Industrial Network Security

Why control networks need their own security

Office IT protects data: confidentiality comes first. A control network protects a process: availability and safety come first, then integrity, and confidentiality last. An office server can be rebooted on a Sunday; a furnace controller or a water pump cannot. Industrial devices also live for 20 years, are patched rarely, and often speak protocols (Modbus, DF1, older S7) with no security at all. The result is that control networks need extra care, a different order of priorities and different tools.

	Office IT	Control networks (OT)
First priority	Confidentiality	Availability and safety
Patching	Monthly, automatic	Rare, planned, tested, during shutdowns
Lifetime of equipment	3 to 5 years	15 to 30 years
Protocols	TLS, HTTPS, modern authentication	Often plain Modbus, EtherNet/IP, S7, with no encryption
Downtime	Tolerated	Costly or dangerous
Real-time needs	Mostly none	Milliseconds matter; a scan can break a process
Typical error	Data leak	Spoiled batch, equipment damage, injury

Threats and how attacks happen

Most attacks on industrial systems are not exotic. They use a few common routes, mostly open doors that were left unlocked.

Route	How it happens	What stops it
Internet-exposed devices	A PLC, HMI or router with port 502, 44818, 102 or 3389 forwarded to the internet, found by scanners within hours	No direct internet exposure; VPN with multi-factor authentication
Phishing and the office network	Malware arrives by email on an office PC and spreads to the control network through a shared link	Segmentation; a DMZ; no direct office-to-PLC path
Default and weak passwords	Vendor default accounts, shared passwords written on the panel	Unique, strong passwords; disable defaults
Remote access shortcuts	A cellular router, a vendor’s remote tool or a forgotten TeamViewer	One controlled, logged remote-access path
Infected laptops and USB sticks	A contractor’s laptop or a thumb drive connected to the machine network	Clean-laptop policy; port control; scan stations
Unpatched known vulnerabilities	A published flaw in a controller or a Windows PC	Patch plan; virtual patching with a firewall
Insiders and mistakes	A wrong download, a wrong IP, a forgotten force	Access control, change control, backups
Supply chain	Compromised software or a vendor’s remote-support account	Vendor access rules; verify updates
Protocol weaknesses	Anyone on the network can read and write Modbus or CIP without authentication	Segmentation, allow lists, secure protocol variants

Defense in depth

No single measure is enough. Defense in depth stacks several, so that one failure does not give the attacker the whole plant: policy and people, the perimeter, the network, the devices, the applications and the data.

Layer	Measures
Policy and people	Written rules, training, who may connect what, vendor access procedures, an incident plan
Physical	Locked panels and rooms, cabinet door switches, disabled unused ports, port locks
Perimeter	Firewalls between plant, DMZ and enterprise; no direct internet
Network	Segmentation, VLANs, access control lists, managed switches, port security
Devices	Hardening, passwords, disabled services, firmware updates, program protection
Applications and data	Role-based access, signed projects, change control, backups
Monitoring	Logs, passive network monitoring, alerts

Zones, conduits and the Purdue model

The Purdue model arranges a plant in levels from the process (level 0) to the enterprise (levels 4 and 5), and IEC 62443 turns that into zones (groups of assets with the same security needs) joined by conduits (the controlled communication paths between zones). The aim is that traffic crosses a zone boundary only where a rule allows it, and the enterprise reaches the plant only through a DMZ.

Level	What lives there	Boundary rule
5 and 4: enterprise	ERP, email, internet access	No direct path into the plant
3.5: DMZ	Historian mirror, patch and antivirus servers, remote-access jump host	Both sides connect to it; neither connects through it directly
3: site operations	MES, historian, engineering workstations	Only the services that supervisory systems need
2: supervisory	SCADA, HMI servers	Allow the protocols to the PLCs (and no more)
1: control	PLCs, drives, remote I/O	Only from the supervisory and engineering addresses that need them
0: process	Sensors, actuators, safety devices	Safety systems on separate networks or fully independent

Segmentation and firewall rules

The simplest strong measure is to divide the network into small zones and write down who may talk to whom. A firewall (or a managed switch with access lists) between zones then allows exactly that, and nothing else: a “default deny” policy.

#	From	To	Protocol and port	Action	Reason
1	SCADA 10.20.30.10	PLC 192.168.10.10	EtherNet/IP: TCP 44818, UDP 2222	Allow	Tag reads and writes
2	Historian 10.20.30.20	PLC 192.168.10.10	Modbus TCP: TCP 502 (read functions only if the firewall can inspect)	Allow	Data collection
3	Engineering PC 10.20.40.5	PLC 192.168.10.10	TCP 44818, 102 or the vendor’s port	Allow, logged	Programming and diagnostics
4	PLC 192.168.10.10	NTP server 10.20.30.1	UDP 123	Allow	Time
5	Machine network	Internet	Any	Deny	No direct internet from the machine
6	Enterprise network	Machine network	Any	Deny	Only through the DMZ
7	Any	Any	Any	Deny and log	Default deny

• Allow lists, not block lists. List what is needed; everything else is denied.
• Rules by address and port, not “any”.
• Log denied traffic. A blocked connection attempt is often the first sign of a problem or a forgotten dependency.
• Review the rules. A firewall with 300 rules nobody understands is a risk; remove the old ones.
• Industrial firewalls (deep packet inspection of Modbus, CIP, S7) can allow only certain function codes or tags and block writes from a read-only client.
• Test before enforcing. Run in log-only mode first and watch the real traffic, so that the rules do not stop the machine.
• Unidirectional gateways (data diodes) allow data out of a critical network with no path back: used in the most sensitive plants.

