CISSP 9.6 - Industrial Control Systems

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series explores the systems that run our physical world, continuing Domain 3. These machines do not just move data — they open valves, spin turbines, and run assembly lines — so protecting them is where digital security meets physical safety, often on gear that was never built with attackers in mind.

Frequently Asked Questions

What is an industrial control system?

An industrial control system is a computer-based device that manages industrial processes and machinery, a category often called operational technology. You find these systems running manufacturing lines, power generation and distribution, water and sewage handling, and oil refining — the quiet brains behind heavy industry.

What are the main forms of industrial control systems, and how do they scale?

Three forms climb a ladder of scale. A programmable logic controller is a focused, single-purpose computer that automates one electromechanical job, like driving a stretch of an assembly line. A distributed control system links several such controllers within a limited area, with a central location issuing commands and gathering status, and a supervisory control and data acquisition system stretches that reach across vast geographic areas using a human-machine interface. One controller might run a single transformer, a distributed system a whole power station, and the supervisory system an entire power grid.

How do these systems talk to each other?

Largely through a long-established industrial protocol that has become a de facto standard for connecting devices on the plant floor, giving machines from many different manufacturers a common language to exchange data and commands. That very openness is a double edge: it delivers the interoperability the industry depends on, but an open, widely understood protocol is also easier for an attacker to speak.

Why have industrial control systems been so poorly secured?

Their static design and bare interfaces once seemed protection enough, so little real security was built in. That assumption held until serious, well-known compromises arrived, including a landmark piece of malware that planted the first known rootkit inside a control system at a nuclear facility. Vendors have since started adding protections, yet many of these systems remain weakly defended, rarely patched, and full of older versions never designed with security in mind.

How do you harden industrial control systems?

Isolate the control networks from general traffic, restrict access both physically and logically, allow only essential applications to run, change the default credentials that ship with the gear, and log all activity. The crucial shift is in priorities: where ordinary IT often leads with confidentiality, the top concern for operational technology is availability, because a paused real-time control signal can mean a physical disaster. Recognized industry and government standards exist to guide this work.

Reference: This article is based on concepts discussed in CISSP 9.6 - Industrial Control Systems.