backup: 2026-10-11 00:08

ot-ics-security-rampglossary.org

@@ -58,12 +58,23 @@ Running, quiz-ready glossary built up during Aner's cybersecurity terminology ra
 - Level 3.5 / DMZ — the firewalled buffer zone mediating any traffic between OT (Levels 0-3) and IT (Levels 4-5); the main real-world security boundary in practice.
 - Air-gapped — historically meant zero physical connectivity between OT and IT; in practice today almost nothing is truly air-gapped, so security work focuses on controlling the Level 3.5 boundary instead.
 - Passive monitoring — watching a copy of network traffic (via a tap/span port) rather than actively scanning/injecting packets, because active scans can crash fragile field devices never built to handle unexpected input.
-- Modbus — the oldest/most universal ICS protocol (1979); plaintext, no authentication; the canonical example of "ICS protocols have no security by design."
-- DNP3 (Distributed Network Protocol) — dominant protocol for North American electric/water utility master-station-to-RTU communication; has an optional auth extension (DNP3-SA) rarely enabled in practice.
+- SNMP (Simple Network Management Protocol) — general network-device management protocol (not ICS-native, but ubiquitous on the network infrastructure — switches, routers, firewalls, UPSs — surrounding OT, and sometimes on OT devices themselves). Manager/agent model: manager polls or configures an agent via GET/SET; agents can also proactively push a TRAP (e.g. "interface down") without being polled. UDP 161 (agent)/162 (trap). v1/v2c auth is a single plaintext "community string" sent in every request and directly comparable to a password check — no real security, and a successful GET/SET with the default `public`/`private` string can both enumerate a full device inventory and alter live configuration. SNMPv3 adds real user-based authentication and optional encryption, but — same brownfield pattern as DNP3-SA/Modbus Security — is often left disabled. See [[ot-ics-security-ramp/reading-list]] for the NSA/CISA SNMP abuse advisory, including the Russian FSB Center 16 campaign that exfiltrated critical-infrastructure router configs via SNMP.
+- MIB (Management Information Base) / OID (Object Identifier) — SNMP's data model: a standardized hierarchical tree (defined in ASN.1/SMI) of every manageable variable a device exposes, addressed by an OID (a dotted numeric path from root to leaf, e.g. `1.3.6.1.2.1.1.1.0` = sysDescr). MIB-II is the standard baseline branch nearly every SNMP device implements (interfaces, uptime, routing table); vendors extend into a reserved private-enterprise branch (`1.3.6.1.4.1.<vendor>...`) for proprietary variables. A "MIB walk" (enumerating every OID under a branch) is why read-only SNMP alone is a reconnaissance goldmine — one walk against MIB-II returns a device's full interface/routing/system inventory with no vendor-specific knowledge required. Mechanically, a walk isn't "ask the root for its children" — SNMP has no such operation. It's iterative: `GetNextRequest` returns the next OID in strict lexicographic order after the one you supply, so a walk loops GetNext → take the returned OID → GetNext again, until the result falls outside the starting branch (`GetBulkRequest` in v2c/v3 batches several "next" steps per round trip instead of one at a time). Every call still requires valid auth (community string in v1/v2c) — a walk succeeding against weak/default credentials isn't an auth bypass, it's auth trivially satisfied. A device's MIB only describes *itself* (its own interfaces/CPU/routing table), not devices it merely forwards traffic for — except via neighbor-discovery branches like Cisco's CDP-MIB or the vendor-neutral LLDP-MIB, which let a device report what's directly connected to each of its own ports, the closest SNMP gets to mapping adjacent devices one hop at a time.
+- ACL (Access Control List) — a rule set on a device/network boundary (router, switch, firewall) specifying which source addresses/ports/protocols may reach a given service. Not a per-protocol auth mechanism itself — it operates at the network layer, restricting *who can even attempt* a request (e.g. restricting which hosts may query a device's SNMP agent at all) independent of whatever credential/auth check the service itself performs. A common compensating control for protocols with weak native auth (SNMP, Modbus, DNP3): even if the protocol-level security is trivial to satisfy, an ACL can still block the request from ever arriving if the source isn't on the allowed list.
