Common IT protocols found in the ICS

Although not directly industrial control protocols by themselves, the upcoming sections are a list of common IT protocols that can be found on OT networks. The list includes a summarization of their well-known vulnerabilities.

HTTP

Many ICS devices will have built-in diagnostic web pages and some form of web server to allow access to the diagnostic pages. HTTP is known to have the following vulnerabilities:

• Vulnerable HTTP server application code
• Hard coded credentials
• SQL injection
• Cross-site scripting
• Broken authentication and session management
• Insecure direct object references
• Cross-site request forgery
• Security misconfiguration
• Insecure cryptographic storage
• Failure to restrict URL...