PCN PEP cheat sheet

Purdue Model levels: 0 = physical process, 1 = basic controllers (PLCs, RTUs), 2 = supervisory (HMI, SCADA), 3 = site operations (historian, engineering workstation), 3.5 = DMZ, 4 = enterprise IT, 5 = cloud/Internet.

The CIA triad priority is reversed in OT: Availability > Integrity > Confidentiality, because safety and continuous production outrank data secrecy.

Control loop components: sensor (process variable), controller (PID algorithm), final control element (valve, VFD); scan time is the controller's cycle to read inputs and update outputs.

An RTU is optimized for telemetry over low-bandwidth links and remote locations; a PLC is optimized for high-speed discrete and analog control on the plant floor.

A DCS distributes control across many processors with integrated operator consoles; a SCADA system centralizes supervision of geographically dispersed assets.

Safety Instrumented Systems (SIS) operate independently of the basic process control system (BPCS) and bring the process to a safe state when interlock limits are exceeded.

Key OT protocols and ports: Modbus/TCP 502, DNP3 20000, EtherNet/IP 44818 (TCP) and 2222 (UDP I/O), PROFINET 34964, OPC UA 4840.

OT device constraints: long lifecycle (15–25 years), unpatchable firmware, real-time determinism, and often no authentication or encryption in legacy protocols.

Zones and conduits (IEC 62443) group assets with common security requirements and define controlled communication paths between zones.

Modbus/TCP has no authentication or encryption; function codes 1–6, 15, 16 read/write coils and registers; unit ID 0 is often a broadcast.

DNP3 uses a master-outstation model with unsolicited responses, supports time synchronization and event buffers, and Secure Authentication (SAv5) adds challenge-response integrity.

EtherNet/IP runs CIP over TCP (explicit messaging, port 44818) and UDP (implicit I/O, port 2222); CIP Security adds TLS/DTLS for integrity and confidentiality.

PROFINET uses RT (real-time) for cyclic I/O and IRT (isochronous) for motion control; GSDML files describe device configuration.

OPC UA is platform-independent, uses TCP port 4840, supports X.509 certificates, signing and encryption, and an information model with nodes and references.

IEC 61850 is the substation automation standard; GOOSE messages are Layer 2 multicast for fast protection trips, and MMS runs over TCP.

WirelessHART uses IEEE 802.15.4 mesh at 2.4 GHz with TDMA and channel hopping; ISA100.11a is a competing industrial wireless standard.

Industrial Ethernet determinism: PROFINET IRT and EtherCAT achieve sub-millisecond cycles; standard TCP/IP is non-deterministic due to queuing and retransmission.

Protocol gateways and protocol converters translate between legacy serial (RS-485 Modbus RTU) and Ethernet protocols; each translation point is an attack surface.

The DMZ between Level 3 and Level 4 terminates all IT-to-OT sessions; no direct routing from enterprise to control networks is permitted.

A unidirectional gateway (data diode) enforces one-way data flow from OT to IT, preventing inbound command and control.

Conduits between zones must be documented with source, destination, protocol, port, and business justification; default-deny is the baseline.

VLANs provide Layer 2 separation but are not a security boundary without inter-VLAN ACLs or firewalls; VLAN hopping via trunk negotiation is a known risk.

The ISA/IEC 62443 zone model requires that a conduit's security controls match the higher Security Level of the two zones it connects.

Mirror ports or TAPs are used for passive OT monitoring; active scanning can disrupt fragile controllers and should be avoided unless explicitly approved.

Redundant network paths (ring topologies with RSTP or MRP) improve availability; media redundancy protocol (MRP) is common in PROFINET rings.

Remote access should traverse a jump host in the DMZ with MFA, session recording, and time-limited accounts; direct VPN into Level 2 is discouraged.

Defense in depth layers: physical security, network segmentation, host hardening, application controls, identity management, and monitoring.

IEC 62443-3-3 defines seven foundational requirements: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability.

