Figure 1: Modbus overview
Todays Industrial Control Systems still rely on serial communication. Why? Industrial networks are very static and the life cycle of assets like RTUs and PLCs in those environments are very long. Those serial assets are lacking IP capabilities making it near to impossible to monitor or secure serial traffic. OT admins and OT operators are using baselines to detect anomalies or other unwanted changes. Serial protocols run over RS-232, RS-422 or RS-485 interfaces. A SCADA serial protocol normally is using 8 or 16 bits addressing. They bring good memories to me! Examples: Serial Modbus and IEC-101.
Quote | IEC 60870-5-101 is a standard for power system monitoring, control & associated communications for telecontrol, teleprotection and associated telecommunications for electric power systems.
Today you still will find many old RTUs and PLCs with RS-232 interfaces in OT environments. Especially in the energy and manufacturing vertical.
Figure 2: Overview of Industrial Revolutions
When it comes to Industry 4.0 OT admins and OT operators can’t adopt Industry 4.0 as many assets (those who hold a serial interface) are not even connected to the network. As they lack IP capabilities. There are special solutions to address this, like a device server or a protocol converter. The device server can integrate the serial interfaces RS-232, RS-422 or RS-485 to Ethernet/LAN. The protocol converts the protocol and is also called "gateway" in the OT realm. Gateway example: connecting 2 serial field busses over an Ethernet interface. Think of PROFINET and ModbusTCP. Note the name gateway could be misleading as they are not gateways like we know from IT (with routing and that kind of features) The OT gateway is "just" a protocol converter.
Did you know we support with our Application Control blade the Ether-S-Bus serial protocol? At this moment, November 11 2023 we can inspect 1,838 SCADA applications. That number keeps on rising.
Figure 3: Overview of supported SCADA protocols
Our rugged gateways hold a serial port. We offer 1x DB9 supporting RS232, RS422 and R485 with terminal server support.
Figure 4: Industrial gateway, rugged 1570R
And what about DNP3? DNP3 stands for Distributed Network Protocol. It is also a master slave protocol used in industrial control systems. The DNP3 protocol was developed in 1990 by Westronic (now GE Harris) and published in 1993. Initially DNP3 used serial communications as IEC 101 in the past. Today DNP3 can also be used over TCP/IP or UDP/IP communications in IP networks. We can perform DPI, Deep Packet Inspection on DNP3. Making sure only certain OT admins or operators can argue a freeze command for example.
Figure 5: OT policy example using DNP3
Fri 10 Jan 2025 @ 10:00 AM (CET)
CheckMates Live Netherlands - Sessie 32: Infinity External Risk Management (CyberInt)Fri 10 Jan 2025 @ 10:00 AM (CET)
CheckMates Live Netherlands - Sessie 32: Infinity External Risk Management (CyberInt)
