Study guide
8.5 OT, ICS & SCADA Security
EC-Council Certified Ethical Hacker CEH
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 CEH Exam Format, Cost & Eligibility 1.2 The Five Phases of Ethical Hacking 1.3 Information Security Fundamentals 1.4 Ethical Hacking Concepts, Scope & Legal Framework 1.5 The CEH Domains & Your Study Priority Map
2 Reconnaissance, Footprinting, Scanning & Enumeration
2.1 Footprinting & Reconnaissance Concepts 2.2 Footprinting Sources & Techniques 2.3 Network Scanning Concepts 2.4 Banner Grabbing, OS Fingerprinting & Scanning Beyond IDS/Firewall 2.5 Enumeration 2.6 Vulnerability Scanning & Countermeasures
3 Vulnerability Analysis & System Hacking Phases
3.1 Vulnerability Analysis Concepts 3.2 System Hacking Methodology Overview 3.3 Gaining Access: Password Attack Concepts 3.4 Privilege Escalation Concepts 3.5 Maintaining Access: Backdoors, Rootkits & Persistence 3.6 Covering Tracks, Anti-Forensics & Blue-Team Detection
4 Malware Threats, Sniffing & Social Engineering
4.1 Malware Concepts and Taxonomy 4.2 Malware Analysis and Detection 4.3 Sniffing Concepts and Layer 2 Attacks 4.4 Sniffing Countermeasures and Detection 4.5 Social Engineering Types and Human Psychology 4.6 Social Engineering and Insider Threat Defenses
5 Network & Perimeter Hacking
5.1 Denial of Service and DDoS Attacks 5.2 Session Hijacking 5.3 Evading IDS and IPS (Defensive Focus) 5.4 Evading Firewalls 5.5 Evading Honeypots and Defensive Deception 5.6 Network Security Controls and Architecture 5.7 Packet Analysis and Secure Protocols for Defenders
6 Web Server & Web Application Hacking
6.1 Web Server Attacks & Hardening 6.2 OWASP Top 10 Overview 6.3 Injection: SQL Injection & Command Injection 6.4 Cross-Site Scripting (XSS) & CSRF 6.5 Authentication, Session & Access-Control Flaws 6.6 API & Web App Security Testing Concepts
7 Wireless Network Hacking
7.1 Wireless Concepts and Standards 7.2 Wireless Encryption 7.3 Wireless Threats and Attack Concepts 7.4 Wireless Security Countermeasures
8 Mobile Platform, IoT & OT Hacking
8.1 Mobile Platform Threats & Security Models 8.2 Mobile Attack Vectors & Risks 8.3 Mobile Device Management & Enterprise Defense 8.4 IoT Hacking Concepts & Defense 8.5 OT, ICS & SCADA Security
9 Cloud Computing & Cryptography
9.1 Cloud Computing Concepts 9.2 Cloud Threats & Attack Surfaces 9.3 Cloud Security Controls 9.4 Cryptography Fundamentals 9.5 PKI & Cryptographic Applications 9.6 Cryptanalysis, Crypto Attacks & Best Practices
8.5 OT, ICS & SCADA Security
Key Takeaways Explain This Topic AI
OT prioritizes availability and safety, while traditional IT typically prioritizes confidentiality — this A-I-C inversion drives every OT defense decision
The Purdue model layers OT/IT into zones (Levels 0-5) with a demilitarized zone (DMZ) separating enterprise IT from the control network
Industrial protocols such as Modbus (TCP port 502) and DNP3 were built for reliability, not security, and often lack built-in authentication or encryption
Stuxnet (2010) targeted Siemens S7 PLCs via Step7/WinCC, over-sped uranium centrifuges, and masked the change on the HMI — the landmark ICS attack
Core OT defenses are zone segmentation, a controlled IT/OT DMZ, strict brokered remote access, and passive monitoring instead of active scanning
Last updated: June 2026
Why OT Security Is Different
Operational Technology (OT) is the hardware and software that monitors and controls physical processes — manufacturing lines, power grids, water treatment, oil and gas, building systems. Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) are categories of OT. CEH expects you to understand why OT defense differs from IT and to choose OT-appropriate controls. The single most important idea is the priority inversion of the security triad.
IT vs OT Priorities
- Dimension Traditional IT OT / ICS / SCADA
- Top priority Confidentiality Availability and safety
- Triad order C-I-A (confidentiality first) A-I-C (availability first)
- Downtime tolerance Often acceptable for patching Often unacceptable; can halt production or endanger people
- Device lifespan 3-5 years 10-30+ years (legacy, hard to patch)
- Patching Frequent, scheduled Rare, tightly controlled, vendor-validated
- Active scanning Routine Risky — can crash fragile controllers
- Primary impact of failure Data loss/breach Physical damage, safety hazard, outage
Why availability/safety dominates: in OT, an outage or a manipulated control command can damage equipment, spill chemicals, or harm people. A control that protects confidentiality but risks process disruption is often the wrong choice for OT. This is why routine IT practices — aggressive patching, active port scanning, forced reboots — are dangerous on a live plant floor.
