OT and ICS trust¶

Operational technology was built on the assumption that the network is a safe room. Controllers, sensors and safety logic talk over protocols that ask for no proof of identity, because for decades the wire sat inside a fence and the only things on it were meant to be there. That assumption is the trust, and everything honours it: a programmable logic controller obeys a command that reaches it, an engineering workstation is allowed to rewrite the logic a controller runs, and a historian bridging the plant to the office answers to both sides at once. None of it breaks when an attacker uses it. The controller does what it was told, by whoever was in a position to tell it.

The protocols trust the wire¶

IEC 60870-5-104, IEC 61850 GOOSE, PROFINET and Modbus leave the sender unauthenticated by default. A GOOSE frame is a plaintext layer-2 multicast; anyone on the segment can publish one, and a subscribing relay acts on the highest state number it sees, so a spoofed frame carrying an inflated counter is honoured over the genuine one. An IEC 104 control command executes because it arrived on the right port and followed the select-before-operate dance, not because the controller has any way to know who sent it. IEC 62351 exists to add authentication and encryption to these stacks, but it is rarely deployed, and where it is absent a command on the wire is a command obeyed.

The engineering workstation is the master key¶

A controller trusts one machine absolutely: the engineering workstation that programs it. The trust is deliberate, since somebody has to download logic, change setpoints and force outputs. Compromise the workstation and the same channel that commissions the plant reprograms it. Stuxnet reached Siemens S7 controllers through the Step7 engineering software rather than the controllers directly, and TRITON reached a Schneider Triconex safety controller through its engineering interface. The way in, in both cases, was a channel the controller already trusted, not a break in the protocols it speaks. Stuxnet used that channel to load malicious ladder logic onto the Siemens PLC; TRITON, to plant an implant in the Triconex safety controller’s memory.

The boundary that is assumed, not enforced¶

The Purdue model draws clean trust zones with a demilitarised zone between plant and office, and the plant rarely matches the drawing. A historian that collects process data for business reporting is dual-homed by definition, trusted by the control network to read from it and by the corporate network to serve it, so a foothold on one side inherits a path to the other. Data diodes specified as one-way are quietly paired with a return channel for acknowledgements. A flat, unsegmented plant network is common enough that the boundary is often a diagram rather than a control.

Standing trust in a third party¶

Integrators and equipment vendors keep maintenance access into plants they built, often as an always-on connection through a jump host, sometimes a cellular router nobody in operations remembers is there. That access is a trust relationship with an outside party, and the outside party’s security becomes the plant’s. A supplier breached upstream is a path into every plant that honours its remote-support connection, which is what makes industrial-control-system supply chains worth more to an attacker than any single site.

The safety system’s independence¶

A safety instrumented system is meant to be the last line, independent of the basic process control it watches. That independence is itself a trust boundary: the safety controller trusts its own engineering tool and little else. TRITON showed what happens when the tool is reachable from a compromised control network. The safety controller honoured a firmware change from what looked like its legitimate programmer, and the only thing between the attacker and a plant with its protection disabled was the same interface the plant relied on to keep that protection working.

Bought, run and kept this way¶

None of this is an oversight waiting to be corrected. A plant is engineered to run for twenty or thirty years, and the controllers commissioned at the start are expected to see it out, so protocols designed before authentication was a concern stay in service long after. Availability outranks confidentiality and integrity in a control system, so a change that risks a stoppage is resisted harder than one that risks a breach. Patching wants a maintenance window a continuous process can rarely spare. IEC 62351 has existed for years and runs in a small fraction of the plants that could use it. The trust is not a fault in the equipment; it is a property of how the equipment is bought, run and kept.

The packet is honest¶

Passive monitoring can read OT protocols off a span port and flag a command no operator issued, and a well-baselined plant with stable, repetitive traffic is a fair place to catch an anomaly. The difficulty is that the same flat trust that lets an attacker in leaves the monitor little to check against: a forged command is well-formed, arrives on the right wire, and looks exactly like a real one, because the protocol never carried anything that would tell one from the other. Detection that works watches behaviour and process state, an unexpected setpoint or a safety function that changed, rather than the packet, which is honest by construction.

The devices, protocols and network layout belong to the OT grounds. The edges, what in a plant is trusted to instruct what, are where a foothold turns into control.