Secure remote access

Practice	Why
One approved path	Every other route (cellular routers, vendor tools) is a hole
Multi-factor authentication	A stolen password alone is not enough
Individual accounts, not shared ones	You can see who did what, and remove one person at a time
A jump host in the DMZ	Remote users never reach the machine network directly; the jump host is monitored and hardened
Time-limited access, approved for each job	Access exists only while it is needed
Allow only the ports and addresses the job needs	Limits what a compromised remote PC can reach
Session recording and logs	Evidence and accountability
Vendor access agreements	Rules for outside engineers, including their laptops
Never expose a PLC or HMI port to the internet	Scanners find open Modbus, EtherNet/IP and S7 ports within hours

Hardening devices

Step	Detail
Change every default password	On PLCs, HMIs, drives, switches, cameras, routers and web interfaces
Turn off services you do not use	Web server, FTP, Telnet, SNMPv1/2, discovery protocols, unused protocol ports
Disable unused physical ports	Switch ports and USB
Enable the controller’s protection	PLC project password, know-how protection, access levels, secure communication (Siemens access protection levels, Rockwell FactoryTalk Security and CIP Security, Omron and Mitsubishi security keys)
Use the key switch or mode switch	Keep the controller in RUN when not being programmed
Keep firmware current	Read the manufacturer’s security advisories; test updates before installing
Secure the PCs	Patched operating system, antivirus or application allow-listing, no email or web browsing on engineering and SCADA PCs, disk encryption on laptops
Set time	NTP everywhere so that logs line up
Remove test and temporary equipment	Taps, jumpers, sniffers and temporary firewall rules

Passwords and accounts

A password protects only as well as it resists guessing. The number of possibilities grows by a factor of 95 (the number of printable characters) with each extra character, so length matters more than complexity rules.

• Individual accounts and roles (operator, maintenance, engineer, administrator) with only the rights each needs.
• No shared accounts for people; service accounts only for software, with long random passwords.
• Remove accounts when people leave or contracts end.
• Break-glass access: a sealed, logged emergency account.
• Multi-factor authentication on every remote and administrative login where the system allows.
• Record the controller passwords in a secure place: a lost PLC password can mean the program must be rewritten.

Security of each protocol

Protocol	Built-in security	What to do
Modbus RTU / TCP	None	Segmentation, allow lists; Modbus/TCP Security (TLS, port 802) if both ends support it
EtherNet/IP and CIP	CIP Security (TLS, certificates, user authentication) on newer devices	Enable CIP Security where supported; otherwise segmentation
PROFINET	Security classes (authenticated devices, secure start of communication) in newer specifications	Use segmentation; use security class where devices support it
S7 communication	Access protection levels and a connection password; TLS for S7-1500	Protect the CPU; disable PUT/GET when not needed; use TLS
Omron FINS, Mitsubishi MC protocol	Mostly none	Segmentation; restrict which addresses may connect
OPC UA	Built in: certificates, signing, encryption, user authentication	Sign and Encrypt; no Anonymous; manage certificates
MQTT	TLS and authentication if configured	Port 8883, client certificates or strong credentials, topic ACLs
HTTP, Telnet, FTP, SNMPv1/2	None	Use HTTPS, SSH, SFTP and SNMPv3, or disable
PROFIBUS, DeviceNet, CAN	None	Physical security; keep them inside the machine

Wireless, USB and removable media

• Wi-Fi on the machine network: WPA3 or WPA2-Enterprise, a separate VLAN, no guest access, a rogue access point scan.
• Cellular and radio links: private APNs or VPNs; change default passwords on routers; avoid port forwards.
• Bluetooth and NFC service ports on drives and sensors: disable if not used.
• USB sticks: a major route for malware. Scan them at a station before connecting; use a dedicated, labeled stick for the machine.
• Laptops: a contractor’s laptop is the same risk as a stick. Use a clean laptop policy or a scanning station before connecting to the machine network.
• Engineering software licenses and dongles belong in a secured place.

