← All cheat sheets

ICS / OT SECURITY

Plain-text reference · 7 KB. Read it, search it (Ctrl-F) or print it.

Industrial Control Systems (ICS) and Operational Technology (OT) run physical
processes - power, water, manufacturing, transport. A defensive reference:
how OT differs from IT, the reference models, the protocols you will meet, the
threats, and the controls. For detection mapping see MITRE-ATTACK; for network
capture see ZEEK / SURICATA / TCPDUMP; for incident handling see
INCIDENT-RESPONSE.

OT IS NOT IT (WHY IT MATTERS)#

Priority triad is INVERTED: Availability > Integrity > Confidentiality (AIC).
  Safety and uptime first; a crash can injure people or stop production.
Lifespans 15-30 yrs; devices often unpatchable and never rebooted.
Protocols are old and usually UNauthenticated and UNencrypted by design.
Change windows are rare; you cannot "just patch" or scan aggressively
  (active scans can crash fragile PLCs - prefer passive monitoring).
Consequence of failure is physical, not just data loss.

THE PURDUE MODEL (REFERENCE ARCHITECTURE)#

Level 5  Enterprise network (corporate IT, ERP)          # IT
Level 4  Site business / logistics                       # IT
----- IT/OT DMZ (Level 3.5): the boundary; no direct L4<->L3 traffic -----
Level 3  Site operations - historians, MES, patch/AV     # OT
Level 2  Supervisory control - HMI, SCADA, EWS
Level 1  Basic control - PLC, RTU, IED, DCS controllers
Level 0  Process - sensors, actuators, valves, motors
Segment between levels; the DMZ brokers all IT<->OT flows (no pass-through).

IEC 62443 (ISA/IEC - THE OT SECURITY STANDARD)#

Zones & conduits: group assets of like risk into ZONES; all traffic between
  zones crosses a controlled CONDUIT (firewall, diode, broker).
Security Levels SL 1..4 (resistance to attacker capability), as a vector:
  SL-T target (what you need)  SL-C capability (what a product offers)
  SL-A achieved (what you actually have) - aim SL-A >= SL-T
7 Foundational Requirements (FR):
  FR1 Identification & Authentication Control
  FR2 Use Control
  FR3 System Integrity
  FR4 Data Confidentiality
  FR5 Restricted Data Flow
  FR6 Timely Response to Events
  FR7 Resource Availability
Parts: -2-1 (program/CSMS), -3-2 (risk & zones), -3-3 (system reqs),
  -4-1 (secure product dev), -4-2 (component reqs).

COMMON OT PROTOCOLS (DEFAULT PORTS)#

Modbus TCP            502/tcp    # no auth; function codes below
DNP3                  20000/tcp  # power/water; Secure Auth is optional add-on
S7comm / S7comm+      102/tcp    # Siemens, over ISO-on-TCP (TPKT/COTP)
EtherNet/IP (CIP)     44818/tcp  # explicit; 2222/udp implicit I/O
OPC UA                4840/tcp   # modern; CAN do auth+TLS (use it)
OPC DA (classic)      DCOM/135   # legacy, Windows RPC - avoid exposing
BACnet/IP             47808/udp  # building automation (0xBAC0)
IEC 60870-5-104       2404/tcp   # power telecontrol
PROFINET              34962-34964 # UDP/TCP; RT I/O is layer 2 (0x8892)
Most have NO authentication: network position = control. Isolate them.

Modbus function codes (read/write the PLC's memory):
  1 read coils    2 read discrete inputs   3 read holding registers
  4 read input registers   5 write single coil   6 write single register
  15 write multiple coils  16 write multiple registers
  (fn 5/6/15/16 change physical state - alarm on unexpected writes)

THREATS & NOTABLE OT MALWARE (STUDY, NOT RECIPES)#

Stuxnet (2010)         # S7 PLC manipulation; centrifuge sabotage
BlackEnergy (2015)     # Ukraine grid; KillDisk + HMI access
Industroyer/CrashOverride (2016), Industroyer2 (2022)  # grid protocols
TRITON / TRISIS (2017) # targeted a Triconex SAFETY instrumented system
Pipedream (Dragos) / INCONTROLLER (Mandiant), 2022; CISA AA22-103A # toolkit
Common entry: IT-to-OT pivot, remote access/VPN, vendor laptops, USB,
  internet-exposed HMIs/PLCs (find your own via asset inventory, not Shodan
  against others' kit).

MITRE ATT&CK FOR ICS#

Separate matrix from Enterprise. v20 (Oct 2026): 12 tactics, 78 techniques +
26 sub-techniques (counts change each release - check attack.mitre.org).
Tactics (left to right):
  Initial Access > Execution > Persistence > Privilege Escalation >
  Evasion > Discovery > Lateral Movement > Collection >
  Command and Control > Inhibit Response Function >
  Impair Process Control > Impact
Note the two OT-specific tactics: Inhibit Response Function (defeat safety/
  alarms) and Impair Process Control (change the physical process).
Map detections to techniques here, not the Enterprise matrix.

MONITORING & DETECTION (PASSIVE-FIRST)#

Passive network monitoring (SPAN/TAP) - never active scan L0-L2.
Baseline then alert on deviation: OT traffic is highly repetitive.
  new source talking Modbus/S7, unexpected write function codes,
  engineering connections (STOP/PROGRAM mode), firmware download,
  new MAC/IP in a zone, DNS/HTTP egress from a controller (should be none).
Tools: Zeek + ICS parsers, Suricata ICS rulesets, Malcolm/Arkime, and OT-aware
  platforms (Nozomi, Claroty, Dragos, Microsoft Defender for IoT/CyberX).
Collect HMI/EWS host logs and historian access; watch L3.5 DMZ crossings.

CONTROLS / HARDENING#

- Asset inventory first: you cannot defend what you cannot see.
- Segment by Purdue level + IEC 62443 zones; enforce at the DMZ, deny
  pass-through IT<->OT; unidirectional gateways/data diodes where one-way.
- Secure remote access: brokered, MFA, time-boxed, recorded - no flat VPN
  into the OT LAN; kill vendor always-on tunnels.
- Remove internet exposure of HMIs/PLCs/historians entirely.
- Allowlist on engineering workstations; control USB/removable media.
- Patch via the DMZ on the vendor's cycle and maintenance windows;
  compensating controls when patching is impossible.
- Protect safety systems (SIS) hardest: separate, keyed to RUN, alarmed.
- Back up PLC logic/configs offline; test restore; keep spares.
- Have an OT-specific incident response plan (manual fallback, who can
  safely power down, vendor contacts) - IT playbooks do not fit.

GOOD PRACTICE#

- Default to passive: assume any active probe can crash a device.
- Know the process: a "weird" packet may be normal engineering - ask ops.
- One change at a time, with operations in the loop and a rollback.
- Measure safety/availability impact before any security change.
- Coordinate disclosure via the vendor PSIRT and CISA ICS advisories.

REFERENCES (verify against primary sources)#

NIST SP 800-82 Rev 3  Guide to Operational Technology (OT) Security (Sep 2023)
IEC 62443 series      ISA / IEC (webstore; isa.org/isagca)
MITRE ATT&CK for ICS  attack.mitre.org/matrices/ics
CISA ICS              cisa.gov/topics/industrial-control-systems + advisories
Purdue / ISA-95       ISA-95 enterprise-control integration model
ENISA OT/ICS          enisa.europa.eu

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.