Mbrojtja e Rrjeteve OT

Because you cannot just patch a PLC the way you patch a laptop, OT defense relies heavily on network controls and monitoring.

The Purdue Enterprise Reference Architecture layers an OT network into levels from 0 (physical process) up through 5 (enterprise IT), with each boundary enforced by firewalls and data diodes. Critical production segments live at levels 0–2 and never talk directly to the internet. A DMZ at level 3.5 hosts jump servers, historian mirrors and update staging so that no direct path exists from IT to the safety-critical floor. Remote vendor access goes through a VPN into the DMZ with multi-factor authentication and session recording. Monitoring is done passively because injecting any active probe into an ICS network is risky. Tools like Nozomi Networks Guardian, Dragos Platform and Claroty Continuous Threat Detection speak the industrial protocols, understand normal operational patterns, and alert on deviations like unauthorized firmware uploads to a PLC, unexpected writes to safety registers, or new devices appearing on the process network. Incident response in OT has different priorities than in IT. Availability comes first: taking a plant offline to investigate a possible intrusion can cost millions per hour, and in extreme cases can cause physical damage or safety incidents. Playbooks are built in advance with engineers, operators and security teams together, and tabletop exercises verify the plan before a real incident tests it.

Mbrojtja praktike:

• Segmentim strikt IT/OT me firewall dhe DMZ industriale.
• Jump hosts për qasjen e inxhinierëve.
• Allowlist për protokollet industriale (vetëm Modbus, OPC UA, etj.).
• Passive monitoring me Claroty, Dragos, Nozomi.

Shembull arkitekture:

  Enterprise (IT)  ──FW1──  Industrial DMZ  ──FW2──  Control Network (OT)
                               ▲
                               └─ Historian, Patch server, Jump host

Konfigurim Suricata për alarme ICS:

enable-source ptresearch/attackdetection
enable-source et/open

1. Dizajno një rrjet të thjeshtë OT: 3 PLC, 1 SCADA, 1 historian, 1 engineering workstation.
2. Zbato 3 rregulla allow-list dhe 2 alerts IDS për ICS.

• NIST SP 800-82.
• MITRE ATT&CK for ICS.