Controlled Laboratory Environment DisclosureThis technical case study was executed within isolated research testbeds (Parasym Security Research Range / AI Defense Lab / Industrial Security Lab). It simulates authentic enterprise architectures without representing a specific commercial client engagement.
Target Scope & Environment
Hardware-in-the-Loop Industrial Process Range
Classification / Standard
IEC 62443: Zone & Conduit Segmentation Violation
Client / Testbed
Parasym Industrial Security Lab
01.Context & Authorized Scope
Executed in the Parasym Industrial Security Lab on a hardware-in-the-loop testbed modeled according to the Purdue Enterprise Reference Architecture (IEC 62443). The environment incorporates physical programmable logic controllers (PLCs), Human-Machine Interfaces (HMIs), historian servers, and Modbus/TCP networks.
02.Security Question Tested
Can an adversary on the corporate IT subnet bypass boundary firewalls and communicate directly with Level 1 industrial field controllers without passing through security monitoring?
03.Testing Approach & Methodology
Utilized passive network traffic analysis, route table inspection, and non-disruptive protocol inspection to identify boundary bridging without transmitting active scans that could destabilize sensitive PLCs.
04.Observed Technical Evidence
Inspection revealed an engineering workstation configured with two physical network interfaces:
• NIC 1: Connected to corporate IT subnet (10.10.20.0/24) for administrative access and domain services.
• NIC 2: Connected to supervisory control subnet (192.168.100.0/24) to monitor PLCs.
The host OS had IP forwarding enabled, acting as an unmonitored bridge. Operators confirmed that standard routing configurations allowed relaying Modbus function code requests (Read Holding Registers, FC 03) directly from the IT network to Level 1 controller endpoints.
Segmentation Boundary & Modbus Protocol Trace
[Corporate IT Network (10.10.20.0/24)]
│
▼ (Bypassed Perimeter Firewall via Multi-Homed Bridge)
[Engineering Workstation (Dual NIC: 10.10.20.45 / 192.168.100.12)]
│
▼ (Direct Modbus/TCP Relay: Port 502)
[Level 1 PLC Controller (192.168.100.20)]
-> Modbus Function Code 03 (Read Holding Registers)
-> Response Verified: Unit ID 1, Count 10, Registers [40001-40010]
05.Demonstrated Impact & Operational Assumptions
Direct, unmonitored access to Level 1 controllers allows an adversary to read telemetry or inject unauthorized control commands, presenting serious operational continuity risks. (Operational Assumption: Assumes prior network presence or host compromise on the corporate IT subnet).
06.Engineering Remediation
Parasym's industrial security engineers formulated a robust segmentation model:
1. Removed multi-homed network connections across all engineering workstations.
2. Established an isolated Industrial DMZ (Purdue Level 3.5) with redundant firewalls and jump hosts requiring multi-factor authentication and session logging.
3. Deployed Deep Packet Inspection (DPI) firewalls enforcing protocol-level rules restricted to authorized IP-MAC pairings and approved Modbus function codes.
4. Deployed unidirectional data diodes for OT-to-IT historian data replication.
07.Verified Retest Outcome
Validated segmentation integrity across the lab range; demonstrated that passive boundary auditing identifies dangerous operational bridging without risking plant downtime or equipment destabilization.
Require an authorized security assessment?
Discuss your architecture, testing scope, and safe-harbor requirements with our offensive engineering team.