+- Modbus — the oldest/most universal ICS protocol (1979, Modicon); originally serial (RTU/ASCII), later Modbus TCP (port 502). Master/slave (client/server) request-response only, addressing four flat tables (coils, discrete inputs, holding registers, input registers) via function codes (FC01 read coils, FC03 read holding registers, FC05/FC06/FC16 writes). No authentication, no encryption, no sender-identity check — any client reaching port 502 can issue any function code; the canonical example of "ICS protocols have no security by design." Modbus Security (TLS retrofit, ~2018) exists but is rarely enabled in the field, same adoption story as DNP3-SA.
+- Modbus Plus (Modbus+) — a separate, proprietary Schneider Electric/Modicon network protocol, not the same wire format as standard Modbus RTU/ASCII/TCP. Token-passing (not master-slave) so multiple PLCs can initiate as peers; 1 Mbps over shielded twisted-pair with deterministic timing, proprietary HDLC-derived data link layer incompatible with standard Modbus framing (needs a bridge/gateway to talk to it). Mostly legacy now, superseded by Modbus TCP/IP. Same no-auth/no-encryption weakness as standard Modbus, just rarer in the wild so less commonly targeted/tooled-for.
+- Compensating controls / defense-in-depth — when a weakness can't be fixed at its source (e.g. an inherently insecure field protocol), layer protections around it instead (network segmentation, monitoring, access control). The practical justification for the Purdue Level 3.5 DMZ: Modbus/DNP3/GOOSE can't be secured on their own, so security gets pushed to the perimeter/network layer instead.
+- Brownfield vs. greenfield — brownfield = existing legacy installed equipment (the overwhelming majority of OT/ICS, often running protocols/hardware decades old); greenfield = new builds designed from scratch. OT field devices commonly have 20-30 year lifecycles, so replacing a protocol in the field usually means replacing working hardware, not just patching software — a major reason insecure legacy protocols persist.
+- DNP3 (Distributed Network Protocol) — dominant protocol for North American electric/water utility master-station-to-RTU communication. Richer than Modbus: object-based data types with built-in semantics (Binary/Analog Input/Output, Counters) rather than anonymous flat registers, plus unsolicited reporting (an outstation can push event-driven updates without being polled — useful over slow serial/radio links, but an extra unauthenticated inbound-trigger surface). Originally serial (Data Link Layer framing + per-block CRC → Transport Function reassembly → Application Layer data); DNP3 over TCP (port 20000) tunnels that same serial-era framing inside TCP rather than replacing it the way Modbus-TCP's MBAP header does.
+- DNP3-SA (Secure Authentication, IEEE 1815) — optional auth extension, rarely enabled in practice. Only protects *critical* function codes (control/operate/config-change), not routine polls/reads, as a deliberate latency tradeoff. Uses HMAC-based challenge-response rather than a static shared secret (like SNMP's community string, sent in cleartext and directly replayable): outstation sends a random nonce Challenge, master replies with an HMAC of that nonce under a pre-shared session key (the key itself never crosses the wire), outstation verifies by recomputing the same HMAC — a sniffed Challenge/Reply pair is useless for a different operation. Session keys rotate via a separate key-update exchange from longer-lived per-user-role "update keys," giving per-operator accountability a static secret can't. Full challenge-response costs a round trip per critical command, which is real overhead over slow serial/radio links — "Aggressive Mode" exists to cut that round trip by having the master proactively attach its HMAC without waiting for a fresh challenge, but formal analysis (Cremers et al. 2019; Coloured Petri Net modeling) found this reintroduces a replay flaw: a captured Aggressive Mode message can be replayed to execute reads/writes/application launches on the outstation without ever possessing the session key. Net effect: real deployment of DNP3-SA remains limited by both legacy device constraints and genuine real-time-latency requirements, so most operational DNP3 traffic today is still plaintext.
