor access for remote support.
- An "air gap" is rarely real: maintenance laptops, USB drives and vendor remote access create bridges. Segment by function and enforce allow-listed rules.
Worked example
A legacy PLC and HMI share a flat network with the corporate LAN. Put the PLC and HMI in a control zone, the historian in a DMZ, and the enterprise in a separate zone. Allow only the historian to read Modbus/TCP port 502 from the PLC, block all other traffic, and require remote vendors to enter through a jump host with multifactor authentication. The reasoning is zone-and-conduit reduction of attack paths, not simply buying a firewall.
Traps
Assuming serial fieldbus is secure because it is old; allowing any-to-any rules; using unmanaged switches without VLANs; exposing programming ports; and treating patching as impossible rather than planned.