Common ICS Protocols and Their Weaknesses

Most industrial protocols were designed decades ago for reliability on isolated networks, not for security against a networked adversary -- and understanding their weaknesses is essential for reasoning about what a compromise on an OT network can actually accomplish. Modbus, one of the most widely deployed protocols in industrial environments, has no authentication and no encryption in its classic form: any device that can reach a Modbus server on the network can issue read and write commands, including commands that change output states. This is precisely why network access control matters more than protocol hardening for legacy Modbus deployments -- the protocol itself will not stop an attacker who has network reachability. DNP3, common in utility and substation environments, added optional secure authentication in later revisions, but a large installed base still runs without it, and DNP3 traffic that reaches an unsegmented WAN link (common in geographically distributed utility networks) extends the attack surface far beyond a single site. OPC (and OPC UA, its more modern successor) is used heavily for interoperability between different vendors' systems. OPC UA meaningfully improved on classic OPC by adding authentication and encryption as first-class features, but the security benefit only materializes if those features are actually configured and enforced -- OPC UA can still be deployed insecurely if default or permissive settings are left in place. The practical takeaway for a security program is not to try to 'fix' these protocols -- most cannot be meaningfully hardened at the protocol layer without vendor and lifecycle constraints -- but to treat network segmentation, strict access control, and monitoring for anomalous command patterns as the primary compensating controls.