Introduction

ICS/OT protocols play a vital role in the operation of critical infrastructure. Electricity networks, water treatment facilities, factories, and building automation systems rely on them every day. These protocols allow industrial devices to exchange information, monitor equipment, and execute control commands. Without them, many essential industrial processes could not function efficiently.

However, growing connectivity has introduced new cybersecurity challenges. Many industrial communication protocols were developed for isolated networks, where devices operated within trusted environments. Their original designs often lacked strong authentication, encryption, and access controls. As organizations connect industrial systems to wider networks, attackers gain more opportunities to target exposed equipment.

Why ICS/OT Protocols Matter for Cybersecurity

Industrial communication protocols connect the devices that monitor and control physical processes. These include Programmable Logic Controllers (PLCs), Remote Terminal Units (RTUs), Human-Machine Interfaces (HMIs), and SCADA systems. Through these connections, industrial equipment exchanges measurements, reports operational conditions, and receives control instructions.

Unlike standard IT communications, industrial messages can directly affect physical equipment. A command might activate a pump, adjust a production parameter, or operate an electrical circuit breaker. As a result, unauthorized communications may affect more than digital information. They can also disrupt equipment and industrial operations.

Many traditional ICS/OT protocols lack built-in mechanisms to verify the identity of communicating devices. Attackers who gain network access may therefore send commands that follow the protocol’s rules but lack authorization. Such activity does not always require a software vulnerability. Instead, attackers may misuse legitimate functions to interfere with industrial processes.

Understanding the security characteristics of each protocol helps organizations identify these risks and select suitable safeguards.

Modbus TCP: A Common Industrial Protocol with Security Limitations

Modbus is one of the most widely used communication protocols in industrial automation. Manufacturing plants, energy facilities, and water treatment systems use it to exchange operational data. Modbus TCP allows controllers to read registers, retrieve device information, and write control values across Ethernet networks.

Its simple design makes Modbus easy to implement across different industrial devices. However, traditional Modbus TCP does not provide native authentication or encryption. Attackers who gain access to the relevant network may send requests without proving their identity.

For example, an unauthorized Modbus write request could change a process value if the controller accepts it. The consequences depend on the device, its configuration, and the affected industrial process. Such activity could interfere with equipment operation or disrupt production.

Modbus Security introduces TLS-based protection and certificate authentication. However, many industrial facilities continue to operate legacy equipment that uses traditional Modbus communications. Security teams must therefore restrict network access and monitor command activity to identify suspicious interactions.

DNP3 and IEC 104: Communication Across Critical Infrastructure

Electricity and water utilities often manage equipment across large geographical areas. They depend on industrial communication protocols to connect remote facilities with centralized control systems. DNP3 and IEC 60870-5-104 support these operations by carrying measurements, equipment status, and control commands.

DNP3: Remote Monitoring and Control

Distributed Network Protocol 3 (DNP3) is widely used in electricity and water infrastructure, particularly in North America. It allows SCADA systems to communicate with RTUs and other field devices. Operators use these connections to monitor equipment and control remote installations.

Traditional DNP3 implementations offer limited native authentication. This can create opportunities for message spoofing, replay attacks, or unauthorized commands when networks lack adequate protection. DNP3 Secure Authentication helps verify important communications, although device compatibility and configuration influence its deployment.

IEC 104: Power System Telecontrol

IEC 60870-5-104, commonly called IEC 104, is widely used in European electricity networks. It connects control centers with remote substations through TCP/IP communication.

Traditional IEC 104 does not include native encryption or authentication. Attackers with sufficient network access may attempt to intercept messages, manipulate communications, or issue unauthorized commands. The IEC 62351 standards provide mechanisms to strengthen security, but legacy equipment can complicate adoption.

Both protocols support essential remote operations. Their security therefore plays an important role in protecting distributed critical infrastructure against cyber threats.

IEC 61850: Securing Electrical Substation Communications

IEC 61850 supports communication and interoperability within electrical substations. It connects protection relays, controllers, supervisory systems, and other intelligent electronic devices. The standard defines data models and communication services that help this equipment exchange information efficiently.

Key IEC 61850 Communication Mechanisms

IEC 61850 includes several mechanisms that serve different operational purposes:

• MMS (Manufacturing Message Specification): Supports supervisory communication and device data exchange.
• GOOSE (Generic Object Oriented Substation Event): Enables fast event communication between substation devices.
• Sampled Values (SV): Carries digitized electrical measurements between compatible systems.

