Industrial Control Systems & Cyber-Physical Security

Section 1

1Why This Matters: Cyber-Physical Systems

Every domain of the CISSP CBK assumes an attacker's worst case is stolen data or downtime. In industrial control systems (ICS), the worst case is different: a compromised system can open a valve, over-speed a turbine, de-energize a breaker, or disable a safety interlock. These are cyber-physical systems — software and network decisions have direct, sometimes irreversible, physical consequences.

This shifts the security priority model. IT security is generally built around the CIA triad in the order Confidentiality → Integrity → Availability. ICS/OT security typically inverts it to AIC: Availability and Integrity of the physical process come first, because a control system that silently corrupts data or goes offline can injure people, damage equipment, or harm the environment before anyone notices a "confidentiality" problem.

Section 2

2ICS/OT Fundamentals

Industrial Control System (ICS) is the umbrella term for the systems that monitor and control physical processes: manufacturing lines, power grids, water treatment, pipelines, building automation. Operational Technology (OT) is the broader category of hardware and software that detects or causes changes in physical devices — ICS is the largest subset of OT.

Core building blocks

IT vs. OT: a different risk calculus

Section 3

3OT Networking Basics

Students with an IT networking background already understand Ethernet, IP, and TCP. What's different in OT is the application layer: industrial protocols were designed decades ago for reliability and real-time determinism on trusted, isolated networks — not for a world where the network is routinely exposed to attackers.

The practical takeaway: because most legacy industrial protocols lack authentication, anyone who can reach the network segment can typically issue commands — there's often no equivalent of a login prompt at the protocol layer. This is why network segmentation (not endpoint hardening alone) is the primary control in OT, and it's the reasoning behind the model in the next section.

Section 4

4The Purdue Model

The Purdue Enterprise Reference Architecture (PERA), usually shortened to the "Purdue Model," is the reference architecture the ICS security community uses to describe how a plant network should be layered — from the physical process at the bottom to enterprise IT at the top — with a buffer zone in between. It's the OT equivalent of a defense-in-depth network diagram, and it's the model examiners expect candidates to recognize when a question describes segmentation between "the plant floor" and "the corporate network."

Why examiners care about this model

• Zones and conduits (IEC 62443): the Purdue levels map onto "zones" of similar trust/function, connected only through defined, monitored "conduits" — the same segmentation logic tested in CISSP network security questions, applied to OT.
• The DMZ is the control, not a level: a common exam trap is assuming data can flow directly from L4 to L2. In a properly segmented design, it cannot — everything routes through the industrial DMZ.
• Lower levels = higher consequence of failure: Level 0/1 failures affect physical safety; Level 4/5 failures are mostly business impact. Segmentation direction (protecting downward) matters as much as segmentation existence.

Section 5

5Real-World Incidents

These three incidents are the ones most referenced in ICS security training and CISSP-adjacent material — each demonstrates a different failure mode.

Section 6

6Defense & Mitigation Strategies

Architectural controls

• Zones and conduits (IEC 62443): group assets of similar criticality/trust into zones; allow traffic to cross only through defined, monitored conduits (firewalls, data diodes).
• Industrial DMZ: enforce that no protocol/session initiates directly between enterprise IT and the control network — brokered through DMZ-hosted relay servers.
• Unidirectional gateways ("data diodes"): for the highest-criticality zones, use hardware that physically permits data to flow only one direction (OT → IT), making inbound compromise impossible over that path.
• Independent safety layer: keep SIS logic and communication paths separate from the basic control system so a control-system compromise cannot also disable safety interlocks.

Operational controls

• Asset inventory: you cannot protect what you don't know exists — passive network discovery is preferred over active scanning, which can crash fragile legacy devices.
• Patch & change management: patches are validated by the vendor and applied during scheduled outages; compensating controls (segmentation, monitoring) cover the gap between disclosure and patching.
• Passive/OT-aware monitoring: deploy IDS built for ICS protocols (reads Modbus/DNP3/etc. semantically) rather than generic IT tools, and avoid active probing on the OT side.
• Remote access control: vendor and engineer remote access goes through jump hosts with MFA, session recording, and time-boxed approval — never direct VPN into the control network.
• OT-aware incident response: IR playbooks must account for physical safety — "isolate and reimage" can be the wrong first move if it interrupts a live physical process; response steps are usually co-owned with plant operations/engineering, not run by IT security alone.

Section 7

7Curated Video Library

Watch alongside the reading above. Videos are grouped by section; all are publicly available on YouTube. Preview each before assigning to students, since availability and ads can change.

ICS/OT & SCADA fundamentals

Networking & protocols

Purdue Model

Real-world incidents

Defense & segmentation

Section 8

8Knowledge Check

Click each question to reveal the answer. Use these as a quick self-check or as CISSP-style warm-up questions before a quiz.