Security Levels SL1–SL4 describe protection against casual, intentional, sophisticated, and state-sponsored attackers; SL4 is the highest.

Application whitelisting is the most effective endpoint control on fixed-function HMIs and engineering workstations because it blocks unknown executables.

Patch management in OT follows a test-then-deploy cycle: vendor advisory, lab validation, maintenance window, rollback plan, and post-patch verification.

Network allowlisting (ACLs, firewalls) is preferred over signature-based detection at OT boundaries because protocol signatures vary by vendor.

USB and removable media controls include endpoint port blocking, scan-before-use kiosks, and hardware write blockers.

Least privilege applies to engineering workstations: separate accounts for operator, engineer, and administrator roles; no shared generic logins.

Physical controls (locked cabinets, badge access, camera coverage) protect PLCs and network gear that may lack logical authentication.

Risk = likelihood × consequence; in OT, consequence includes safety, environmental impact, production loss, and regulatory penalty.

A HAZOP study systematically examines deviations (no flow, more pressure, reverse flow) from design intent using guide words.

LOPA (Layer of Protection Analysis) quantifies independent protection layers and determines whether risk is as low as reasonably practicable (ALARP).

IEC 62443-3-2 requires a cyber security risk assessment that identifies zones, conduits, and target Security Levels before control selection.

NIST SP 800-82 provides OT security guidance; NIST CSF organizes outcomes into Identify, Protect, Detect, Respond, Recover, and Govern.

NERC CIP applies to bulk electric systems: CIP-002 (asset categorization), CIP-005 (electronic security perimeter), CIP-007 (system security management), CIP-010 (configuration change management).

TSA Security Directives for pipelines require cyber implementation plans, network segmentation, and reporting of incidents to CISA.

Risk treatment options are mitigate, transfer, avoid, and accept; acceptance must be documented with residual risk and management sign-off.

A security assessment gap analysis compares current controls to a target profile (e.g., IEC 62443-3-3 SL2) and produces a remediation roadmap.

Passive OT monitoring uses SPAN ports or TAPs to capture traffic; industrial IDS (e.g., Dragos, Claroty, Nozomi) baselines normal protocol behavior and flags anomalies.

Key OT detection use cases: new asset appearing, unauthorized protocol command, PLC program download, firmware change, and unexpected outbound connection.

Log sources include firewalls, switches, HMIs, historians, domain controllers, and endpoint agents; time synchronization (NTP or PTP) is required for correlation.

The incident response lifecycle: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

OT containment differs from IT: isolating a compromised HMI may stop production; safety and manual operation must be confirmed before disconnection.

The SANS six-step IR process and NIST SP 800-61 both emphasize documented playbooks and defined communication channels.

Incident reporting obligations: CISA within 72 hours for significant cyber incidents under CIRCIA (where applicable), and sector regulators such as NERC and TSA.

Forensics in OT requires memory and configuration capture from controllers, but many PLCs lack logging; network packet capture is often the primary evidence.

Tabletop exercises test OT-specific scenarios such as ransomware on the historian or unauthorized engineering workstation access.

Change management in OT requires a request, risk review, test plan, approval, scheduled window, implementation, verification, and documentation.

Configuration backups of PLCs, HMIs, switches, and firewalls must be stored offline and tested for restore; an untested backup is not a control.

Asset inventory should record make, model, firmware version, network address, owner, location, and end-of-support date for every OT device.

Vendor end-of-life (EOL) and end-of-support (EOS) dates drive replacement planning; unsupported devices require compensating controls.

The OT lifecycle phases: requirements, design, implementation, commissioning, operations, maintenance, decommissioning, and secure disposal.

Spare parts and cold/warm spares for critical controllers reduce recovery time; firmware images must be archived with checksums.

Maintenance windows are coordinated with production planning; emergency changes require retrospective documentation and risk acceptance.

Decommissioning must include data sanitization, credential revocation, network removal, and physical destruction of storage media where required.

Performance baselines (CPU load, scan time, network latency) help detect degradation and validate changes after maintenance.