In this lesson,
we're going to discuss industrial control systems
and supervisory control and data acquisition systems
known as ICS and SCADA.
In general, most of us work in IT,
which is information technology.
Now, information technology
includes our standard Windows computers,
our servers, our networks, our cloud platforms,
and things like that.
When we start talking about ICS and SCADA though,
we're moving into the world of OT, operational technology.
Now, operational technology is a communications network
that is designed to implement an industrial control system
rather than our traditional
business and data networking systems.
When we're dealing with ICS and SCADA,
we're not going to be focused on end user machines
or Windows 11 workstation, for example,
sitting on our networks.
Instead, with OT,
we're going to be using technology and computers
do something in the physical world,
like open or shut a valve
like you might do in a manufacturing plant,
create power generation in an electrical power plant,
or turn lights on or off, and things like that.
Now, when you look at operational technology,
it does look different
than our other typical information technology networks.
For example, here's what OT looks like
with a big cabinet with dials and gauges and buttons
that reference what is happening in the real world.
If I want to open or shut a different valve
or turn on or turn off a different pump,
I would push the buttons on that diagram
in front of the cabinet
instead of something like using a Windows machine
and using commands like start open valve and pressing Enter.
Now, this isn't to say you can't connect a Windows machine
and use them as a digital interface into the world of OT,
because you can, but in general, when you think of OT,
I want you to be thinking about technology
that interacts with the real world.
A lot of operational technology can just be done
in a manufacturing plant using systems like this,
and you don't even need to have a regular computer.
But if you want to use a Windows computer
and control these operational technology networks,
you can do that and you can integrate IT with OT,
but again, you don't have to.
Now, in the world of operational technology,
we have two main types of systems.
We have industrial control systems
and supervisory control and data acquisition systems.
First, we have industrial control systems.
Now, an industrial control system, also known as ICS,
provides the mechanisms for workflow
and process automation by controlling machinery
using embedded devices that are designed
to perform a specific and dedicated function.
ICS is heavily used to control real-world devices
and critical infrastructure.
Things like power suppliers, water suppliers,
healthcare services, telecommunication,
and natural security services.
If you interconnect multiple ICSs together,
you can actually create a distributed control system or DCS.
Now, when you're dealing with industrial control systems,
you have to prioritize availability
and integrity over confidentiality.
Now, in the IT world, we usually focus on the CIA triad,
and we start thinking about that all three things
are really important,
with confidentiality being a strong contender
for first place.
But in the world of operational technology,
confidentiality is actually the least important
of the three components.
Availability is paramount,
and it's that way for a good reason.
Let's think about the purpose of operational technology
and what it was originally designed to do in manufacturing.
It was about maximizing the efficiency
of our manufacturing plants.
After all, anytime that plant was down,
the organization is not making money.
So for them, availability is everything.
Also, back then,
the manufacturing plants didn't connect to the internet,
and the entire network
was located within the walls of the factory.
So we had that physical boundary
to provide us some level of confidentiality.
This meant that confidentiality wasn't a big deal
and we didn't have to think about
having to build that into our networks.
This is because we trusted the people
who were working in our factories.
Now, let's take a look at another good example of ICS
that's used on a daily basis all over the world.
Here we have a US Navy warship.
This is a great example
because it contains multiple ICSs
that are focused on different things
because essentially that ship is a city at sea.
Now remember, when you hear ICS,
this is essentially just a network
that manages embedded devices.
On that ship,
there's a power plant that creates electricity.
There's an equivalent of a factory
with all the machines needed to create thrust
and turn that propeller and move the ship through the water.
There's a telecommunications backbone for voice and video
that's going throughout the entire ship.
There's waste and water treatment facilities onboard.
Everything those sailors need to survive
for months at a time is on that ship,
and it's all being controlled by ICS and embedded devices.
Now to interconnect all these industrial control systems,
ICS uses a communication technology known as Fieldbus.
Now, Fieldbus is a digital serial data communication
that is going to be used in operational technology networks
to link different programmable logic controllers
or PLCs together.
A programmable logic controller
is a type of digital computer
that's used in industrial settings
to enable automation in assembly lines,
autonomous field operations, robotics,
and other applications.
PLCs are going to be interconnected using Fieldbus
with sensors, input, and output devices
to connect the real world with the digital world.
