Industrial Control System (ICS)

The Human-Machine Interface (HMI) is the graphical dashboard that translates complex machine data into a visual format for human operators. It serves as the primary control panel, displaying real-time process schematics, alarms, and trend graphs.

• Function: Allows operators to monitor system status, acknowledge alarms, and issue manual setpoint changes.
• Security Note: Often runs on commercial operating systems, making it a high-value target for phishing attacks aimed at gaining initial access to the OT network.
• Example: A touchscreen panel on a factory floor showing the temperature and pressure of a reactor vessel.

The Programmable Logic Controller (PLC) is the ruggedized, real-time computer that acts as the physical workhorse of the ICS. It executes the control logic by continuously scanning inputs, processing a ladder logic program, and updating physical outputs.

• Execution Cycle: Operates on a deterministic scan cycle (read inputs -> execute logic -> write outputs) measured in milliseconds.
• Logic Programming: Typically programmed using IEC 61131-3 standard languages like Ladder Diagram (LD) or Structured Text (ST).
• Example: A PLC receiving a signal from a high-level float switch and immediately sending a command to close an intake valve.

A Remote Terminal Unit (RTU) is a microprocessor-controlled field device that interfaces physical objects to a SCADA system by transmitting telemetry data and receiving control commands. Unlike PLCs, RTUs are optimized for wide-area telemetry over long distances.

• Key Difference: RTUs often have integrated communications (radio, cellular) for remote sites like pipelines or wellheads, whereas PLCs rely on local plant networks.
• Data Concentration: Aggregates multiple analog and digital signals from field sensors before transmitting back to the master station.
• Example: An RTU at a remote electrical substation measuring bus voltage and reporting it back to the central control center via DNP3.

An Intelligent Electronic Device (IED) is a microprocessor-based controller for power system equipment, such as circuit breakers, transformers, and capacitor banks. It combines protection, control, and monitoring functions in a single unit.

• IEC 61850: Modern IEDs leverage the IEC 61850 standard to enable high-speed peer-to-peer Generic Object Oriented Substation Events (GOOSE) messaging, replacing hardwired copper connections.
• Protection Logic: Executes complex protection algorithms (e.g., overcurrent, differential) to isolate faults in microseconds.
• Example: A digital relay protecting a transmission line; it trips the breaker instantly if a short circuit is detected.

The Engineering Workstation (EWS) is a high-privilege computer used to configure, program, and maintain the control system logic. It holds the master copies of PLC ladder logic, HMI tag databases, and network configuration files.

• Critical Asset: Compromise of the EWS grants an attacker the ability to push malicious logic changes directly to field controllers.
• Change Management: Strict version control and procedural lockouts are essential here to prevent unauthorized logic modifications.
• Example: A laptop used by an automation engineer to update the structured text code running on a turbine controller.

The Data Historian is a centralized database that archives time-series process data and events from the control system. It acts as the 'black box' of the plant, storing years of operational data for compliance and analysis.

• Analytics Backend: Feeds historical data to machine learning models for predictive maintenance and anomaly detection.
• Forensic Value: Security analysts query the historian to reconstruct the timeline of a cyber-physical incident.
• Example: A server logging the opening pressure of a valve every 500 milliseconds for the past five years.

Operational Technology is the hardware and software that directly monitors and controls physical devices. Unlike IT, which manages data, OT manages the physical world.

• Priority: Safety and availability over confidentiality.
• Lifecycle: OT components often have 15-20 year lifespans, making legacy protocol support critical.
• Convergence: IT/OT convergence drives efficiency but expands the cyber attack surface.

The PLC is the ruggedized digital computer that executes the control logic at the heart of an ICS. It replaces hard-wired relays and timers.

• Operation: Reads inputs (sensors), executes a ladder logic program, and writes outputs (actuators) in a continuous scan cycle.
• Languages: Standardized under IEC 61131-3, including Ladder Diagram and Structured Text.
• Security Risk: Unauthenticated PLCs can accept malicious ladder logic modifications.

A DCS is a control architecture where controllers are distributed throughout the plant but integrated into a single high-speed network for centralized supervision.

• Application: Continuous, complex processes like oil refining or chemical manufacturing.
• Key Feature: Redundant controllers and networks ensure no single point of failure.
• Contrast: Unlike SCADA's wide-area focus, a DCS is typically confined to a single facility.

The HMI is the graphical touchscreen or workstation that translates complex machine data into a visual format for the operator.

• Role: Provides situational awareness, trend charts, and manual override controls.
• Modern Shift: HMIs are moving from proprietary panels to web-based interfaces, increasing the need for strict access control.
• Attack Vector: A compromised HMI can spoof normal operating conditions while physical damage occurs.

The Purdue Enterprise Reference Architecture is the standard logical segmentation framework for ICS networks.

• Levels 0-2: The physical process, basic control (PLCs), and area supervisory control.
• Levels 3-4: Site operations management and business logistics (IT).
• Security: An Industrial Demilitarized Zone (IDMZ) strictly enforces separation between Level 3 and Level 4.