Industrial protocols: Modbus, DNP3, OPC UA, PROFINET and their security

Why industrial protocols are different

Industrial protocols carry readings and commands between controllers, field devices and supervisory systems. Most were designed in the 1970s to 1990s for serial links inside isolated plants, where everyone on the wire was trusted. When they moved onto Ethernet and TCP/IP, they kept that trust model. Anyone who can reach a Modbus device on TCP port 502 can usually read and write its values.

The main protocols

What can go wrong

Without authentication, an attacker on the control network does not need an exploit. Sending a well-formed "write register" or "operate" command is enough. Concept-level risks include:

• Unauthorised writes that change set points or switch outputs.
• Spoofed readings that show operators normal values while the process drifts.
• Replay of captured commands at a later time.
• Program downloads or "stop CPU" commands sent to controllers.
• Reconnaissance: protocol queries reveal device type, firmware and configuration.

Industrial devices are regularly found exposed directly to the internet on these ports, which is never acceptable.

Protecting industrial protocols

1. Never expose industrial protocol ports to the internet. Use VPNs or DMZ gateways for remote access.
2. Segment and filter: only the SCADA server and engineering workstation should reach controllers on these ports.
3. Use protocol-aware firewalls that can, for example, allow Modbus reads but block writes from certain hosts.
4. Prefer secure variants for new projects: OPC UA with SignAndEncrypt, DNP3 SAv5, CIP Security.
5. Monitor passively with tools that decode these protocols, alerting on writes, program changes or new talkers.

A simple firewall rule set for a Modbus zone might look like this on a Linux-based firewall using nftables:

table inet ot {
  chain forward {
    type filter hook forward priority 0; policy drop;
    ct state established,related accept
    ip saddr 192.168.30.10 ip daddr 192.168.31.0/24 tcp dport 502 accept
    ip daddr 192.168.31.0/24 tcp dport 502 log prefix "MODBUS-DENY " drop
  }
}

Tip: OPC UA with security mode None is just as open as Modbus. Check the configured mode, not just the protocol name, when you audit a system.