These communications can support essential monitoring, automation, and protection functions. For example, protection devices may exchange time-sensitive event messages to coordinate their response to electrical faults.

IEC 61850 Cybersecurity Risks

Attackers who access inadequately protected substation networks may attempt to manipulate or disrupt communication. Forged messages could potentially influence protection behavior, depending on the system and its safeguards. Such activity may affect equipment reliability or interrupt operations.

IEC 62351 provides security mechanisms for power-system communications. However, organizations must consider the strict timing and availability requirements of substation equipment before applying security changes. These operational demands make IEC 61850 security a specialized area of OT cybersecurity.

EtherNet/IP and Siemens S7: Protecting Industrial Automation

Manufacturing facilities rely on industrial controllers to manage machines, production lines, and automated processes. EtherNet/IP and Siemens S7 communications support these environments by connecting controllers, drives, engineering workstations, and supervisory systems.

EtherNet/IP and CIP Security

EtherNet/IP uses the Common Industrial Protocol (CIP) to exchange information between industrial devices. It supports equipment monitoring, configuration, and automation functions.

Traditional deployments may lack strong communication authentication or encryption. An attacker with sufficient network access could attempt unauthorized interactions with industrial equipment. CIP Security addresses several of these risks through authentication, encryption, and message-integrity mechanisms.

However, organizations need compatible devices and suitable configurations to use these protections effectively.

Siemens S7 Communication Security

Siemens S7 communications support data exchange and engineering operations involving Siemens industrial controllers. Older PLC generations may offer limited native communication security. This makes engineering workstations and network access controls important security considerations.

Attackers who compromise an engineering workstation may attempt to retrieve controller information or modify configurations. In some cases, they may also try to interfere with control logic. Protecting engineering access helps reduce the likelihood of unauthorized changes to industrial processes.

BACnet, KNX, and Niagara FOX: Building Automation Security

Building automation systems also form part of the industrial cybersecurity landscape. Hospitals, data centers, transportation facilities, and other critical sites use these technologies to manage essential building functions. Their equipment often controls heating, ventilation, lighting, and energy consumption.

BACnet and KNX

BACnet connects building management systems with automation equipment. Traditional BACnet/IP offers limited native security, which can create risks when networks allow unauthorized access. BACnet Secure Connect improves communication protection through TLS.

KNX supports building automation functions such as lighting and climate control. Insecure KNX IP gateways may expose connected equipment to unauthorized interactions. KNX Secure introduces authentication and encryption to protect supported communications.

Niagara FOX and Internet Exposure

Niagara FOX supports communication within the Tridium Niagara building automation framework. Organizations use this framework to integrate and manage different building systems.

Legacy installations and poorly secured management interfaces may create opportunities for unauthorized access. These risks become more significant when external networks can reach sensitive services.

Bitsight’s 2026 research identified Niagara FOX and Modbus as major contributors to observed internet-facing industrial services. This finding shows that cybersecurity exposure affects more than factories and power plants. It also extends to the systems that support critical buildings and facilities.

OPC UA: Modern Industrial Connectivity and Security

OPC Unified Architecture (OPC UA) enables industrial devices, applications, and supervisory systems to exchange information. It supports interoperability across different vendors and technologies, making it useful for modern industrial environments.

Unlike many legacy ICS/OT protocols, OPC UA includes several security capabilities. These include certificate-based authentication, message signing, encryption, and access control. Organizations can use these features to protect industrial data and verify communicating applications.

Why OPC UA Configuration Matters

Strong security features do not automatically make every deployment secure. OPC UA servers may allow connections using the None security policy. This setting provides neither message signing nor encryption.

If an organization exposes such a service to untrusted networks, attackers may gain opportunities to access information or interfere with communication. The actual impact depends on the server’s permissions and available functions.

Bitsight’s research highlights insecure OPC UA configurations as a concern in internet-accessible industrial environments. Organizations should therefore review security policies, certificates, permissions, and network access when deploying OPC UA.

How Internet Exposure Expands ICS/OT Protocol Security Risks

Industrial devices increasingly support services beyond their main control protocols. A controller may use Modbus or EtherNet/IP while also providing web administration, SSH access, or file transfer services. These additional functions help operators maintain equipment and exchange data, but they can also expand the attack surface.

For example, an organization may restrict access to its industrial control protocol while leaving a management interface exposed. Attackers could then target the interface rather than the protocol itself. Industrial gateways can create similar risks when they connect older equipment to IP networks.

