ICS/SCADA Security Fundamentals
Industrial Control Systems (ICS) and SCADA (Supervisory Control and Data Acquisition) systems manage critical infrastructure: power grids, water treatment, oil and gas, manufacturing. Cyberattacks on these systems can cause physical damage and endanger human safety.
The Purdue Model
Enterprise security architecture for industrial environments:
| Level | Description | Examples |
|---|---|---|
| 5 | Enterprise | ERP, email, internet |
| 4 | Business Planning | MES, historian (DMZ) |
| 3.5 | DMZ | Firewalls, data diodes |
| 3 | Operations | SCADA servers, HMI |
| 2 | Control | PLCs, RTUs, DCS |
| 1 | Field | Sensors, actuators |
| 0 | Process | Physical equipment |
Key Principle: No Direct Connection Between Level 5 and Levels 0-3
Common Vulnerabilities
Protocol Weaknesses
- Modbus: No authentication, no encryption
- DNP3: Limited security features
- OPC UA: Complex, often misconfigured
- EtherNet/IP: Relies on network segmentation
Legacy Systems
- Windows XP/7 still running on HMI systems
- Unpatched PLCs with known vulnerabilities
- Default credentials on controllers
- No endpoint protection on OT systems
Convergence Risks
- IT malware spreading to OT networks
- Remote access for maintenance creating attack paths
- Cloud connectivity for monitoring introducing exposure
Security Strategies
Network Segmentation
- Implement Purdue model with enforced boundaries
- Deploy industrial firewalls at each level
- Use data diodes for one-way communication where possible
- Monitor all cross-zone traffic
Asset Discovery
- Passive scanning (don't actively scan OT networks)
- Protocol-aware asset identification
- Firmware version tracking
- Vulnerability correlation
Monitoring
- OT-specific intrusion detection (Nozomi, Claroty, Dragos)
- Protocol anomaly detection
- Baseline comparison for control commands
- Physical process monitoring for safety validation
Where SuperClue Fits
SuperClue does not support OT or SCADA networks, and its agents cannot be deployed on them. It covers the IT side: web applications through the DAST scanner, and Linux and Windows servers through the SOC agent.