OT Technologies and Protocols PDF

Certified Cybersecurity Technician Exam 212-82 loT and OT Security OT Technologies and Protocols OT Technologies and Protocols over Purd...

Certified Cybersecurity Technician Exam 212-82 loT and OT Security OT Technologies and Protocols OT Technologies and Protocols over Purdue Model OT Technologies and Protocols Industrial network protocols constitute the real-time interconnectivity and information exchange between industrial systems and zones. These network protocols are deployed across the ICS network in any industry. To understand any industrial network, a security engineer needs to understand the protocols existing beneath the networks. The key communication technologies and protocols of the OT network over the Purdue model defined by ISA-95 are as follows: Figure 13.24: OT technologies and protocols over the Purdue model Module 13 Page 1616 Certified Cybersecurity Technician Copyright © by EG-Gouncil All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Exam 212-82 loT and OT Security Protocols used in Level 4 and 5 DCOM: DCOM (Distributed Component Object Model) is Microsoft’s proprietary software that enables software components to communicate directly over a network reliably and securely. DDE: DDE (Dynamic Data Exchange) is used for IPC (Inter-Process Communication). FTP/SFTP: FTP establishes a connection to the specific server or computer, and it is also used to download or transfer files. SFTP verifies the identity of the client, and once a secured connection is established information is exchanged. GE-SRTP: GE-SRTP (Service Request Transport Protocol), developed by GE Intelligent Platforms, is used to transfer data from PLCs, and runs on a selected number of GE PLCs that turn digital commands into physical actions. IPv4/IPv6: IPv4 is a connectionless protocol used in packet-switched networks. IPv6 is used for packet-switched internetworking, which provides end-to-end datagram transmission across multiple IP networks. OPC: OPC (Open Platform Communications) is a set of client/server protocols designed for the communication of real-time data between data acquisition devices like PLCs and interface devices like HMls. TCP/IP: TCP/IP is a suite of communication protocols used for the interconnection of networking devices over the Internet. Wi-Fi: Wi-Fi is a technology that is widely used in wireless local area networking or LAN. The most common Wi-Fi standard used in homes or companies is 802.11n, which offers a maximum speed of 600 Mbps and a range of approximately 50 m. Protocols used in Level 3 CC-Link: A CC-Link (Control and Communications Link) is an open industrial network that enables devices from different manufacturers to communicate. It is used in machine, process control, and building automation. HSCP: Hybrid SCP (Secure Copy Protocol) is developed for transmitting larger file sizes at high speed on long-distance and wideband infrastructure. ICCP (IEC 60870-6): ICCP (Inter-Control Center Communications Protocol) (IEC 60870-6) provides a set of standards and protocols for covering ICS or SCADA communication in power system automation. IEC 61850: IEC 61850 is a common protocol that enables interoperability and communications between the IEDs at electrical substations. ISA/IEC 62443: ISA/IEC 62443 provides a flexible framework for addressing and mitigating current and future security vulnerabilities in industrial automation and control systems. Modbus: Modbus is a serial communication protocol that is used with PLCs and enables communication between many devices connected to the same network. Module 13 Page 1617 Certified Cybersecurity Technician Copyright © by EC-Gouncil All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Exam 212-82 loT and OT Security NTP: NTP (Network Time Protocol) is a networking protocol that is used for clock synchronization between computer systems over packet-switched and variable-latency data networks. Profinet: Profinet is a communication protocol used to exchange data between controllers like PLCs and devices like RFID readers. SuiteLink: SuiteLink protocol is based on TCP/IP and runs as a service on Windows operating systems. It is mostly used in industrial applications that value time, quality, and high throughput. Tase-2: Tase-2, also referred to as IEC 60870-6, is an open communication protocol that enables the exchange of time-critical information between control systems through WAN and LAN. Protocols used in Level 2 6LOWPAN: IPv6 over Low Power Personal Area Networks (6LOWPAN) is an Internet Protocol used for communication