How an industrial plant gets attacked: the leap from IT to the metal, explained with a machine

By Kike Gandia · Hardware & OT · 12 min read

Illustration on a midnight-blue background: a tower with the levels of the Purdue model and a bus with an orange DMZ gate down which a red packet travels, connected to a tank with a liquid level, a red high-level mark, a motorized valve and an overflow

A wastewater treatment plant, a bottling line, an electrical substation or a hospital's HVAC system all have one thing in common: underneath the software there is metal that moves. Pumps, valves, motors, boilers. And controlling it is a layer of technology (we call it OT, operational technology, as opposed to office IT) that lived in isolation for decades and today is almost always connected.

That connection is what brings the risk, and it's also the reason industrial security can't be treated like office security. What matters here is not that nobody steals your data: it's that the plant keeps running and nobody gets hurt. This guide explains it with a machine you can look inside, piece by piece.

Availability: the priority in OT (ahead of confidentiality)
No auth: legacy Modbus, S7comm, DNP3 (whoever reaches the bus is in charge)
Purdue: the plant mapped in levels (0 process … 4 IT, with a DMZ)

The machine: a level-control plant

The figure shows one of the simplest plants there is: a tank that has to be kept at a set level. On the right is the physical process (level 0): the tank with its sight glass and its HIGH and LOW marks, a pump that fills it through a motorized valve, an overflow and a safety interlock (SIS) box. On the left, the control tower: five stacked boxes that are the levels of the Purdue model (the PLC that regulates the valve, the HMI it's operated from, the operations layer, the industrial DMZ and, at the top, the IT network), linked by a bus with a gate at the DMZ.

Pick a scenario and watch what moves: how an attacker's pulse travels down the bus, how the liquid rises in the sight glass, when the valve gets stuck open and when the safety system trips.

Interactive "level-control plant" figure. On the right, a tank (level 0 of the Purdue model) with a sight glass and HIGH and LOW marks, a motorized inlet valve, a pump, an overflow with a drip tray and a safety interlock (SIS) box. On the left, a tower of five boxes (PLC (level 1), HMI (2), operations (3), industrial DMZ (3.5) and IT (4)) linked by a bus with a gate at the DMZ. The PLC drives the valve over a field cable; the SIS cuts the pump over its own cable, independent of the PLC. Four scenarios: process under control (the PLC modulates the valve and the level holds at the setpoint); an IT scan that floods the fieldbus, hangs the PLC, leaves the valve open and makes the tank overflow; from IT to the metal (on a flat network, the attacker moves down the bus level by level to the PLC and, since the bus doesn't authenticate, opens the valve and causes the overflow); and zones and safe shutdown (the DMZ gate stops the pulse and, even if the level did rise, the hardwired interlock cuts the pump independently, so the liquid stays at the high mark without overflowing).

Why an IT scan can stop a plant

In IT, running a port scan to see what's on the network is routine and breaks nothing. In OT, that same scan hits devices designed to talk only to their peers, on small, predictable networks. Many PLCs are ten- or fifteen-year-old hardware with little memory and a fragile network stack: an aggressive sweep overwhelms them, they stop refreshing their outputs and the plant goes dark or, worse, is left with the last command frozen in place.

The priorities are inverted. In IT the order is usually confidentiality, integrity, availability. In OT it's the other way around: physical safety and availability first, then integrity, and confidentiality last. That's why the tools and the aggressiveness of an IT pentest aren't used as-is in a plant.

The practical consequence: you don't brute-force scan an OT environment. You use passive discovery (listening to traffic without injecting anything), agreed tests on replicas or mock-ups, and negotiated downtime windows. The second scenario in the figure shows exactly this: a scan doesn't have to be malicious to cause a disaster.

The Purdue model and why the bus doesn't authenticate

The tower in the figure is the Purdue model, the standard way of organizing a plant into levels, from the physical process (level 0) up to corporate IT (levels 4 and 5). Between OT and IT sits a special level, 3.5, the industrial DMZ: the only door through which data should cross between the two worlds.

Level	What's there	Example in the figure
0	Physical process: sensors and actuators	The tank, the sight glass, the valve and the pump
1	Basic control: PLC, RTU	The PLC box, which modulates the valve
2	Supervision: SCADA and HMI	The HMI box, where it's operated from
3	Plant operations: historian, MES	The operations box
3.5	Industrial DMZ	The gate on the bus: the only IT↔OT crossing
4-5	Corporate IT and enterprise	The IT box, right at the top

The underlying problem lies in the bus that connects everything: legacy industrial protocols (Modbus/TCP on port 502, the S7comm of older Siemens equipment, DNP3 without its security extensions) were designed for isolated networks and travel without authentication or encryption. They can't tell who is issuing a command. Reading a value and writing a new one cost the same. So the rule in OT is brutally simple: whoever reaches the bus is in charge. That's why the third scenario, on a flat network with no separation between IT and OT, takes the attacker from an email in the office to opening a valve, without ever setting foot in the plant.

Blocking port 502 from the internet is step one, not a security strategy.— Common practice in Modbus network security

The defenses that actually stop an attacker

The good news is that the defenses that work don't depend on patching every old PLC (many of them can't be touched) but on how the plant is built. They come in two layers that don't depend on each other, and the fourth scenario in the figure shows them together.

Zones Segment IT and OT: The Purdue model and the IEC 62443 standard organize the plant into zones linked by controlled conduits. Between IT and OT there is a single DMZ that terminates, authenticates, filters and logs everything. Without that single crossing, any compromised office PC can reach the process.
SIS Independent safe shutdown: The safety interlock (Safety Instrumented System) is a separate, hardwired system that detects a dangerous condition and acts on its own. It cuts the pump even if the PLC is compromised. It was precisely the target of the Triton malware in 2017.
Passive Visibility without touching: Before you can protect anything you need to know what's there. In OT that's done by listening to traffic (passive discovery), not by scanning. An inventory of assets and of normal conversations is the foundation of all detection.
Access Remote access through a single point: Remote maintenance comes in through a single jump host in the DMZ, authenticated and logged, never through a VNC or TeamViewer hanging directly off the PLC. Vendor access is one of the first things we look at.

The idea tying all four together is the same one the figure repeats in every scenario: the point isn't that nothing ever goes wrong, but that when the attacker does get in, they have nowhere to go and physical safety doesn't depend on the system they've compromised.

How to assess a plant without breaking it

1 — Understand the process first
What the plant does, what can go physically wrong and which shutdowns are acceptable. Security starts with the process risk analysis, not with the scanner.
2 — Passive inventory
Listen to the traffic to find out which devices are there, who they talk to and over which protocols, without injecting anything.
3 — Review the architecture
Where the IT/OT boundary is, whether there's a real DMZ, how remote maintenance gets in and what happens if a segment goes down. The Purdue model as the map.
4 — Active, agreed and scoped testing
On replicas, mock-ups or during downtime windows, never blindly against production. What is routine in IT is negotiated in OT.
5 — Verify the safety layers
That segmentation holds and that the SIS acts independently of the control system. Those are the two that save the plant.

If you want the detail on why the methodology differs so much from a classic pentest, we cover it in OT/ICS security: why IT pentesting isn't enough. And if you're interested in the very bottom layer (how the hardware of these devices is itself analyzed and attacked), there's our Hardware Analysis series, from the forgotten interfaces in the silicon all the way to JTAG. To assess your plant sensibly, let's talk: it's part of what we do in pentesting.

Topics

#OT #ICS #SCADA #PLC #Modbus #Purdue-model #IEC-62443 #Industrial-security #SIS #Segmentation

Keep reading

Sources

Talk to us about your plant's security