Download Attacking Programmable Logic Controllers

Product and process control are usually feed-back or feed-forward control loops whereby
key product and/or process conditions are automatically maintained around a set point.
PLC are often used as field devices and can offer a range functionality to accomplish the
desired product or process tolerance. A typical architecture is illustrated in Figure 2.1
(Borrowed from [71])
Figure 2.1: A typical DCS architecture
When they were first developed, ICS had very little in common with IT systems. ICS
were isolated and ran proprietary software. In recent year there has been a shift towards
utilizing low cost Internet Protocol (IP) devices. Replacing proprietary solutions with well
known protocols and software lowers the threshold for implementing a wide range of new
features. This shift significantly narrows the gap between ICS and IT systems. While this
allows for closer connection between the existing corporate network and the ICS, this also
means that the ICS is less isolated from the outside world than its proprietary predecessor.
2.2
Network architectures
Industrial control systems are seldom based on a single field device. The complexity of
the system grows rapidly as more components are added to the system, thus creating a
need to organize the components in a way that is easy to work with. Communication
networks for industrial control systems are usually built in a layered/hierarchical way as
shown in Figure 2.2.
Different parts of the system have different requirements. For communication between
the process network and the corporate network, Ethernet is a suitable protocol. However,
for communication between the PLC and the actuators and sensors, a different set of
protocols are better suited. In the following three subsections we will take a close look at
each of the three layers and protocols suited.
10