Search
Search the atlas
One box across protocols, components, vendors, industries, incidents, hunts, techniques and guides — narrowed by the protocol on your wire and the component it runs on.
252 entries indexed
VendorABBDCS, Substation automation, Drives, Robotics, PLC, ElectrificationHuntAbnormal Authentication in OTIdentify authentication patterns in the OT environment that do not match normal operational behaviour.HuntAbnormal HMI CommunicationDetect HMIs communicating with unusual peers, services or destinations.AssetActuator / Final ElementLevel 0GlossaryAdvisoryA vendor or agency publication describing affected products, impact and recommended mitigations.GlossaryAir gapThe idea of complete physical isolation. In practice it degrades through media, laptops and vendor connectivity, and should not be relied on as a sole control.ProtocolAMQP5672/TCP (plain), 5671/TCP (TLS) · Open / standardizedVuln classAuthentication BypassAccess is possible without presenting valid credentials.VendorAVEVASCADA, HMI software, Historian, MESGuideBackup & RecoveryBe able to restore OT operations from validated, protected backups.ProtocolBACnet47808/UDP (BACnet/IP) · Open / standardizedProtocolBACnet/IP47808/UDP (0xBAC0) · Open / standardizedVendorBeckhoffPC-based control, EtherCAT, MotionProtocolBeckhoff ADS/AMS48898/TCP · Vendor-associatedGlossaryBPCSBasic Process Control SystemVuln classBuffer Overflow / Memory CorruptionMalformed input corrupts memory, causing a crash or potentially code execution.IndustryBuilding AutomationHVAC, lighting, access and fire systems — frequently the least segmented OT in an organisation.ProtocolCAN busN/A · Open / standardizedProtocolCANopenN/A · Industry consortiumIndustryChemicalContinuous and batch chemical production with significant process hazards and rigorous safety layers.GlossaryCIPCommon Industrial ProtocolProtocolCIP (Common Industrial Protocol)Depends on carrier · Industry consortiumProtocolCIP SafetyCarrier dependent · Industry consortiumFrameworkCISA ICS GuidanceAdvisories, alerts and recommended practices for industrial control systems, including defense-in-depth and incident response material.Vuln classCleartext CredentialsCredentials traverse the network or are stored without protection.IncidentColonial Pipeline Ransomware2021 · Indirect operational impactVuln classCommand InjectionUntrusted input is passed to a system command interpreter.GlossaryCompensating controlAn alternative control applied when the primary remediation (usually patching) is not feasible.GlossaryConduitA defined, controlled communication path between zones, carrying only approved flows.GlossaryCPSCyber-Physical SystemGlossaryCVECommon Vulnerabilities and ExposuresGlossaryCVSSCommon Vulnerability Scoring SystemGlossaryCWECommon Weakness EnumerationAssetData Acquisition ServerLevel 2 – Level 3IndustryData CentersFacility infrastructure — power, cooling and monitoring — that underpins digital services and is itself an OT environment.GlossaryDCSDistributed Control SystemVuln classDefault CredentialsDevices ship with well-known credentials that are never changed.HuntDefault Credentials and Internet-Exposed Field DevicesFind control devices that are reachable from the internet or still using factory-default credentials, before an opportunistic actor does.GlossaryDefense in depthLayering independent controls so that the failure of one does not expose the process.Vuln classDenial of ServiceThe device or service can be made unavailable.ProtocolDeviceNetN/A · Industry consortiumAssetDistributed Control SystemDCS · Level 2 – Level 1ProtocolDNP320000/TCP (commonly) · Open / standardizedGlossaryDNP3A telemetry protocol used widely in electric and water utilities, with optional Secure Authentication.AssetDomain Controller in OTLevel 3IndustryElectric PowerGeneration, transmission and distribution, where protection schemes operate in milliseconds and outages have public consequences.VendorEmersonDCS, Instrumentation, Asset management, SafetyAssetEngineering WorkstationEWS · Level 2 – Level 3HuntEngineering Workstation CompromiseHunt for signs that an engineering host has been compromised before it is used to change a controller.GuideEngineering Workstation ProtectionTreat engineering hosts as the highest-value endpoints in the environment.GlossaryEPSSExploit Prediction Scoring SystemProtocolEtherCATN/A — Layer 2 · Industry consortiumProtocolEtherNet/IP44818/TCP (explicit), 2222/UDP (implicit I/O) · Industry consortiumGlossaryEWSEngineering WorkstationVuln classExposed Management ServicesWeb, SSH, Telnet or vendor management services reachable beyond their intended scope.AssetField DeviceLevel 0GlossaryFieldbusA digital communication network connecting field devices to controllers, such as PROFIBUS or FOUNDATION Fieldbus.IndustryFood & BeverageHigh-throughput production lines with strong hygiene requirements and heavy OEM machine content.ProtocolFOUNDATION FieldbusN/A / Ethernet for HSE · Industry consortiumVendorGE VernovaGrid