Industrial Control Systems Basics

Industrial Control Systems (ICS) are the computers and devices that monitor and operate physical processes: power grids, water treatment, manufacturing lines, pipelines, and building systems. Together with the broader category of Operational Technology (OT), they bridge the digital and physical worlds.

A failure here is not lost data; it can mean stopped production, environmental harm, or risk to human life.

A Programmable Logic Controller (PLC) is a ruggedized industrial computer that reads sensor inputs and drives actuator outputs in real time. It executes control logic in a continuous scan cycle: read inputs, run the program, write outputs, repeat.

• Deterministic and reliable, built for harsh environments
• Often programmed in ladder logic resembling relay diagrams
• Directly controls valves, motors, pumps, and breakers

Related field devices extend control to remote and specialized roles.

• RTU (Remote Terminal Unit) — like a PLC but optimized for geographically distributed sites with telemetry over long-distance links, common in utilities and pipelines
• IED (Intelligent Electronic Device) — purpose-built controllers such as protective relays in substations

These devices gather data and execute commands at the edge, often in unmanned locations.

SCADA (Supervisory Control and Data Acquisition) is the system that lets operators monitor and control distributed processes from a central location. It does not control the process directly; it supervises the PLCs and RTUs that do.

• Collects telemetry from many field devices
• Presents it to operators and stores it historically
• Sends supervisory commands (setpoints, start/stop)

Think of SCADA as the cockpit and the PLCs as the engines.

The Human-Machine Interface (HMI) is the operator's window into the process: graphical screens showing tank levels, temperatures, flows, and alarms, with controls to adjust the process.

From a security view, the HMI is significant because compromising it can let an attacker blind the operator (showing normal values while the process is sabotaged) or directly issue dangerous commands.

A Distributed Control System (DCS) is a close relative used for tightly coupled, continuous processes within a single facility, such as a refinery or chemical plant.

• SCADA — geographically dispersed, supervisory, tolerant of latency (pipelines, grids)
• DCS — plant-local, process-control focused, low latency loops (refineries, power plants)

The distinction blurs in practice, and both share the same security concerns covered in this course.

A data historian records time-series process data (sensor readings, setpoints, alarms) at high resolution for analysis, compliance, and troubleshooting.

Security relevance:

• It often straddles OT and IT networks to feed business analytics, making it a common pivot point
• Its data is valuable for attackers performing reconnaissance of the process
• It must be protected without disrupting the real-time control path

The Engineering Workstation (EWS) is used to program and configure PLCs and other controllers. It holds the project files and the software that can upload, download, and modify control logic.

This makes it one of the most dangerous targets in OT: an attacker who controls the EWS can rewrite the logic that governs physical equipment. Compromise of an EWS featured in several high-profile ICS attacks.

At the physical edge, two device types close the loop:

• Sensors measure the process: pressure, temperature, level, flow, position
• Actuators change the process: valves, motors, pumps, breakers, heaters

The controller reads sensors, decides, and drives actuators. A key security insight: if an attacker falsifies sensor readings or actuator commands, the control logic makes wrong decisions even while appearing healthy.

A Safety Instrumented System (SIS) is an independent layer whose sole job is to bring the process to a safe state if dangerous conditions arise, for example tripping a reactor on overpressure.

The SIS is deliberately separate from the control system so a control failure cannot also defeat safety. A notorious attack specifically targeted an SIS, aiming to disable safety protections; this is why SIS isolation and integrity are treated as paramount.

A typical control hierarchy, bottom to top:

• Sensors and actuators touch the physical process
• PLCs / RTUs / IEDs execute real-time control
• SCADA / HMI / DCS supervise and let operators intervene
• Historian and EWS support analysis and engineering
• SIS independently guards safety

Understanding this stack is the foundation for the security differences and protections in the rest of the course.

Match the component to its security significance.

You learned the building blocks of industrial control.

• PLCs, RTUs, IEDs execute real-time control of physical processes
• SCADA, HMI, DCS supervise and let operators monitor and intervene
• Historians store process data; EWS program the controllers
• Sensors and actuators close the loop; falsifying them misleads the logic
• The SIS is an independent safety layer and a critical protection target

Next: why securing OT differs fundamentally from securing IT.