IAES: Guarding the University of Arizona's Heartbeat – The Watchful Eye on Critical Infrastructure

Michael Galde, an assistant professor at the University of Arizona, describes a research project that began when the university's facilities department asked for help. Facilities runs its own network carrying power generation, water treatment, chiller and building automation devices. The facilities engineers knew their equipment well but had little visibility into what those devices were saying to each other, and central IT had no practical way to read industrial protocols.

He explains why OT networks differ from IT. Controllers are long-lived, cannot host agents or antivirus, and are hard to patch without planned downtime. Protocols such as Modbus, DNP3 and BACnet were built without encryption or authentication, and few have seen security-focused revisions. He uses the Stuxnet episode and the 2015 Ukraine grid attack as examples of how industrial environments get hit. He also notes that many industrial controllers are reachable from the internet with weak or no authentication.

The project's answer is a passive monitor fed from a mirror port on the single uplink between each industrial segment and the enterprise network. Captured traffic is decoded with Wireshark dissectors and turned into logs for Wazuh, ELK or Splunk. Over about 30 days the system builds a baseline, then flags new connections and unexpected talkers, which facilities staff can review or escalate. The takeaways are to segment OT networks, watch their boundaries, and translate protocol data into terms operators can act on. The project was described as still in development.