ICS / OT security

Defending industrial control systems (the PLCs, SCADA servers, engineering workstations and the physical processes they run) as opposed to the IT estate the rest of this spoke defends. It enters the corpus through stuxnet and stuxnet-reconstruction, and it is a genuinely different problem, not a subfolder of the one the spoke already knows.

Why it is not just "security, but in a factory"

The spoke's thesis is that defence buys time on one line, the window between a weakness existing and being usable against you, across hardening, detection and the fix. ICS bends three of the assumptions underneath that:

• The asset is physical and the failure is irreversible. An IT breach loses data you can, in principle, restore. A spun-apart centrifuge or a tripped turbine does not come back from a snapshot. The consequence is measured in equipment and safety, which changes what "buying time" is worth.
• Availability outranks patching. A control system that runs a continuous process cannot be rebooted for Patch Tuesday, and its controllers may be certified as a unit that a firmware change invalidates. The patch-and-comply rhythm the IT side assumes is often simply unavailable, so detection and segmentation carry more of the load than remediation does.
• The kit is old and speaks plaintext. Field protocols were designed for trusted serial links and frequently have no authentication at all, so zero-trust's "no network inside" and mTLS arguments meet devices that cannot participate in them. Defence tends to happen around the device.

Where it connects to what the spoke already holds

ATT&CK has a dedicated ICS matrix: the spoke references ATT&CK but has only ever used the Enterprise tactics; the ICS matrix is where a Stuxnet-class behaviour is actually catalogued. in-silicon-enforcement is the same instinct as OT network monitoring: put the observer somewhere the compromised machine cannot reach it. And stuxnet is the founding case study, the demonstration that an IT compromise can be merely the carrier for an OT effect the IT defences never see.

Standing hole

This is a one-source corner, and that source (stuxnet-reconstruction) is a T3 reconstruction of a 2010 event. The spoke holds nothing on the modern OT-defence practice this concept names — no source on network segmentation for control networks, protocol-aware monitoring, safety-instrumented systems, or a current ICS advisory feed (CISA ICS-CERT). That is the growth edge this page opens.

Related

stuxnet · stuxnet-reconstruction · mitre-attack · in-silicon-enforcement · zero-trust · network-traffic-analysis · defensive-security · synthesis