between smaller and low-power devices with limited processing capacity; it is mainly used for home and building automation. DNP3: DNP3 (Distributed Network Protocol 3) is a communication protocol used to interconnect components within process automation systems. DNS/DNSSEC: Domain Name System Security Extensions (DNSSEC) provide a way to authenticate DNS response data and can secure information provided by DNS. FTE: Fault Tolerant Ethernet (FTE) is designed to provide rapid network redundancy, and each node is connected twice to a single LAN through dual network interfaces. HART-IP: The HART-IP protocol is used to integrate WirelessHART gateways and HART multiplexers tightly and efficiently for sending and receiving digital information. IEC 60870-5-101/104: This is an extension of the IEC 101 protocol with some modifications in transport, network, link, and physical layer services. It enables communication between the control station and substation through the standard TCP/IP network. SOAP: SOAP (Simple Object Access Protocol) is a messaging protocol containing a stern set of rules that can administrate data transfer between client and server using the XML message format. Protocols used in Level 0 and 1 BACnet: BACnet (Building Automation and Control network) is a data communication protocol designed for building automation and control networks that implements standards such as ASHRAE, ANSI, and ISO 16484-5. EtherCAT: Ethernet for Control Automation Technology (EtherCAT) is an Ethernet-based fieldbus system that is appropriate for both hard and soft real-time computing necessities in automation technology. Module 13 Page 1618 Certified Cybersecurity Technician Copyright © by EG-Council All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Exam 212-82 loT and OT Security = CANopen: CANopen is a high-level communication protocol based on the CAN (Controller Area Network) protocol. It is used for embedded networking applications like vehicle networks. ®= Crimson: Crimson is the common programming platform used for a variety of Red Lion products such as G3 and G3 Kadet series HMIs, Data Station Plus, Modular Controller, and the Productivity Station. = DeviceNet: DeviceNet is another variant of the Common Industrial Protocol (CIP) that is used in the automation industry for interconnecting control devices to exchange data. = Zigbee: Zigbee is a short-range communication protocol that is based on IEEE 203.15.4 standard. Zigbee is used for devices that transfer data intermittently at a low data rate in a restricted area and within a range of 10-100 m. = |SA SP100: ISA SP100 is a committee for establishing the industrial wireless standard ISA100. ISA100 is used for the industrial manufacturing environment and process automation industry. = MELSEC-Q: MELSEC-Q provides an open and seamless network environment integrating different levels of automation networks such as CC-Link IE, high-speed, and large- capacity ethernet-based integrated open networks. = Niagara Fox: Niagara Fox protocol is a building automation protocol used between the Niagara software systems developed by Tridium. ®= Omron Fins: Omron Fins is used by PLC programs for transferring data and performing other services with remote PLC connected on an Ethernet network. It can also be used by remote devices such as FieldServer for transferring data. = PCWorx: PCWorx is used in many ICS components, and they make a series of inline controllers (ILCs). These controllers allow the use of different ICS protocols and some common TCP/IP protocols. = Profibus: Profibus is more complex than Modbus, and is designed and developed to address interoperability issues. It is employed in process automation and factory automation fields. = Sercos ll: The serial real-time communication system (Sercos Il) comprises a digital drive interface appropriate for use in industrial machines. It is used in complex motion control applications with high specification designs. = S§7 Communication: S7 Communication is a Siemens proprietary protocol that runs between programmable logic controllers (PLCs) of the Siemens $7-300/400 family and is used in PLC programming and for accessing PLC data from SCADA. = WiMax: Worldwide Interoperability for Microwave Access (WiMax) is based on the standard IEEE 802.16 and is envisioned for wireless metropolitan area networks. WiMax operates at frequencies between 2.5 GHz and 5.8 GHz with a transfer rate of 40 Mbps. Module 13 Page 1619 Certified Cybersecurity Technician Copyright © by EG-Gouncil All Rights Reserved. Reproduction is Strictly Prohibited.