 - IEC 61850 — modern substation automation standard for electric utilities; includes GOOSE messages.
-- GOOSE (Generic Object Oriented Substation Event) — peer-to-peer protection-relay messages requiring single-digit-millisecond delivery, with essentially no authentication due to the speed requirement; a known attack surface (used in the 2016 Ukraine grid attack, Industroyer malware).
-- IEC 60870-5-104 ("IEC 104") — DNP3's rough European/Middle-East equivalent protocol.
-- OPC-UA — a newer IT/OT bridging protocol (e.g. historian-to-cloud) that, unlike the field-level protocols above, was built with authentication and encryption from the start.
+- GOOSE (Generic Object Oriented Substation Event) — publish-subscribe (not request-response) protection-relay messaging requiring single-digit-millisecond delivery, with essentially no authentication due to the speed requirement; a known attack surface (used in the 2016 Ukraine grid attack, Industroyer malware). Runs directly on raw Ethernet Layer 2 (EtherType 0x88B8) to a reserved multicast MAC range (01-0C-CD-01-xx-xx) — no IP, no TCP/UDP, so ordinary L3 routers can't route it (nothing to route on) though ordinary L2 switches handle it fine, just flooding to every port on the VLAN (no IGMP-style group pruning, since that's IP-layer). Reliability comes from repetition, not acknowledgment: publisher retransmits the same state at a fast-then-slowing interval; a State Number (stNum, increments only on real state changes) plus Sequence Number (sqNum, increments per retransmission) is what Industroyer forged — crafting a higher stNum than the legitimate relay to make a spoofed "breaker open" look like the newest valid state. All publish/subscribe wiring (which multicast address/dataset maps to which relay) is statically pre-engineered in a Substation Configuration Description (SCD) file loaded onto each IED at commissioning time, not negotiated at runtime — so once an attacker has that config (via traffic capture or a leaked SCD file), forged frames work indefinitely, no handshake to invalidate them.
+- IEC 62351-6 — the security extension for GOOSE/Sampled Values/MMS, adding a digital signature for authentication/integrity (not encryption — confidentiality isn't the goal on an assumed-physically-secured substation LAN). Low real-world adoption, and not just from brownfield inertia like Modbus/DNP3-SA: the original RSA-signature scheme is often too slow for the sub-4ms timing budget on older relay hardware, a genuine unresolved engineering tension rather than pure organizational inertia; later proposals shift to faster symmetric-key MAC schemes to try to fit the budget.
+- PRP / HSR (Parallel Redundancy Protocol / High-availability Seamless Redundancy, IEC 62439) — substation network resilience standards that send duplicate frames over two independent physical paths simultaneously, giving zero-recovery-time failover if one link/switch dies. Distinct from GOOSE's own retransmission-based reliability, which only covers random packet loss, not a dead physical path.
+- Process bus / station bus — the dedicated, VLAN-segmented (sometimes physically separate) Ethernet network a substation runs GOOSE/Sampled Values on, kept apart from general SCADA/IT traffic for two reasons: (1) latency contention — ordinary traffic queuing ahead of a time-critical trip message, (2) security — Ethernet doesn't distinguish IP packets from GOOSE frames on the wire, so any compromised host sharing that L2 segment can craft and inject raw GOOSE frames directly (exactly what Industroyer did), with no "GOOSE-specific access" required. Segmentation here is the control meant to keep an IP-side compromise from ever reaching that segment — in budget-constrained or poorly-designed substations this isolation is sometimes incomplete, a real rather than theoretical risk.
