A little background information:
I recently conducted a network/ network assessment on the ICS/ OT systems and attempted a packet capture from the enterprise side of the system.
The SCADA servers (running VTScada) sit directly on the Enterprise VM Cluster with no DMZ or Firewalls separating the enterprise and OT systems.
The IT group would not give me access to the distributions switches to collect the pcaps. They supplied the pcaps to me. After examining the data i found that there is absolutely no data to the SCADA servers (VTSCADA) from the controls network (PLCs).
The IT tech that supply the pcaps told me that i would not see any traffic from the OT network because the traffic stays behind the local firewall (there is none) and is not transmitted over the VPN tunnel back to the VTscada servers. (How is data being displayed on the VTScada HMI if no data is passed thru the VPN to VTScada?) He also stated that VTScada queries the RTU and retrieves values from the tags. and the VPN tunnel dumps straight from the Firewall to the VTScada servers with no additional filtering in between.
My question;
I believe this guy is giving me a lot of BS.
Can someone explain this if he is correct or confirm that he is giving me a lot of BS?
I recently conducted a network/ network assessment on the ICS/ OT systems and attempted a packet capture from the enterprise side of the system.
The SCADA servers (running VTScada) sit directly on the Enterprise VM Cluster with no DMZ or Firewalls separating the enterprise and OT systems.
The IT group would not give me access to the distributions switches to collect the pcaps. They supplied the pcaps to me. After examining the data i found that there is absolutely no data to the SCADA servers (VTSCADA) from the controls network (PLCs).
The IT tech that supply the pcaps told me that i would not see any traffic from the OT network because the traffic stays behind the local firewall (there is none) and is not transmitted over the VPN tunnel back to the VTscada servers. (How is data being displayed on the VTScada HMI if no data is passed thru the VPN to VTScada?) He also stated that VTScada queries the RTU and retrieves values from the tags. and the VPN tunnel dumps straight from the Firewall to the VTScada servers with no additional filtering in between.
My question;
I believe this guy is giving me a lot of BS.
Can someone explain this if he is correct or confirm that he is giving me a lot of BS?
