The plant is built to the zone model, and graded in its vocabulary

Declared conduits

• C-01 Z-CONTROL → Z-OPSHistorian collection, read-only, one direction.Watched for: A write function code arriving from the historian's address.
• C-02 Z-OPS → Z-DMZHistorian replication and batch-record export.Watched for: Volume or destinations the historian has never used before.
• C-03 Z-DMZ → Z-ENTERPRISEBrokered reads from the replica only. No session reaches the plant.Watched for: Any flow that terminates below the DMZ.
• C-04 Z-CONTROL → Z-SAFETYNothing. The safety system is monitored, never commanded.Watched for: Any packet at all.

• FR1 Identification and authentication control4 detections

  Every human, device and software process on the control network is identified.

• FR2 Use control5 detections

  Identified users and devices may only do what their role permits, and it is logged.

• FR3 System integrity4 detections

  Control logic, firmware and process data are not altered without being noticed.

• FR4 Data confidentiality1 detection

  Recipes, batch records and process data stay inside the zone that owns them.

• FR5 Restricted data flow5 detections

  Zones are segmented and traffic crosses only through declared conduits.

• FR6 Timely response to events4 detections

  The plant notices a security event and responds without losing the process.

• FR7 Resource availability4 detections

  Control keeps running — availability outranks a clean IT containment.

• Maroochy Shire sewage spills2000 · Water and wastewater

  An insider used a legitimate radio master to issue pump commands and falsify the state reported back, releasing around a million liters of sewage before anyone accepted the control system was under attack rather than faulty.

  A former contractor with the vendor's own radio equipment

  MITRE ATT&CK — Maroochy Water Breach (C0020)
• Stuxnet2010 · Nuclear enrichment

  Controller logic was rewritten from the engineering environment while the operator display was fed recorded normal values, so the process was damaged over months with the screens showing nothing wrong.

  State-sponsored; delivered via removable media and the engineering toolchain

  MITRE ATT&CK — Stuxnet (S0603)
• Ukraine electric power attack2015 · Electric distribution

  Operators watched their own HMIs being driven from elsewhere: breakers were opened over legitimate remote sessions with valid accounts, and the call center was flooded so the loss of power took longer to confirm.

  Sandworm, using BlackEnergy and KillDisk

  MITRE ATT&CK — 2015 Ukraine Electric Power Attack (C0028)CISA IR-ALERT-H-16-056-01
• Industroyer / CRASHOVERRIDE2016, repeated as Industroyer2 in 2022 · Electric transmission

  Purpose-built malware spoke the substation protocols natively — no exploit required — sending valid-looking command messages to open breakers, and disabling protective relays so the response would be slower than the damage.

  Sandworm

  MITRE ATT&CK — Industroyer (S0604)MITRE ATT&CK — Industroyer2 (S1072)
• TRITON / TRISIS2017 · Petrochemical

  The first malware written to reprogram a safety instrumented system: it reached the safety controller from an engineering workstation and attempted to leave the plant running with its last line of protection removed.

  State-sponsored, via an engineering workstation left on the safety network

  MITRE ATT&CK — Triton (S1009)CISA advisory MAR-17-352-01
• Dragonfly / Energetic Bear energy-sector intrusions2014–2018 · Energy and critical manufacturing

  The objective was operational information rather than disruption: engineering documents, network diagrams and historian data were collected and staged out through the business boundary over long periods.

  Russian state-sponsored actors

  CISA alert TA18-074A
• PIPEDREAM / INCONTROLLER2022 · Cross-sector ICS

  A modular toolkit that scans for controllers, changes their operating mode, downloads programs and rewrites parameters using nothing but the vendors' own protocols and defaults.

  State-aligned; disclosed before it was used against a plant

  CISA advisory AA22-103AMITRE ATT&CK — INCONTROLLER (S1045)
• FrostyGoop heating outage2024 · District heating

  Plain Modbus writes to heating controllers made them report wrong measurements and run the wrong way, leaving more than six hundred buildings without heat in winter for two days.

  Unattributed; reached the controllers through an exposed network device

  MITRE ATT&CK — FrostyGoop (S1165)
• Unitronics PLC and HMI intrusions2023 · Water and wastewater

  Internet-reachable controllers with default credentials were logged into directly and their operator panels defaced, forcing several utilities onto manual operation.

  CyberAv3ngers

  CISA advisory AA23-335A