Industrial Control System
Industrial Control System (ICS)
•System that monitors and controls industrial processes
•Can be confined to single factory, or span over large geographical area
•Operators overlook and take care of the health and status of the system
ICS Network – Purdue Model
- Developed by International Society of Automation (ISA-99)
- Uses zones to subdivide an ICS network into logical segments
- Used to build a secure ICS environment
Field Devices – Level 0
- Interface between the ICS net work and the process
- Elements directly connected to the manufacturing process
- Comprised of Input and Output Devices:
- Input– Sensors, measuring instruments, etc.
- Output– Switch, valves, etc.
Field Controllers – Level 1
- Located close to the field devices
- Collects and processes I/O data
- Sends process data to HMI
- Different types for different environments
Field Controllers - Programmable Logic Controller (PLC)
- Digital computing device used forautomation
- Used within close-rangeenvironments (e.g. single factory)
- Contains programs used to controlfield device behavior
- Also used by safety instrumentedsystems (SIS)
- Components:
- Power supply
- CPU
- I/O Module(s)
Field Controllers - Remote Terminal Unit (RTU)
- Device controlled by a microprocessor
- Interfaces SCADA Masters to the physical process
- Used in large geographical environments with low bandwidth communication channels (e.g. remote electrical substations)
Field Controllers - Intelligent Electronic Device (IED)
- Microprocessor-based controllers used by the electric sector
- Monitors and controls electrical power devices (e.g. transformers)
- Receives Input data from field sensors and/or power equipment
- Can output commands (e.g. change voltage level)
Supervisory Control – Level 2
- Comprised of multiple devices kept in a central location
* Concerned primarily with supervising, monitoring and controlling the process(es)
Supervisory Control – Level 2
SCADA/DCS Server
- Displays data acquired by the field controllers
- Allows changing/controlling the process
- Graphic visualization of the process
- Provides historical trends and alarm info
- Used to configure and/or program control system applications
- Used for diagnostics and maintenance
Site Operations and Control – Level 3
- Systems responsible for managing control plant operations
- Plant historian
- Production reporting/scheduling systems
- Network file servers
- IT Services
- DNS/DHCP/AD/NTP
- Remote access
Site Business Planning – Level 4
Systems managing business related activities
- Inventory management
- Capacity planning
- E-mail/phone/printing
Component Process Workflow
Field Controllers- operations are monitored by field controllers – sends measurement to HMI
#Field devices– take measurements – then take action based upon those measurements -Example: close a valve
ICS Architectures - SCADA
SCADA– Supervisory Control And Data Acquisition
- Have little control over the process
- Acquire and pass along data needed to make decisions
ICS Architectures - DCS
DCS– Distributed Control System
- Very little control done at central control station
- Most control performed out at the remote I/O controllers
ICS Protocols
Mostly developed before the2000s
- Open-specification
- Proprietary
ICS Protocols
SCADA
- Standardized (open-specification protocols)
- Recognized by all major SCADA vendors
- Examples:
- IEC104
- IEC61850 (MMS & GOOSE)
- DNP3
- Largely proprietary for different vendors
- Examples:
- Siemens– Step 7
- Emerson– Delta and Ovation
- ABB– Symphony Plus
- Honeywell- Experion
What is an Industrial Control System?
A management system for controlling networks that manage factories, utilities,robotic assembly lines, etc.
What is the Purdue model and why is it used?
It is the ISA-99 standard and it logically subdivides an ICS network in order toprovide security.
What types of devices are found in Level 0 of the Purdue model?
Input/Output devices which directly control manufacturing and utility processes.Examples include sensors, measuring instruments, switches, valves, etc.
What types of devices are found in Level 1 of the Purdue model?
Devices that collect data from the input/output devices of Level 0 and send it on to the “HMI”. Comprised of Programmable Logic Controllers (PLCs), Remote Terminal Unites (RTUs), and Intelligent Electronic Devices (IEDs)
What is the function of Purdue Level2?
Supervising, monitoring and controlling the processes which occur at Level 0
What is the lowest Purdue level which should contain traditional IT devices (i.e. fileservers, DNS, DHCP, AD, and NTP)
Layer 2
What is Purdue Level4?
IT personnel uses it for managing business related activities
-
Chapter_1_Introduction to SilentDefense9
-
Chapter_2_SilentDefense Initial Configuration and Concepts5
-
Chapter_3_Visual Analytics – Flow Information5
-
Chapter_4_Asset Inventory4
-
Chapter_5_ICS Patrol Sensor4
-
Chapter_6_Alerts & cases4
-
Chapter_7_Network Logs2
-
Chapter_8_Sensor Built-in Detection Modules3
-
Chapter_9_LAN Communication Profiler (LAN CP)4
-
Chapter_10_Industrial Threat Library(ITL) and SD Scripts2
-
Chapter_11_CVE's and IoC's7
-
Chapter_12_Forwarding4
-
Chapter_13_Housekeeping4
-
Chapter_14_SilentDefense in the Forescout Platform4
-
Appendix: ICS Overview23
