8.0 KiB
8.0 KiB
ot-ics-security-ramp/protocol-comparison
- Transport / Addressing
- Data Model
- Security Posture
- Purdue Level / Typical Role
- Known Real-World Attacks
- Regional / Vendor Notes
Side-by-side quick-reference comparing the ICS/OT protocols covered in ot-ics-security-ramp/curriculum (deep-dive session 2026-10-06). Full prose definitions live in ot-ics-security-ramp/glossary — this node is for comparison at a glance, not canonical definitions.
Transport / Addressing
| Protocol | Transport | Port/Layer | Topology |
|---|---|---|---|
| Modbus | Serial (RTU/ASCII) or TCP | TCP 502 | Master/slave (req-resp) |
| DNP3 | Serial or TCP (tunnels serial framing inside TCP) | TCP 20000 | Master/outstation (req-resp + unsolicited) |
| IEC 104 | TCP (IP version of serial IEC 101) | TCP 2404 | Controlling/controlled station (req-resp) |
| GOOSE | Raw Ethernet, no IP/TCP/UDP at all | L2, EtherType 0x88B8, multicast MAC | Publish-subscribe |
| OPC-UA | Own binary protocol, or HTTPS | TCP 4840 or HTTPS | Client/server, cross-vendor interop |
| SNMP | UDP | UDP 161 (agent), 162 (trap) | Manager/agent (poll + trap push) |
Data Model
| Protocol | Data model |
|---|---|
| Modbus | Flat, untyped: coils / discrete inputs / holding registers / input registers, addressed by number only — no semantic meaning in the wire format |
| DNP3 | Object-based with real semantics: Binary/Analog Input/Output, Counters |
| IEC 104 | ASDUs containing typed Information Objects (Type Identification field: single-point info, measured value, command, …) |
| GOOSE | Dataset of pre-engineered values per GOOSE Control Block, identified by stNum/sqNum for state/retransmission tracking |
| OPC-UA | Full object-oriented address space: Nodes (variables, methods, types, relationships), self-describing and browsable at runtime |
| SNMP | MIB tree of named values addressed by OIDs (dotted-numeric path) |
Security Posture
| Protocol | Built-in security | Retrofit extension | Real-world adoption of retrofit |
|---|---|---|---|
| Modbus | None | Modbus Security (TLS, ~2018) | Rare |
| DNP3 | None | DNP3-SA (IEEE 1815, HMAC challenge-response) | Rare; Aggressive Mode has a known replay flaw |
| IEC 104 | None | IEC 62351-3/5 (TLS) | Rare |
| GOOSE | None (sub-4ms budget leaves no room) | IEC 62351-6 (digital signature) | Very rare — genuine timing-vs-security tension, not just inertia |
| OPC-UA | Real, from the start: X.509 mutual auth, Sign/SignAndEncrypt modes | N/A — native | "Security Policy: None" is valid and often left set anyway; ~80% of exposed servers found in plaintext (2026 scan data) |
| SNMP | v1/v2c: plaintext community string only (no real auth) | SNMPv3 (real auth + encryption) | Often not enabled; v1/v2c still common |
Purdue Level / Typical Role
| Protocol | Typical Purdue level | Typical use |
|---|---|---|
| Modbus | Level 0-1 | PLC/RTU to field I/O, SCADA polling |
| DNP3 | Level 1-2 | Utility master station to RTU, esp. electric/water, North America |
| IEC 104 | Level 1-2 | Utility master station to RTU, Europe/Middle East/Asia/Africa |
| GOOSE | Level 0-1 | Peer-to-peer protection-relay coordination within a substation |
| OPC-UA | Level 2-4 (increasingly pushed to Level 1 on modern PLCs) | Cross-vendor interop (SCADA-historian-MES), and Level 2/3-to-cloud bridging |
| SNMP | Network infrastructure (switches/routers/firewalls around all levels) | Device health monitoring, not process control |
Known Real-World Attacks
| Protocol | Case study |
|---|---|
| Modbus | FrostyGoop (2024) — injected Modbus TCP commands to disable district heating, Ukraine |
| DNP3 | No single named malware yet exploiting DNP3 directly at scale; risk is mainly from it being unauthenticated by default |
| IEC 104 | No single named malware yet exploiting IEC 104 directly at scale; same unauthenticated-by-default risk |
| GOOSE | Industroyer (2016) — forged GOOSE stNum to spoof breaker-open state, Ukraine grid |
| OPC-UA | No single named malware yet; risk driven by internet-exposed misconfigurations (Security Policy: None) rather than a protocol flaw |
| SNMP | Russian FSB Center 16 — exfiltrated critical-infrastructure router configs via SNMP + Cisco Smart Install |
Regional / Vendor Notes
- DNP3 dominates North America; IEC 104 dominates Europe/Middle East/Asia/Africa — functionally parallel protocols serving the same utility master-to-RTU role in different regions.
- OPC-UA's founding purpose was horizontal cross-vendor interoperability (replacing the Windows-only COM/DCOM-based original OPC); vertical IT/cloud bridging and field-level PLC-native deployment are both newer extensions of that original role.
- SNMP isn't an ICS-native protocol at all — it rides alongside the other protocols on the same network infrastructure (switches, routers, sometimes OT devices themselves, as Conpot's multi-protocol emulation reflects).