Industrial Control Systems

Key Control Areas

When to Use

Any commercial or government organisation operating industrial automation equipment should implement this pattern. Typical applications include process control for production lines, energy generation and distribution (power plants, substations, smart grid), oil and gas (upstream, midstream, downstream), water and wastewater treatment, transportation infrastructure (rail signalling, traffic management, aviation), manufacturing, healthcare (building management, medical gas systems), shipping and port operations, mining, and emergency services. This pattern should apply in the majority of cases given the cost of securing versus the cost of equipment and the impact from process downtime or safety incidents. Regulatory drivers include NERC CIP for energy, TSA Security Directives for pipeline operations, NIS2 Directive for essential services in Europe, and sector-specific regulations for nuclear, water, and chemical facilities.

When NOT to Use

This pattern may be inappropriate where the automated process has genuinely low impact if it operates outside specified tolerance levels, there are very low availability requirements, and there is verified certainty that the system is isolated with strong logical and physical access controls. First-generation panel-based equipment with no network connectivity and no use of commercial off-the-shelf software typically falls outside the scope of this pattern. However, the threshold for applying this pattern should be low -- even seemingly low-impact processes may have upstream or downstream dependencies that amplify the consequences of compromise, and air-gapped claims should be rigorously verified as true isolation is increasingly rare.

Typical Challenges

The most persistent challenge is the shortage of personnel with expertise spanning both cybersecurity and OT engineering -- ICS security requires understanding of industrial protocols, process safety, control theory, and cybersecurity principles simultaneously. Legacy ICS equipment often runs end-of-life operating systems (Windows XP, Windows Server 2003) and proprietary firmware that cannot be patched or upgraded without replacing hardware, creating permanent vulnerability exposure that must be mitigated through compensating controls. It can be difficult to distinguish system failures from behaviour under attack, making baseline behaviour profiling essential -- organisations must invest in OT network monitoring tools that can establish normal traffic patterns and alert on deviations. Vendor dependency is significant: many ICS components have restrictive licensing that prohibits installing third-party security software or modifying system configurations, and patching often requires vendor certification that lags months behind vulnerability disclosure. The cultural divide between IT and OT teams creates organisational friction -- OT engineers may view cybersecurity controls as threats to system availability, while IT security teams may not understand the safety implications of their recommended controls. Budget justification is challenging because ICS security investments protect against low-frequency, high-impact events where the return on investment is difficult to quantify until an incident occurs.

Threat Resistance

This pattern addresses threats specific to the ICS/OT domain. Malicious code targeting industrial systems, including Stuxnet-class attacks that manipulate controller logic while displaying normal values to operators, and ransomware variants like EKANS/Snake specifically designed to kill ICS processes before encrypting systems. Compromise of process integrity through manipulation of setpoints, safety system bypasses, or injection of rogue commands via industrial protocols. Denial of service attacks against control networks that disrupt real-time process control communications. Man-in-the-middle attacks on unencrypted industrial protocols (Modbus TCP, DNP3) allowing command injection or telemetry manipulation. Insider threats from employees or third-party maintenance personnel with physical access to control equipment. Supply chain compromise through tampered firmware updates, counterfeit components, or compromised vendor remote access. Unauthorised wireless access through rogue access points deployed within the OT network perimeter. Reconnaissance and lateral movement from compromised IT networks into OT zones through inadequately segmented network architectures.

Assumptions

The organisation operates industrial automation equipment that uses standard networking technologies (TCP/IP over Ethernet) and has some degree of connectivity to the corporate IT network for management information and remote monitoring. Attacks on ICS enable real-world physical actions and are increasingly used by state-sponsored actors, criminal groups, and hacktivists to impact critical infrastructure. The knowledge and tools to attack ICS are becoming commoditised, with frameworks like Metasploit including ICS-specific modules. Financial motives for ICS attacks are growing due to the potential for extortion against high-value industrial processes. Management and monitoring of OT systems is increasingly provided by third-party vendors who supply equipment and supporting services, introducing additional supply chain risk.

Developing Areas

• State-sponsored pre-positioning in critical infrastructure OT networks represents the most significant strategic threat to ICS environments. Groups like Volt Typhoon have been documented maintaining persistent access to US critical infrastructure for years without conducting disruptive operations, positioning for potential activation during geopolitical conflict. Detecting this activity is extraordinarily difficult because the adversaries deliberately use living-off-the-land techniques that blend with normal administrative operations, and most OT environments lack the behavioural baseline monitoring needed to identify subtle anomalies over extended timeframes.
• IT/OT convergence security is accelerating as industrial organisations adopt cloud-connected IoT sensors, edge computing, and digital twin technologies, but the security architecture for converged environments remains immature. Traditional Purdue model segmentation assumes clear boundaries between IT and OT zones, yet modern IIoT deployments create data flows that bypass these boundaries entirely -- sensor data streaming directly to cloud analytics platforms, remote maintenance via vendor cloud portals, and AI-driven process optimisation that requires bidirectional communication. Emerging reference architectures from ISA/IEC 62443 and NIST are adapting but lagging behind deployment reality.
• OT asset visibility and inventory remains a fundamental gap in most industrial environments. Surveys consistently find that organisations are unaware of 20-40% of the devices connected to their OT networks, including legacy PLCs, unmanaged switches, and vendor-installed remote access devices. Passive network discovery tools have improved significantly, but many ICS protocols do not support passive identification, and active scanning of production OT networks remains risky due to the fragility of legacy controllers.
• ICS-specific detection and response capabilities are maturing rapidly but still require specialised expertise that is in critically short supply. Fewer than 5,000 professionals globally hold both OT engineering and cybersecurity qualifications sufficient to perform ICS incident response. Tools like Dragos and Claroty provide OT-aware detection, but interpreting alerts in the context of physical process behaviour requires domain knowledge that cannot be automated, and the consequence of a wrong containment decision in OT can be physical damage or safety incidents.
• Remote OT access security has become a permanent architectural concern since the pandemic normalised remote maintenance of industrial systems. Vendor remote access to PLCs and DCS systems, which was previously tightly controlled through on-site visits, is now routinely provided via cloud-based remote access platforms with varying security postures. Standardised approaches to secure remote OT access -- including jump server architectures, session recording, just-in-time access provisioning, and MFA for industrial remote sessions -- are emerging but adoption is inconsistent, particularly among smaller equipment vendors.

Related Patterns

Patterns that operate within or alongside this one. Click any to view.