What are industrial control systems (ICS)?

Industrial control systems (ICS) in plain English

ICS is an umbrella term for the technology that makes machines and plants run automatically. Office IT processes data such as emails, invoices, and documents. Industrial control systems, by contrast, move real things: they open valves, regulate temperatures, start motors, and monitor fill levels. The overarching term for this world is OT (operational technology).

A comparison: an ICS works like a factory’s nervous system. Sensors are the sense organs, controllers the fast reflexes, and the control room is the brain that keeps track of the big picture. If the nervous system is disrupted, the whole body is thrown off balance.

How an ICS works

An ICS typically consists of several layers:

1. Field devices: Sensors measure pressure, temperature, or rotational speed. Actuators such as motors, pumps, and valves carry out commands.
2. Controllers: Programmable logic controllers (PLCs) process the measured values in real time and switch the actuators.
3. Operation and monitoring: On operator panels (HMI, human-machine interface), employees see the status of a machine and intervene.
4. Control systems: SCADA systems monitor geographically distributed facilities from a central location. Distributed control systems (DCS) control complex processes, for example in the chemical industry.
5. Engineering and remote maintenance: Controllers are programmed via engineering workstations – computers with special programming software. Remote maintenance access lets manufacturers and service providers connect from outside.

Many industrial protocols date back to a time when plants were cut off from the rest of the world. They often transmit commands unencrypted and without checking who is sending them. Anyone with access to the network may then be able to give a controller new commands directly.

Priorities also differ from those in office IT. Availability and functional safety – the protection of people and the environment – come first. Plants often run for decades, and updates require downtime and approval from the manufacturer.

A practical example

Here’s a typical scenario: A foundry controls its melting furnaces and molding lines via several controllers and a central control system. An OT penetration test reveals that the engineering workstation used to program the controllers doubles as an ordinary office PC – with an email program and internet access. Updates for its operating system hadn’t been installed for years because the plant wasn’t supposed to be shut down.

A single malicious email attachment would have been enough to plant malware right next to the controllers. The foundry then disconnects the engineering workstation from the office network, removes email and internet access, and further isolates the outdated system until it can be replaced.

Why does this matter for businesses?

Attacks on ICS have physical consequences: production downtime, defective products, damaged equipment, and, in the worst case, dangers to people and the environment. Ever since the Stuxnet computer worm came to light in 2010, it has been clear that malware can sabotage industrial plants, too.

At the same time, the former isolation is disappearing. Remote maintenance, cloud connections, and networking as part of Industry 4.0 are creating new paths from outside into production. An attack on office IT can also bring manufacturing to a halt if production processes depend on IT systems.

Regulatory pressure is rising, too. NIS2 covers not only energy and water utilities but also many medium-sized and large companies in industrial sectors such as machinery, vehicle manufacturing, electrical engineering, and chemicals. IEC 62443 is regarded as the leading series of standards for the security of industrial automation systems.

How to protect your organization

• Create an inventory: Record all components, firmware versions, and connections of your facilities.
• Separate networks: Separate office IT from production and allow only connections that are explicitly required. The zone model of IEC 62443, which divides plants into clearly defined security zones, provides guidance.
• Secure remote maintenance: Route remote access through a central, logged access point with multi-factor authentication and enable it only when needed.
• Harden controllers: Change default passwords, activate the controllers’ access protection, and switch off services you don’t need.
• Detect attacks: Use passive attack detection that monitors traffic on the OT network without interfering with the plant.
• Prepare for emergencies: Back up controller programs and configurations, and practice restarting operations.
• Plan updates: Coordinate patches with the manufacturer and install them during maintenance windows. Where that isn’t possible, add extra safeguards for the systems.

How Rootsektor can help

With a penetration test for OT, ICS/SCADA & IoT, we examine the path from the office network into production as well as individual controllers, protocols, and remote maintenance access points. We start passively, test actively only after approval, and agree on test windows, abort criteria, and escalation paths with your operations team in advance. We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person. You can get a fixed-price quote after scoping via our Pentest Quote page.