The Purdue Model
The Purdue Enterprise Reference Architecture (Purdue model) is the standard way to describe OT/IT segmentation. It defines zones connected through controlled boundaries, with an IT/OT demilitarized zone (DMZ) isolating enterprise IT from the control network.
- Level Zone Examples
- Level 5 Enterprise network Corporate IT, internet-facing services
- Level 4 Site business / logistics Plant scheduling, email, ERP
- IT/OT DMZ Controlled boundary Patch servers, jump hosts, data brokers, historians mirror
- Level 3 Site operations Historians, OT domain services
- Level 2 Area supervisory control SCADA , Human-Machine Interface (HMI)
- Level 1 Basic control Programmable Logic Controllers (PLC), RTUs
- Level 0 Physical process Sensors, actuators, motors, valves
Lower levels are closest to the physical process and most safety-critical. The DMZ prevents direct IT-to-control connectivity; data flows through brokered, inspected paths only.
ICS Protocols (Conceptual)
Industrial protocols were built for deterministic reliability decades before modern security expectations, so most assume a trusted, isolated network.
Protocol Use Security characteristic
Modbus Simple master/slave control, broad industrial use; commonly TCP port 502 Classic Modbus has no authentication or encryption — any reachable node can issue commands
DNP3 (Distributed Network Protocol 3) Electric and water utilities Base DNP3 lacked authentication; DNP3 Secure Authentication extensions exist but are not always deployed
PROFINET / EtherNet/IP / OPC Automation, device messaging Generally weak or optional native security; rely on network controls
Exam takeaway: the systemic OT issue is not an exotic zero-day — it is that core protocols assume a trusted, isolated network that no longer exists once OT is bridged to IT. IT/OT convergence (connecting plant networks to corporate IT and the internet for analytics and remote support) delivers business value but exposes these unauthenticated protocols to a far larger threat population.
Case Study: Stuxnet
Stuxnet (discovered 2010) is the landmark ICS attack CEH expects you to recognize. It spread via Windows (using four zero-day vulnerabilities) to find systems running Siemens Step7 / WinCC SCADA software, then reprogrammed specific Siemens S7 PLCs controlling variable-frequency drives on uranium-enrichment centrifuges . It manipulated centrifuge speeds (well outside safe operating range) to physically damage them while replaying normal readings to the HMI so operators saw nothing wrong.
Stuxnet proved that a cyberattack can cause real-world physical destruction and that air-gapped OT is not invulnerable (it crossed via removable media). It is the reason OT defense emphasizes integrity of control logic, monitoring for anomalous commands, and rigorous removable-media and supply-chain controls.
OT-Specific Defenses
Zone segmentation: enforce the Purdue boundaries; never allow flat IT-to-PLC connectivity.
IT/OT DMZ: broker all cross-zone data through inspected hosts; no direct enterprise-to-control sessions.
Strict, brokered remote access: jump hosts, multi-factor authentication, session recording, and just-in-time access for vendors.
Passive monitoring: prefer passive network monitoring and anomaly/baseline detection over active scanning that can destabilize controllers.
Change-controlled patching: vendor-validated patches in maintenance windows; virtual patching /isolation as compensating controls when patching is impossible.
Removable-media and supply-chain control: the Stuxnet lesson — govern USB/removable media and vendor software.
Safety-first incident response: containment cannot trade physical safety for speed.
IT/OT Convergence Risks
For decades OT lived on isolated, sometimes air-gapped networks. Business pressure for real-time analytics, predictive maintenance, and remote vendor support has driven IT/OT convergence — connecting plant networks to corporate IT and, often, the internet. This delivers value but imports IT-style threats into an environment that was never designed to resist them. The specific convergence risks CEH tests are:
Exposed unauthenticated protocols: Modbus, DNP3, and similar become reachable from a much larger network, where any node can issue control commands.
Legacy, unpatchable systems: decades-old PLCs and HMIs run end-of-life operating systems that cannot be patched without vendor validation, if at all.
Remote access sprawl: vendor VPNs, jump hosts, and remote HMIs become high-value targets and frequent entry points.
Flat networks: without Purdue segmentation, a phishing foothold on the enterprise (Level 4/5) can reach control systems (Level 1/2) directly.
Removable media and supply chain: as Stuxnet showed, USB drives and trusted vendor software can cross even an air gap.
The defensive answer to convergence is not to abandon it but to constrain it: enforce the Purdue boundaries, route all cross-zone traffic through the inspected IT/OT DMZ, broker remote access through hardened jump hosts with MFA and session recording, and monitor passively for anomalous commands. The recurring exam theme is that OT cannot simply adopt IT security practices wholesale — aggressive scanning, forced patching, and reactive reboots that are routine in IT can halt production or create a safety hazard in OT. Every OT control decision must respect the availability-and-safety-first priority.
When a question pits a confidentiality-protecting action against process availability or human safety, the OT-correct answer protects availability and safety.