ICS Security Basics
So first of all what is ICS?
ICS stands for Industrial Control Systems. These systems are used to control and monitor industrial processes such as manufacturing plants, power grids, water treatment facilities and warehouses.
Security is a critical concern in ICS environments for several reasons:
- Long device lifecycle
ICS devices are designed to run for years after deployment. During this period new vulnerabilities are discovered and also the systems become outdated.
- Direct interaction with physical processes
ICS components directly control hardware such as motors, valves, sensors, and conveyor systems. This makes them high-value targets for attackers.
- Human safety risks
Industrial environments involve people working alongside automated systems. If an ICS is compromised and behaves unexpectedly, it can cause physical damage, financial loss, or even put human lives at risk.
In ICS environments, availability and safety often take priority over confidentiality. Unlike IT systems, downtime in ICS can halt production or cause physical damage, which is why many insecure systems remain in use despite known risks.
Historically, ICS networks were air-gapped, relying on physical connections and proprietary hardware. Today, many of these systems are connected to TCP/IP networks and the internet for remote monitoring, maintenance, and integration with enterprise IT systems. This shift has dramatically expanded the attack surface.
One of the most widely used protocols in modern ICS environments is Modbus. Its popularity is not due to strong security features but because of its simplicity and compatibility with both legacy and modern devices. Modbus was designed in an era where security was not a priority, making it a common weak point in industrial networks.
Because of these factors, ICS security has become a high-priority field, requiring a different mindset than traditional IT security.
Why legacy Protocols like Modbus are Dangerous
Legacy protocols are still widely used in Industrial Control Systems, and Modbus is the most common example. Despite being over four decades old, Modbus continues to power critical infrastructure across manufacturing plants, power stations, and warehouses.
Its widespread adoption is not because it is secure — but because it is simple, reliable, and universally supported. Unfortunately, those same traits make it dangerous in modern, networked environments.
1. No Authentication — Anyone Can Talk to the Device
Modbus has no built-in authentication. If a system can reach a Modbus-enabled device, it can issue commands to it.
There is:
- No username
- No password
- No device identity verification
An attacker who gains network access can read sensor data or write control commands without resistance. In an ICS environment, that can mean stopping motors, opening valves, or altering production logic.
2. No Encryption — All Traffic Is in Clear Text
Modbus transmits data in plain text.
This allows attackers to:
- Sniff network traffic
- Understand control logic
- Capture commands and replay them later
In a flat network or poorly segmented environment, this becomes trivial. Anyone with access to the network can observe exactly how the system operates.
3. Designed for Trusted Networks, Not the Internet
Modbus was created in an era where:
- Systems were air-gapped
- Networks were physically isolated
- Security threats were not considered
Today, many Modbus devices are:
- Connected to corporate IT networks
- Exposed through VPNs
- Sometimes directly reachable from the internet
The protocol itself assumes trust. Modern attackers do not.
Why Modbus Still Exists
Despite all these issues, Modbus remains popular because:
- It works with almost any device
- It is simple to implement
- It integrates well with legacy systems
- Engineers trust its behavior
From an operational perspective, it works. From a security perspective, it is fragile.
In the next article, we’ll take a hands-on look at the Modbus protocol by establishing a connection and observing how registers and coils are accessed. Understanding these mechanics is essential for recognising how misconfigurations and weak network controls can be exploited in real-world ICS environments.