69 lines
8.0 KiB
Org Mode
69 lines
8.0 KiB
Org Mode
:PROPERTIES:
|
|
:ID: d588e9b0-8ad8-4a26-a1ed-62f50957e4a4
|
|
:END:
|
|
|
|
#+title: ot-ics-security-ramp/protocol-comparison
|
|
#+filetags: :project: :knowledge: :cybersecurity: :protocols: :reference:
|
|
|
|
Side-by-side quick-reference comparing the ICS/OT protocols covered in [[ot-ics-security-ramp/curriculum]] (deep-dive session 2026-10-06). Full prose definitions live in [[ot-ics-security-ramp/glossary]] — this node is for comparison at a glance, not canonical definitions.
|
|
|
|
** Transport / Addressing
|
|
|
|
| Protocol | Transport | Port/Layer | Topology |
|
|
|----------+---------------------------------------------------+-------------------------------------+--------------------------------------------|
|
|
| Modbus | Serial (RTU/ASCII) or TCP | TCP 502 | Master/slave (req-resp) |
|
|
| DNP3 | Serial or TCP (tunnels serial framing inside TCP) | TCP 20000 | Master/outstation (req-resp + unsolicited) |
|
|
| IEC 104 | TCP (IP version of serial IEC 101) | TCP 2404 | Controlling/controlled station (req-resp) |
|
|
| GOOSE | Raw Ethernet, no IP/TCP/UDP at all | L2, EtherType 0x88B8, multicast MAC | Publish-subscribe |
|
|
| OPC-UA | Own binary protocol, or HTTPS | TCP 4840 or HTTPS | Client/server, cross-vendor interop |
|
|
| SNMP | UDP | UDP 161 (agent), 162 (trap) | Manager/agent (poll + trap push) |
|
|
|
|
** Data Model
|
|
|
|
| Protocol | Data model |
|
|
|----------+-------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
| Modbus | Flat, untyped: coils / discrete inputs / holding registers / input registers, addressed by number only — no semantic meaning in the wire format |
|
|
| DNP3 | Object-based with real semantics: Binary/Analog Input/Output, Counters |
|
|
| IEC 104 | ASDUs containing typed Information Objects (Type Identification field: single-point info, measured value, command, ...) |
|
|
| GOOSE | Dataset of pre-engineered values per GOOSE Control Block, identified by stNum/sqNum for state/retransmission tracking |
|
|
| OPC-UA | Full object-oriented address space: Nodes (variables, methods, types, relationships), self-describing and browsable at runtime |
|
|
| SNMP | MIB tree of named values addressed by OIDs (dotted-numeric path) |
|
|
|
|
** Security Posture
|
|
|
|
| Protocol | Built-in security | Retrofit extension | Real-world adoption of retrofit |
|
|
|----------+--------------------------------------------------------------------+----------------------------------------------+-------------------------------------------------------------------------------------------------------------------------|
|
|
| Modbus | None | Modbus Security (TLS, ~2018) | Rare |
|
|
| DNP3 | None | DNP3-SA (IEEE 1815, HMAC challenge-response) | Rare; Aggressive Mode has a known replay flaw |
|
|
| IEC 104 | None | IEC 62351-3/5 (TLS) | Rare |
|
|
| GOOSE | None (sub-4ms budget leaves no room) | IEC 62351-6 (digital signature) | Very rare — genuine timing-vs-security tension, not just inertia |
|
|
| OPC-UA | Real, from the start: X.509 mutual auth, Sign/SignAndEncrypt modes | N/A — native | "Security Policy: None" is valid and often left set anyway; ~80% of exposed servers found in plaintext (2026 scan data) |
|
|
| SNMP | v1/v2c: plaintext community string only (no real auth) | SNMPv3 (real auth + encryption) | Often not enabled; v1/v2c still common |
|
|
|
|
** Purdue Level / Typical Role
|
|
|
|
| Protocol | Typical Purdue level | Typical use |
|
|
|----------+-----------------------------------------------------------------------+-----------------------------------------------------------------------------|
|
|
| Modbus | Level 0-1 | PLC/RTU to field I/O, SCADA polling |
|
|
| DNP3 | Level 1-2 | Utility master station to RTU, esp. electric/water, North America |
|
|
| IEC 104 | Level 1-2 | Utility master station to RTU, Europe/Middle East/Asia/Africa |
|
|
| GOOSE | Level 0-1 | Peer-to-peer protection-relay coordination within a substation |
|
|
| OPC-UA | Level 2-4 (increasingly pushed to Level 1 on modern PLCs) | Cross-vendor interop (SCADA-historian-MES), and Level 2/3-to-cloud bridging |
|
|
| SNMP | Network infrastructure (switches/routers/firewalls around all levels) | Device health monitoring, not process control |
|
|
|
|
** Known Real-World Attacks
|
|
|
|
| Protocol | Case study |
|
|
|----------+------------------------------------------------------------------------------------------------------------------------------------|
|
|
| Modbus | FrostyGoop (2024) — injected Modbus TCP commands to disable district heating, Ukraine |
|
|
| DNP3 | No single named malware yet exploiting DNP3 directly at scale; risk is mainly from it being unauthenticated by default |
|
|
| IEC 104 | No single named malware yet exploiting IEC 104 directly at scale; same unauthenticated-by-default risk |
|
|
| GOOSE | Industroyer (2016) — forged GOOSE stNum to spoof breaker-open state, Ukraine grid |
|
|
| OPC-UA | No single named malware yet; risk driven by internet-exposed misconfigurations (Security Policy: None) rather than a protocol flaw |
|
|
| SNMP | Russian FSB Center 16 — exfiltrated critical-infrastructure router configs via SNMP + Cisco Smart Install |
|
|
|
|
** Regional / Vendor Notes
|
|
- DNP3 dominates North America; IEC 104 dominates Europe/Middle East/Asia/Africa — functionally parallel protocols serving the same utility master-to-RTU role in different regions.
|
|
- OPC-UA's founding purpose was horizontal cross-vendor interoperability (replacing the Windows-only COM/DCOM-based original OPC); vertical IT/cloud bridging and field-level PLC-native deployment are both newer extensions of that original role.
|
|
- SNMP isn't an ICS-native protocol at all — it rides alongside the other protocols on the same network infrastructure (switches, routers, sometimes OT devices themselves, as Conpot's multi-protocol emulation reflects).
|