Network
Industrial Ethernet Switch
A hardened managed or unmanaged switch providing plant-floor connectivity.
High criticalityLevel 2 – Level 0
What it does
Forwards control traffic, enforces VLANs and port security when managed, and provides mirroring for monitoring.
Typically locatedControl panels, network cabinets, substation racks.
At a glance
PurdueLevel 2 – Level 0
CategoryNetwork
Protocolsprofinet, ethernet-ip, goose
Talks toEvery device in the cell, Network management systems, Monitoring sensors via SPAN
Common vendorsCisco, Siemens (SCALANCE X, RUGGEDCOM), Phoenix Contact, Moxa, Hirschmann
Why should I care?
Industrial Ethernet Switch sits at Level 2 – Level 0. Compromise here is not just a data problem — it changes what the physical process does or what operators can see and control.
Common security problems
- Unmanaged switches with no visibility
- Default credentials on management interfaces
- Open unused ports
If it is compromised
- Traffic interception, segmentation bypass, denial of communications
What to monitor
- Configuration changes
- MAC table / new device appearance
- Port link state changes
- Management logins
How to defend it
- Replace unmanaged switches during projects
- Disable unused ports
- Centralise switch logs where safe
- Port security in sensitive zones
Hunting
Hunt ideas for this component
Related