automation, SCADA, Power generation controlsAssetGeneric ControllerLevel 1ProtocolGOOSEN/A — EtherType 0x88B8 · Open / standardizedGlossaryGOOSEIEC 61850 Layer 2 multicast messaging carrying time-critical protection signals between substation devices.Vuln classHardcoded CredentialsCredentials are embedded in firmware or software and cannot be changed by the operator.ProtocolHARTN/A — field wiring · Industry consortiumProtocolHART-IP5094 (TCP/UDP) · Industry consortiumIndustryHealthcare / Medical CPSClinical devices and hospital facility systems where patient safety and continuity of care dominate.GlossaryHistorianA time-series database storing process values, events and alarms for analysis and reporting.HuntHistorian Data ExfiltrationDetect abnormal bulk extraction of process data from historians or reporting systems.GlossaryHMIHuman-Machine InterfaceVendorHoneywellDCS, Safety, Building automation, InstrumentationAssetHuman-Machine InterfaceHMI · Level 2GlossaryICSIndustrial Control SystemGuideIdentity & Privileged AccessEnsure every action in OT is attributable to a person and privileges are minimal and time-bound.GlossaryIDMZIndustrial DMZProtocolIEC 60870-5-101N/A — serial · Open / standardizedProtocolIEC 60870-5-1042404/TCP · Open / standardizedProtocolIEC 61850102/TCP for MMS; GOOSE and SV are Layer 2 · Open / standardizedFrameworkIEC 62443A series of standards for industrial automation and control system security covering asset owners, integrators and product suppliers.GlossaryIEDIntelligent Electronic DeviceGlossaryIIoTIndustrial Internet of ThingsAssetIIoT Edge GatewayLevel 3.5 and aboveVuln classImproper Access ControlFunctions are reachable by users or peers that should not be authorised for them.Vuln classImproper Input ValidationThe device or application accepts input it should reject.VendorInductive AutomationSCADA / HMI software, MQTT-based architecturesGuideIndustrial DMZEnsure no traffic passes directly between the enterprise and control environments.AssetIndustrial Ethernet SwitchLevel 2 – Level 0AssetIndustrial FirewallLevel 3.5 / zone boundariesHuntIndustrial Protocol Write ActivitySurface write operations on industrial protocols and confirm each has an operational reason.IncidentIndustroyer / CrashOverride2016 · Direct OT impactVuln classInsecure FirmwareFirmware contains known-vulnerable components or weak protections.Vuln classInsecure Update MechanismsThe update process itself lacks integrity or authenticity controls.AssetIntelligent Electronic DeviceIED · Level 1VendorJohnson ControlsBuilding automation, Fire and security systemsGlossaryJump hostA hardened intermediate system that all interactive access into a protected zone must traverse.AssetJump Server / BastionLevel 3.5GlossaryKEVKnown Exploited VulnerabilitiesGlossaryKnow normalThe practice of baselining expected assets, peers, protocols and timings so that abnormal behaviour becomes visible.ProtocolKNX3671/UDP (KNXnet/IP) · Open / standardizedGuideLegacy & Unsupported SystemsManage systems that cannot be patched with compensating controls and a lifecycle plan.GuideLogging & Log CentralisationCollect the OT logs that matter, safely, and retain them long enough to investigate.GlossaryLoss of controlA condition where operators can no longer influence the process as intended.GlossaryLoss of viewA condition where operators can no longer observe the process accurately.GlossaryMaintenance windowA scheduled period in which changes can be made with reduced operational impact.GlossaryManipulation of viewA condition where the information presented to operators has been falsified.GlossaryManual operationRunning the process using local controls and human procedures when automated systems are unavailable or untrusted.IndustryManufacturingDiscrete and hybrid production where downtime is measured directly in units and revenue, and cells are highly heterogeneous.IndustryMaritimeVessels and ports combining navigation, propulsion, cargo and terminal automation with intermittent connectivity.IndustryMiningFixed plant and mobile fleet operations, often remote, with heavy reliance on wireless and autonomous systems.FrameworkMITRE ATT&CK for ICSA knowledge base of adversary tactics and techniques observed against industrial control systems.VendorMitsubishi ElectricPLC, HMI, Drives, RoboticsProtocolMitsubishi MC ProtocolConfigurable (commonly 5007 / 5562 depending on configuration) · Vendor-associatedGlossaryMMSManufacturing Message SpecificationProtocolMMS (Manufacturing Message Specification)102/TCP · Open / standardizedGlossaryMOCManagement of ChangeGlossaryModbusA widely used industrial protocol for reading and writing device registers, available in serial (RTU) and TCP variants.ProtocolModbus RTUN/A — serial · Open / standardizedProtocolModbus TCP502/TCP · Open / standardizedAssetMotor Controller / MCCLevel 1 – Level 0ProtocolMQTT1883/TCP (plain), 8883/TCP (TLS) · Open / standardized
Showing the first 120 of 252 matches — narrow with a term or a filter to see the rest.