Bitsight’s findings underline the importance of assessing the complete network exposure of industrial equipment. Internet accessibility does not automatically mean that attackers have compromised a device. However, unnecessary exposure can increase the opportunities for reconnaissance and exploitation.

Critical infrastructure operators must therefore examine control protocols, management interfaces, remote-access connections, and other enabled services.

Key Takeaway: Internet exposure does not automatically mean an industrial device has been compromised. However, unnecessary connectivity increases opportunities for reconnaissance, unauthorized access, and potential exploitation.

How to Improve ICS/OT Protocol Security

Organizations can reduce industrial communication risks by combining secure network architecture with better visibility and monitoring. No single control can protect every industrial environment. Security teams must consider the protocols, equipment, and operational requirements involved.

Reduce Exposure and Strengthen Access Controls

An accurate asset inventory provides a useful starting point. Organizations should identify which industrial devices operate on their networks and which services they expose. They should also review whether each connection serves a necessary operational purpose.

Network segmentation can restrict communication between enterprise systems and sensitive industrial equipment. Secure remote access and supported protocol security features provide additional protection. Where possible, operators should remove unnecessary internet exposure.

Monitor Industrial Protocol Activity

Protocol-aware monitoring helps security teams understand what industrial devices communicate and which commands they exchange. This goes beyond basic network monitoring, which may reveal connections without explaining their operational purpose.

For example, unexpected Modbus write operations or unusual IEC 104 control commands may require investigation. Suspicious engineering workstation activity can also indicate attempts to access sensitive controllers.

However, monitoring tools must consider operational context. Maintenance tasks, production changes, and equipment updates may create legitimate variations in network behavior. Security teams need this context to distinguish routine operations from potential cyber threats.

ICS/OT Protocol Security and AI-Powered Threat Detection

Industrial protocol visibility creates opportunities for more effective cybersecurity monitoring. By examining communication patterns, command types, and device relationships, security teams can better understand activity inside industrial networks. This information helps them investigate events that may indicate unauthorized access or malicious operations.

AI-supported analysis can assist by identifying unusual communication patterns and correlating security events. For example, it may help analysts recognize unexpected interactions between supervisory systems and industrial controllers. However, AI should support established security controls and human expertise rather than replace them.

These challenges connect directly to the objectives of AICOT. The project aims to develop AI-powered cybersecurity capabilities for Operational Technology and critical infrastructure. Its focus includes industrial protocol analysis, OT monitoring, anomaly detection, and advanced security analytics.

By combining communication data with asset and operational context, AICOT aims to strengthen threat detection in industrial environments. This approach supports a better understanding of suspicious activity and its potential effect on physical operations.

Conclusion: Strengthening Critical Infrastructure Cybersecurity with AICOT

ICS/OT protocols support essential services across electricity networks, water infrastructure, manufacturing, and building automation. Technologies such as Modbus, DNP3, IEC 104, IEC 61850, EtherNet/IP, Siemens S7, BACnet, KNX, Niagara FOX, and OPC UA all serve different purposes. Their security capabilities also vary significantly.

As organizations connect more equipment and enable additional services, they must pay greater attention to their cybersecurity exposure. Understanding industrial protocols, limiting unnecessary access, and monitoring suspicious communication are important steps toward protecting critical infrastructure.

These challenges align with the mission of AICOT, a European initiative developing an AI-powered cybersecurity platform for OT environments. The project aims to combine industrial protocol analysis, machine learning, anomaly detection, and advanced security analytics. It also seeks to strengthen proactive threat detection and support secure, privacy-preserving threat intelligence sharing.

Led by Logstail, AICOT builds on expertise in SIEM, cybersecurity analytics, and security operations. The project extends these capabilities toward the specific challenges of industrial environments and critical infrastructure.

Ultimately, securing industrial communications requires both technical safeguards and a clear understanding of operational risks. Through its research and innovation activities, AICOT aims to support more effective OT threat detection and improve the protection of Europe’s essential industrial systems.

Learn more about the AICOT project and its approach to industrial cybersecurity. For additional context on European critical infrastructure protection, read AICOT’s article on NIS2, CER, and OT resilience.

AICOT is funded by the European Union’s Digital Europe Programme under Grant Agreement No. 101249826.

Views and opinions expressed are those of the authors only and do not necessarily reflect those of the European Union or the European Cybersecurity Competence Centre. Neither the European Union nor the granting authority can be held responsible for them.

 

Contact Our Experts or Sign Up for Free