+- IEC 60870-5-104 ("IEC 104") — DNP3's rough equivalent dominant in Europe/Middle East/Asia/Africa (DNP3 dominates North America); if you see TCP port 2404 in a capture, it's almost certainly non-US utility telemetry. The IP-networked version of the older serial IEC 60870-5-101 (104-to-101 is roughly what Modbus-TCP is to Modbus-serial). Master-slave (controlling/controlled station), not pub-sub. Data carried as ASDUs (Application Service Data Units) containing typed Information Objects (Type Identification field marks e.g. single-point info, measured value, command) — gives semantic typing Modbus's flat registers lack, similar in spirit to DNP3's object model. No authentication/encryption/integrity in the base spec, same as Modbus/DNP3-without-SA; IEC 62351-3/5 defines a TLS security retrofit, same low-adoption brownfield story as everything else.
+- OPC-UA — platform-independent successor to the original OPC (built on Windows-only COM/DCOM, a firewall nightmare); own binary protocol on TCP port 4840 or an HTTPS binding. Unlike field protocols' flat/typed-but-static registers, exposes a genuine object-oriented, self-describing address space (Nodes: variables, methods, types, relationships) a client can browse/discover at runtime. Real built-in security, not retrofitted: X.509 certs for mutual client/server auth, configurable Security Policies (None/Sign/SignAndEncrypt) with a defined cipher-suite-like profile stack (Basic256Sha256 etc.) — though "Security Policy: None" is a valid, sometimes-used setting that defeats all of it. Primary/original use case is horizontal: cross-vendor interoperability between different Level 2/3 systems (SCADA-to-historian, historian-to-MES, HMI-to-SCADA) — solving the "every vendor has a proprietary driver" problem OPC was founded to fix. Increasingly also vertical: Level 2/3 (historian/SCADA) up to Level 4/5 IT/cloud/analytics, crossing the DMZ. At the leading edge, pushed down to the field level too — modern PLCs (Siemens S7-1500, Beckhoff, Rockwell) often ship a native OPC-UA server directly on the controller, and OPC-UA over TSN (Time-Sensitive Networking) is an emerging effort toward real-time field-level use, a long-horizon candidate to someday displace protocols like Modbus or GOOSE. Doesn't retroactively secure the field-level protocols underneath it — it secures the bridge/interop layer it operates at, nothing lower.
+- MES (Manufacturing Execution System) — Purdue Level 3 software managing/tracking production on the plant floor in real time (work orders, batch tracking, quality, OEE) — sits between the Historian/SCADA (Level 2/3, process data) and ERP (Level 4, business/planning data). A common OPC-UA peer: SCADA/historian-to-MES and MES-to-ERP are typical OPC-UA interoperability links.
 - S7 — Siemens' proprietary ICS protocol for communicating with SIMATIC PLCs (S7-300/1200/1500 etc.), port 102/TCP; like Modbus/DNP3, a frequent target for ICS network scanning.
 - CODESYS — the IEC 61131-3 engineering/runtime environment (port 11740/TCP) underlying many different vendors' PLCs, including WAGO's — a shared software base means a CODESYS vulnerability can cross vendor lines.
 - VFD (Variable Frequency Drive) — a device that controls motor speed by varying the frequency/voltage of its power supply; common ICS target (pumps, fans, compressors) alongside PLCs.
@@ -81,7 +92,7 @@ Covered 2026-10-05 in response to "how do I build a fake OT network to play with
 - GRFICS (Graphical Realism Framework for Industrial Control Simulations) — Georgia Tech project providing a full prebuilt virtual plant (simulated chemical process + HMI + PLC logic + documented attack scenarios) as VMs, built explicitly for cybersecurity teaching/research. Closest thing to an "accepted standard" fake OT environment to attack.
 - Conpot — low-interaction ICS honeypot, defaults to impersonating a Siemens S7-300 PLC; speaks Modbus, S7comm, BACnet, SNMP, HTTP simultaneously. Good for observing what scanning/exploitation traffic looks like against a fake device; not meant for realistic control logic.
