What an industrial control system actually is
An industrial control system is the set of equipment that reads the state of a physical process and acts on it. Programmable logic controllers hold the logic that opens a valve or starts a motor. Remote terminal units perform the same role across geographically dispersed sites. Intelligent electronic devices in a substation trip breakers within milliseconds. Field instrumentation reports pressure, flow and temperature back to all of them.
Above that sits the supervisory layer, the human-machine interfaces and historians that operators watch. That layer is covered separately under SCADA security, because its risks and its defences are different. This page is about the control layer itself.
The defining property of the control layer is that its outputs are physical. A wrong value written to a register does not corrupt a record; it changes what a machine does. That is why security controls here are judged first on whether they can be applied without touching the controller at all.
The protocols, and why generic tooling cannot read them
Control systems speak protocols designed for determinism rather than for security. Modbus, still ubiquitous, has no authentication whatsoever. Siemens S7comm, EtherNet/IP with CIP, Profinet, DNP3 and IEC 61850 all carry commands that change process state, and most carry them without proving who sent them.
A conventional security tool observing this traffic sees a TCP session and a byte count. It cannot tell a routine setpoint update from a command that will run a pump dry, because it does not decode the protocol to the point where the distinction exists. Spharaka Signal carries 276+ protocol decoders and reads them at the application layer, which is the minimum needed to see the command rather than the connection.
Decoding alone is still not enough, which is the point most tooling stops at. Knowing that function code 06 wrote to register 40001 tells a control engineer nothing. What matters is which tag that register is, what engineering unit it carries, what its safe range is, whether it is safety-relevant, and which zone is permitted to write it.
Register semantics: the difference between data and meaning
Signal resolves each register to its meaning through a five-tier ladder: a per-customer override first, then an exact device-model match, then a vendor-wide fallback, then a generic protocol match, and finally an explicit miss. Every event records which tier matched, so coverage is auditable rather than assumed, and the misses can be reviewed and promoted into the map.
That resolution happens inline as the event is written rather than in a later batch, so a query can filter on safety relevance from the moment the traffic is seen. It is what turns an unanswerable question into a one-line detection: alert when a write to a safety-relevant register originates anywhere other than the engineering workstation zone.
No signature rule can express that, because a signature engine has no idea what register 40001 means on that specific controller.
Safety systems are a separate category of risk
Safety-instrumented systems exist to bring a process to a safe state when the basic process control system fails. They are frequently on the same network, and occasionally on the same segment, as the equipment they are protecting.
Signal treats them as a distinct class. Active polling is never pointed at a safety controller under any configuration. Traffic to and from safety-related classes, including CIP Safety, is decoded and monitored, and registers marked safety-relevant escalate severity automatically when written from an unexpected source.
Where a safety instrumented function has a SIL rating and a proof-test schedule, those live on the asset record, so the security view and the functional safety view describe the same device rather than two parallel inventories.
Integrity: detecting change you did not authorise
Most consequential ICS incidents involve a change to the controller rather than traffic to it. Four artefacts are monitored continuously: the program logic, compared by hash against a captured baseline; configuration blocks, compared against an approved snapshot; firmware version, against both the vendor current release and your own approved build; and controller mode.
Mode transitions carry information on their own. A controller moving from RUN to PROGRAM outside a maintenance window is worth an alert by itself. A program hash that diverges after that transition is worth a critical one. Signal captures both, links them, and renders the sequence so an analyst sees the whole picture without assembling it by hand.
- Program logic hash against a captured baseline
- Configuration drift from an approved snapshot
- Firmware version against vendor current and your approved build
- Controller mode transitions across RUN, PROGRAM, STOP and FAULT
- Correlation against declared maintenance windows, so authorised change is distinguished from unauthorised
Vulnerabilities on equipment that cannot be patched
Vulnerability management in a control system estate cannot rely on agents or on active scanning, both of which have caused outages. Signal derives the device fingerprint passively and matches it against the vulnerability catalogue, so a controller is assessed without a packet being sent to it.
Prioritisation then has to be realistic about what can actually be done. A high CVSS score on an end-of-life gateway behind strong segmentation is a different problem from a known-exploited vulnerability on a device reachable from the enterprise network. Signal weights CVSS, exploit prediction and the CISA known-exploited catalogue together, and records compensating controls so that a decision not to patch for eighteen months is documented rather than merely tolerated.
Frequently asked questions
What is ICS security?
Industrial control system security protects the equipment that directly monitors and controls a physical process: programmable logic controllers, remote terminal units, intelligent electronic devices and the industrial protocols connecting them. Its defining constraint is that a mistake changes what machinery does rather than what a record says.
How is ICS security different from SCADA security?
ICS security concerns the control layer that acts on the process. SCADA security concerns the supervisory layer above it, the human-machine interfaces, historians and telemetry links operators work with. The two overlap in practice, but the assets, the protocols and the failure modes differ enough to be worth treating separately.
Can you scan a PLC for vulnerabilities?
Active scanning of production controllers has caused outages and is generally avoided. Spharaka Signal identifies devices passively from their traffic and matches that fingerprint against the vulnerability catalogue, so a controller is assessed without receiving a packet from the security platform. Active OT polling exists but is opt-in, explicitly scoped, and never pointed at a safety controller.
How do you detect an unauthorised change to PLC logic?
By comparing the program hash against a captured baseline continuously, and by watching controller mode transitions. A move from RUN to PROGRAM outside a maintenance window is itself worth an alert; a hash divergence after that transition is critical. Signal links the two so the sequence is visible as one event rather than two unrelated ones.
Why do industrial protocols lack authentication?
Most were designed for deterministic performance on isolated networks decades before those networks were routable. Authentication adds latency and complexity that the original design goals did not accommodate. Newer options such as OPC UA include security, but the installed base still runs largely on protocols that do not, which is why monitoring rather than protocol-level trust carries the load.
What is a safety-instrumented system and how is it protected?
A safety-instrumented system brings a process to a safe state when normal control fails. Signal never actively polls one. It monitors traffic to and from safety-related classes, escalates severity automatically when a safety-relevant register is written from an unexpected source, and holds the SIL rating and proof-test date on the asset record so the security and functional safety views describe the same device.
Part of the cluster
OT Cybersecurity
The pillar page for operational technology security.