The ‘air-gap’ is often compromised via physical media (USB drives, laptops) brought in by third parties for maintenance or updates. This is a classic attack vector in supposedly isolated ICS environments. While other risks exist, the introduction of malware via removable media is the most practical and common threat to an air-gapped system.

PLC-to-external-internet communication, especially on a common port like 443 (HTTPS), is highly anomalous and a strong indicator of compromise. Malware often uses such channels for command and control (C2) communication. This is a critical finding requiring immediate containment.

A stateful inspection firewall is the standard and most appropriate device for segmenting IT and OT networks. It can be configured with granular rules to allow only specific, necessary communication (e.g., historian data pulls) while blocking all other traffic. Data diodes are for one-way data flow only, routers lack deep packet inspection, and an IPS is for threat detection/blocking, not primary segmentation.

In the Purdue Model, Level 2 (Supervisory Control) is where supervisory functions reside. This includes HMIs, which provide the operator interface to the process, and Data Historians, which collect and store time-series process data from lower levels (0,1).

Modbus (and many other legacy ICS protocols) has no native security features. It lacks authentication, encryption, and message integrity checks. All commands and data are transmitted in plaintext, making them susceptible to eavesdropping, replay, and unauthorized command injection.

The first critical step is eradication—ensuring the malicious presence (malware, backdoors, compromised accounts) is completely removed from the environment. Restoring a backup into a still-infected network will likely lead to immediate re-compromise, wasting effort and potentially restoring corrupted data.

Least privilege means users and systems have only the permissions absolutely necessary to perform their functions. On an engineering workstation, this prevents unauthorized or accidental changes to critical control logic, setpoints, and configurations, which is a fundamental security and safety control in OT environments.

Data Integrity Verification mechanisms, such as checksums, hashes (e.g., SHA-256), or digital signatures, are designed to detect unauthorized alterations to data. In this context, they could ensure that pressure sensor readings have not been modified in transit from the field device to the controller or HMI.

Active scanning with exploit-like packets can disrupt fragile industrial devices. This incident underscores that active scanning is often too risky for production OT networks. Passive monitoring techniques (listening to network traffic) and vendor-assisted assessments are safer alternatives for asset discovery and vulnerability management in ICS.

The ‘air-gap’ is often compromised via physical media (USB drives, laptops) brought in by third parties for maintenance or updates. This is a classic attack vector in supposedly isolated ICS environments. While other risks exist, the introduction of malware via removable media is the most practical and common threat to an air-gapped system.0