Module 3 · Industrial Control Protocols 🔒

Industrial Control Systems (ICS) speak protocols designed in the 1970s-90s when the network was assumed isolated. Many of those protocols are now exposed to IP networks — and they were never designed with authentication, encryption, or integrity in mind. This module covers the major ICS protocols, what they expose, and the patterns of attack and defense.

The protocols that matter

• Modbus (TCP / RTU) — most common ICS protocol; simple register-read/write. No auth, no encryption
• DNP3 — used heavily in electric utilities, water; some authenticated extensions exist (Secure Authentication v5) but rarely deployed
• OPC-UA — modern, designed with security; certificates, signed messages, encryption. Widely adopted in new installations
• OPC Classic (DA, HDA, A&E) — older OPC; built on DCOM; no native security
• S7Comm / S7CommPlus — Siemens SIMATIC PLCs; widely used in manufacturing
• EtherNet/IP (CIP) — Allen-Bradley / Rockwell PLCs; widely used in North America
• Profinet — Siemens; deterministic real-time on Ethernet
• BACnet — building automation (HVAC, lighting); often internet-exposed
• IEC 60870-5-104 — power utilities, SCADA telemetry
• IEC 61850 (MMS, GOOSE, SV) — substation automation

Modbus — the demonstration target

Modbus TCP runs on port 502. A request specifies a function code (read holding register, write coil, etc.), a register address, and data. No authentication. No encryption. Anyone with network access can read or write any register.

# Reading registers from a Modbus TCP device
python3 -c "
from pymodbus.client import ModbusTcpClient
c = ModbusTcpClient('192.168.1.50', port=502)
c.connect()
result = c.read_holding_registers(0, 10, slave=1)
print(result.registers)
c.close()
"

# Writing a register (could change a setpoint, open a valve, etc.)
# DO NOT RUN IN PRODUCTION WITHOUT AUTHORIZATION

If a Modbus device is exposed to the internet (and Shodan finds tens of thousands), anyone can interact with it. This is why segmentation matters.

OPC-UA — the modern standard

OPC-UA done right has: