Industrial Networking and Protocols
Domain 2 tests protocol-level knowledge and the security implications of Modbus TCP, DNP3, EtherNet/IP, PROFINET, and OPC UA in PCN environments.
Core rules
- Modbus TCP has no built-in authentication or encryption; function codes 1–6, 15, and 16 read or write coils and registers. Anyone who can reach TCP 502 can often write.
- DNP3 supports secure authentication under IEEE 1815, but many deployments still use DNP3 serial or TCP without it. Monitor control operations and unsolicited responses.
- EtherNet/IP uses CIP over TCP/UDP 44818; explicit messaging differs from implicit I/O. CIP Safety is a separate safety layer.
- PROFINET uses RT/IRT for cyclic I/O and DCP for discovery; network design and switch configuration affect determinism.
- OPC UA uses certificates, signing, and encryption, with role-based access. A endpoint configured for 'None' security is a finding, not a default to accept.
Worked example
A capture shows a Modbus TCP write single coil (function code 5) to a PLC from an engineering workstation at 02:14. Reasoning: FC5 changes a discrete output. If the workstation is not authorized for that PLC and no change ticket exists, treat it as a potential unauthorized control action. Check the source asset role, the communications baseline, and PLC mode. Do not simply block TCP 502 without confirming operator HMI dependence.
Traps
Assuming DNP3 is encrypted by default; thinking a protocol is safe because it is serial; confusing Modbus FC5 with FC6; ignoring OPC UA certificate expiry; treating CIP explicit messaging as the same as real-time I/O.