Open / standardized
OPC UA
The platform-independent successor to OPC Classic with an information model, single well-known port and built-in security modes supporting signing, encryption and certificate-based authentication.
4840/TCP (default)TCP (opc.tcp) or HTTPSEncryption: Optional
How it works
Client and server negotiate a secure channel and session with a chosen security policy, then browse the address space and subscribe to monitored items.
Communication patternClient → secure channel → session → subscription.
Fact sheet
TransportTCP (opc.tcp) or HTTPS
Ports4840/TCP (default)
AuthenticationYes
PurdueLevel 3.5 – Level 2
EnvironmentsModern plant integration, IT/OT data flow, Edge and cloud
DevicesOPC UA server, PLC, Historian, IIoT gateway
IndustriesManufacturing, Pharmaceutical, Food & Beverage
Why should I care?
Understanding OPC UA is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Browse address space
- Read / write nodes
- Subscribe / monitored items
- Method calls
- PubSub profiles
Security concerns
- Security mode 'None' with anonymous access is a common misconfiguration
- Certificate trust lists are frequently unmanaged
- Method calls can trigger device-side actions when authorisation is loose
What normal looks like
- Sessions using Sign&Encrypt
- Known client certificates
- Stable subscription counts
What deserves attention
- Sessions negotiated with SecurityPolicy None
- Anonymous user tokens
- New client certificate appearing
Hunting ideas
- unexpected-it-to-ot
- abnormal-authentication
Defensive controls
- Require Sign&Encrypt and disable anonymous access
- Manage certificate trust lists deliberately
- Terminate cross-zone UA in the industrial DMZ
Related ATT&CK for ICS techniques
T0885T0811
Sources & further reading