 - T-Pot — docker-compose bundle of Conpot plus a dozen other honeypots (IT + OT), with a Kibana dashboard of all captured attack traffic. Useful for the "SOC watching attacks land" view rather than the device-builder view.
-- MiniCPS — Mininet-based framework for simulating networks of multiple PLCs/RTUs with physical process models; used in academic SWaT/WADI-style water-treatment-plant research. Heavier/academic, overkill unless specifically doing network-topology-level ICS research.
+- MiniCPS — Mininet-based (network namespaces + virtual Ethernet, not Docker containers) framework for simulating ICS networks at scale; topology and PLC devices defined in real Python (Mininet Topo subclass; PLC subclass with pre_loop()/main_loop()), not a config file. Ships the actual SWaT (Secure Water Treatment) testbed scenario alongside a minimal toy example — most academically credentialed of the open-source ICS simulators. No bundled attacker/traffic-observer tooling; MIT licensed, actively maintained. Chosen (2026-10-06) as the foundation for the planned network-simulator project specifically for its lightweight namespace-based scaling over Docker-per-device isolation — see [[ot-ics-security-ramp/network-simulator-blueprint]] for the full comparison against ICSSIM/ICS-SimLab.
 - ScadaBR — open-source HMI/SCADA software, commonly paired with OpenPLC to get a realistic-looking operator dashboard on top of real PLC logic.
 
 ** OT Attack Case Studies
@@ -89,6 +100,7 @@ Covered 2026-10-05 in response to "how do I build a fake OT network to play with
 - Ukraine grid attacks (2015, 2016) — first confirmed cyberattacks to cause a power outage. 2015: Sandworm (Russian GRU-linked) phished into utility IT, pivoted to OT, manually opened substation breakers via SCADA HMI (~230,000 people lost power). 2016: follow-up used Industroyer malware, the first malware built to natively speak ICS protocols (including IEC 61850 GOOSE) to automate breaker control at scale instead of manual HMI clicks.
 - TRITON / TRISIS (2017) — targeted a Saudi petrochemical plant's Safety Instrumented System (SIS) — the independent emergency-shutdown layer that exists to prevent physical catastrophe (explosion, toxic release). Reprogrammed Schneider Electric SIS controllers; a bug in the attacker's own code accidentally triggered a shutdown, likely preventing serious harm. The case study proving OT attacks carry real physical/safety risk, not just theoretical danger.
 - SIS (Safety Instrumented System) — an independent hardware/software layer that triggers automatic emergency shutdown if a process becomes physically dangerous, separate from the normal control system.
+- FrostyGoop (2024) — malware that injected Modbus TCP commands directly against district-heating ICS controllers in Ukraine, disabling heating to apartment buildings during winter; notable as a protocol-native attack requiring no exploit, just valid-looking Modbus writes to the right registers (same "no authentication to distinguish attacker from legitimate master" pattern as the 2015 Ukraine grid breaker attack). Predecessor VPNFilter (2018) only sniffed/exfiltrated Modbus TCP traffic rather than injecting commands.
 - Metcalf sniper attack (2013) — attackers shot up a PG&E transmission substation in California, knocking out 17 transformers. Physical, not cyber, but the case study behind NERC CIP-014 (mandating physical security planning for critical substations) — cited to make the point that critical-infrastructure risk isn't purely digital.
 - Private-APN CHP plant incident (Poland, 29 Dec 2025; CERT Polska follow-up report) — attacker pivoted from a compromised wind-farm FortiGate VPN/firewall, through a Teltonika cellular router's SSH tunnel, across a DSO private APN lacking client isolation, into a WAGO PFC200 gateway PLC reachable via default web-admin credentials, then via a further SSH tunnel into an unrelated CHP plant's OT network — stopping Siemens S7-300/1200/1500 PLCs and shutting down a steam turbine and water treatment system. First known real-world attack to use a private APN as a lateral-movement path between otherwise-unconnected facilities; the attacker also destroyed the WAGO device's partition table as anti-forensics.