These PLCs can be programmed to conduct an action
based on an input it receives from a given sensor.
Now, to program these PLCs,
we're going to use an HMI or a human machine interface.
A human machine interface can be a local control panel
or a piece of software running on a regular computer.
The human machine interface is going to act as the input
to the PLCs and the output for the entire system.
This way, a human can quickly see and monitor
what that system is doing at any given time.
After all, as a human operator, I need to be able to see
what the machine is doing by reading gauges
or other screens,
as well as to be able to give input to that machine
for what I want it to do.
And I do this by pushing buttons, turning knobs,
entering keystrokes, or even using a touchscreen.
For example,
if I worked in a hospital as a radiography technician,
I might need to take some X-rays.
I can have a human machine interface
that's a flat panel screen,
and I can touch it and tell the machine
what I want it to do.
This way, the panel can take that information from me,
send it to the machine, and then take the X-ray
in the case of this radiography machine.
This allows the ICS and the PLCs connected to it
to form a control loop, and the whole process of automation
is going to be governed by some kind of control server.
To program and control the PLCs,
you're going to use a special sequential control language
known as Ladder Logic.
Ladder Logic is essentially a programming language
that's going to be entered into the system
through the creation
of a graphical diagram that consists of the circuit diagrams
and the relay logic that's going to be used in those PLCs.
By creating a series of ANDs, NOTs, ORs,
and START/STOP conditions, we're going to be able to do this
inside the Ladder Logic language,
and the operator can now effectively program the PLCs
to provide the needed functionality.
The end result looks a lot like a flow chart,
but it allows for the full automation of that PLC
and the interconnections
to perform the work needed by those devices.
As a security practitioner,
you also need to be able to go back
and see what has happened in these ICSs,
these PLCs, and these HMI devices in the event
that you have some kind of a data breach or incident,
because these devices are prone
to being attacked just like a regular computer can be.
To do this, we're going to first look to the data historian.
A data historian is a piece of software
that's going to aggregate and catalog data
from all the multiple sources
within your industrial control system
by collecting all the events generated
from that control loop.
As a cybersecurity practitioner,
it is important that you know where the data historian is
and how you can use it in your organization
because it's going to be very valuable information for you
during an incident if your organization maintains
its own operational technology networks
for ICS and SCADA devices.
Now, the second type of OT we need to talk about
is supervisory control and data acquisition systems,
which is known as SCADA.
Now, technically,
SCADA is a type of industrial control system,
and it's used to manage large-scale, multi-site devices
and equipment spread over a geographic region
from your host computer.
Now, this may be a bit confusing at first
so I want you to remember it this way.
If you hear the term ICS,
we're talking about a single plant or system.
If we're talking about a DCS,
this is a small connection of ICS systems
but still normally in one building or one facility.
When you start moving into the world of SCADA,
we're talking about many different ICS and DCS plants
that are all interconnected through a wide area network.
Because of the wide reach of SCADA,
it is normally going to be operated with a piece of software
that runs on an ordinary system like Windows or Linux.
This SCADA system can then gather data
and manage it across all the different plant devices
and all the different equipment
that has embedded PLCs in those plants.
To interconnect these plants in the SCADA network,
you're going to need a wide area network connection,
which can be either cellular, microwave, satellite, fiber,
or even a VPN-based WAN.
You can really use whatever you want
just like when you're designing your connections
for your other networks, but you need to make sure
you're linking back all those field devices
to the central SCADA server.
A good example of a large-scale SCADA network
is a smart meter system used by many electric companies
around the world.
At my home, for example, we have a smart meter
that was installed by the electric company.
Each month,
instead of them having to come out and read my meter,
that meter sends them the information
over a cellular connection
and they now know how much they need to bill me.
Additionally, they can connect to my meter
and monitor not just my usage,
but also my up and down status
because all the houses in my area
are part of this SCADA network.
So by having this SCADA network,
they no longer have to pay meter readers
to go out and manually check the meters
of every house in the city every single month.
And instead,
they simply use the cellular chip that's in there
to take a reading once a month
and send it back over the cellular network as a text message
or other data format to their SCADA server.
It collates that information,
passes it onto the billing system,
and then I get a bill with the amount due for the electric
that I used that month.