Monitoring, logging and backup

Measure	What it gives you
Logs	Firewall, switch, PC and PLC logs, sent to one place (a syslog server) with synchronized time
Passive network monitoring	A tool on a mirror port learns the normal conversations and alerts on new devices, new connections or new commands, without sending anything onto the network
Asset inventory	A list of every device, firmware version and owner; you cannot protect what you do not know you have
Configuration backups	PLC programs, HMI projects, drive parameters, switch and firewall configurations, stored off the machine and tested
Change management	Every change recorded: who, what, when, why; compare online and offline versions to find unauthorized changes
Recovery plan	How to restore from backups and bring a line back up; practiced, not only written

IEC 62443 in practice

IEC 62443 is the family of standards for industrial automation and control system security. It covers the owner’s program, the integrator’s work, the system design and the product’s development, and defines how secure a zone must be.

Part	Subject	Who uses it
62443-2-1	Security management system for the asset owner	Plant owners
62443-2-4	Security program requirements for service providers (integrators, maintenance)	System integrators and machine builders
62443-3-2	Security risk assessment and system design: zones and conduits	Owners and integrators
62443-3-3	System security requirements and security levels	Integrators, owners
62443-4-1	Secure product development lifecycle	Product makers
62443-4-2	Technical security requirements for components	Product makers, buyers

Security level	Protects against	Typical example
SL 1	Casual or accidental violation	Mistakes, curious staff
SL 2	Intentional violation with simple means, low resources, generic skills	A casual attacker
SL 3	Intentional violation with sophisticated means, moderate resources, system-specific skills	Targeted criminals
SL 4	Intentional violation with sophisticated means, extended resources, system-specific skills	State-level actors

The practical use: ask suppliers whether their products are certified or developed to 62443-4-1 and -4-2, and describe the target level for each zone in the project specification.

When something goes wrong

• 1. Keep the process safe. Switch to manual or a safe state first; production second.
• 2. Contain. Disconnect the affected zone at the firewall or switch, not by turning off devices (which destroys evidence and may trip the process).
• 3. Preserve evidence. Keep the logs, take images of infected PCs, note the times.
• 4. Call the right people: the plant manager, the IT security team, the supplier, and where required the authorities.
• 5. Restore from known-good backups, check the controller programs against the saved copies, and change the passwords.
• 6. Find out how it happened and fix the cause; record the lessons.
• Practice with a tabletop exercise: a plan that has never been tried does not work when it is needed.

A machine-builder checklist

Item	Done when
Network design	A diagram with zones, addresses and the rules between them
Remote access	One documented path; no hidden cellular router; the customer’s approval
Defaults	Every default password changed; the new ones handed over securely
Services	Unused protocols, web pages and ports disabled
Firewall rules	Allow list reviewed; default deny
Program protection	Controller passwords set; mode switch in RUN
Backups	All programs, parameters and switch configs saved, tested, handed over
Documentation	Address and port list, account list, firmware versions, patch policy
Training	The customer knows the rules and the incident plan

Related

• Industrial Communication: the overview of this guide.
• IP Addressing, Subnets and VLANs: addresses, VLANs and ports that the firewall rules name.
• OPC UA, MQTT and Industrial IoT: OPC UA and MQTT security.
• Industrial Ethernet: EtherNet/IP, PROFINET and EtherCAT: managed-switch features used for segmentation.
• System Integration and PLC Troubleshooting, Safety and Documentation.

FAQ

Is a firewall enough?

No. A firewall is one layer. It does nothing about an infected laptop on the inside, a default password or an unpatched device. Use layers: segmentation, hardened devices, strong accounts, monitoring and backups.

Can I just put the machine on a separate network and call it secure?

It is a good start, and it removes most attacks from the office. But the machine still has a service laptop, USB sticks, a remote-access path and vendor connections. Secure those too.

Do I need to patch a PLC?

Read the manufacturer’s security advisories. Patch when a flaw is exploitable in your setting, after testing, during planned downtime. Where you cannot patch, reduce the exposure with segmentation and allow lists (virtual patching).

Is NAT a security measure?

No. NAT hides addresses but does not block connections from the inside or from an attacker who is already in. It is a convenience for address reuse; the firewall rules provide the security.

Who is responsible, the builder or the owner?

Both: the builder delivers a secure product and documentation (62443-4 and 2-4); the owner operates a security program (62443-2-1). Agree this in the contract.

Where do I start?

Draw the network, list the devices, close the internet exposure, change the default passwords and take backups. These four steps remove most of the risk.

References

• IEC 62443 series, Security for industrial automation and control systems, especially 62443-2-1, 2-4, 3-2, 3-3, 4-1 and 4-2.
• NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security.
• CISA, Recommended Practices for Improving Industrial Control System Cybersecurity and Defense-in-Depth Strategies (cisa.gov/ics).
• Rockwell Automation and Cisco, Converged Plantwide Ethernet (CPwE) Design and Implementation Guide; Siemens, Operational Guidelines for Industrial Security.
• ODVA, CIP Security; OPC Foundation, OPC UA Security; Modbus Organization, MODBUS/TCP Security Protocol Specification.
• Purdue Enterprise Reference Architecture (PERA), as used in ISA-95.

Last reviewed: October 2026. Speeds, lengths, node counts and menu names are typical: confirm against the specification and the manufacturer’s documentation for the devices you use. This page gives general guidance and is not a substitute for a security assessment of your site by qualified people.