Investigating Industrial Control Systems

The talk opens with the role of a national cyber security centre and then establishes the vocabulary of operational technology. It separates OT from IT, distinguishes industrial control systems from SCADA, and explains the Purdue model, which places field devices, PLCs, HMIs and supervisory systems in layers relative to the physical process. Reference architectures from vendors are presented as a starting point for learning which products a site is likely to run.

The middle covers attacks. The speaker walks through an ICS-specific version of the kill chain that separates generic intrusion from a second stage where process-specific impact is engineered. Two campaigns are compared: one that only enumerated industrial networks and one that manipulated Modbus traffic and disrupted heating for apartment buildings. A 2007 lab demonstration of a protective relay being reprogrammed shows how little code can destroy physical equipment, so safety comes first during any response.

On investigation, the speaker contrasts familiar IT practice with ICS realities: heavy legacy, unbacked-up systems, many proprietary protocols, and devices that cannot run endpoint agents. Windows-based engineering workstations and HMIs remain investigable with standard DFIR methods, and much industrial traffic is unencrypted, which helps network-based hunting. The practical takeaway is to reuse an existing process, respect physical safety, and be cautious even with simple scans, since they can disrupt fragile devices.