EC-Council Certified Ethical Hacker (CEH) v12Mobile Platform, IoT, and OT HackingMedium
A security assessment of a critical infrastructure facility reveals that several legacy PLCs are still communicating using Modbus TCP over the facility's main corporate network. There are no firewalls or access control lists (ACLs) specifically segmenting the OT network from the IT network. What is the primary security risk introduced by this lack of segmentation and the use of Modbus TCP?
- AInability to perform timely software updates on corporate servers.
- BIncreased risk of employee data theft from corporate workstations.
- CHigher latency for SCADA data transmission due to network congestion.
- DDirect exposure of PLCs to threats originating from the IT network.
Show answer & explanationAnswer & explanation
Correct answer: D. Direct exposure of PLCs to threats originating from the IT network.
The lack of segmentation between IT and OT networks, combined with the use of a common protocol like Modbus TCP, directly exposes critical PLCs to threats originating from the less secure IT network. This allows malware or attackers on the IT side to easily access and potentially manipulate the industrial control systems.
Why the other options are wrong
- A. Software updates are an IT management concern, not directly related to the security risk of exposed PLCs.
- B. While a general risk, it's not the *primary* risk specifically introduced by the direct exposure of PLCs via Modbus TCP.
- C. Network congestion is a performance issue, not a primary security risk from lack of segmentation.
IT/OT Convergence Risk
The security risks introduced when Information Technology (IT) and Operational Technology (OT) networks are interconnected without proper segmentation and security controls.
- Allows IT-based threats to propagate into the OT environment.
- Exposes critical industrial systems to broader attack surfaces.
- Requires specialized security strategies due to differing IT/OT priorities.
Memory trick: IT/OT merge means IT's open door is OT's direct threat.