ICS/OT Security: Connecting OT And IT Networks The Right Way

Industrial Control Systems (ICS) and Operational Technology (OT) security is critical for protecting critical infrastructure. This article breaks down the Purdue Model for ICS/OT security, using an “Oil Pumping Station” as a case study to illustrate network segmentation and security best practices.

Purdue Model Explained

The Purdue Model divides ICS/OT networks into hierarchical levels:

Level 1️⃣: Field Devices & PLCs
Sensors, actuators, and Programmable Logic Controllers (PLCs).
Example command (Linux): `modbus-cli read –ip=192.168.1.10 –register=40001` (Modbus communication test).
Level 2️⃣: Network Switches
Manages communication between field devices and control systems.
Example command: `tcpdump -i eth0 -n port 502` (Monitor Modbus traffic).
Level 3️⃣: SCADA & Control Stations
Supervisory Control and Data Acquisition (SCADA), Historians, and Operator Workstations.
Example command: `wireshark -k -i eth0 -Y “modbus”` (Analyze SCADA traffic).
DMZ 🔥: Firewalls & Security Rules
Isolates OT from IT networks with strict firewall policies.

Example iptables rule:

iptables -A INPUT -p tcp --dport 502 -s 192.168.1.0/24 -j ACCEPT 
iptables -A INPUT -p tcp --dport 502 -j DROP

Physical vs. Logical Network Diagrams

Physical Diagram: Shows hardware (switches, cables, devices).
Logical Diagram: Displays data flow (VLANs, protocols like Modbus, DNP3).

OT-to-IT Flow & SIEM Integration

Use OT SIEM (Security Information and Event Management) for anomaly detection.
Example: `zeek -i eth0` (Network monitoring for OT protocols).

You Should Know:

Critical Commands for OT Security:

nmap -sU -p 161,162 192.168.1.0/24  Scan for SNMP devices 
snmpwalk -v2c -c public 192.168.1.10  Check SNMP misconfigurations

Windows OT Security:

Get-NetTCPConnection -State Established | Where-Object {$_.RemotePort -eq 502}

What Undercode Say:

Securing ICS/OT networks requires strict segmentation, protocol monitoring, and SIEM integration. The Purdue Model ensures structured defense, while tools like Wireshark, Zeek, and Modbus-cli help in real-time analysis. Always enforce firewall rules and disable unnecessary services in OT environments.