<!-- TTPSEC Firewall — OT-DMZ -->
<policy id="ot-dmz-001">
<rule action="DENY">
<src>0.0.0.0/0</src>
<dst>10.0.3.0/24</dst>
<proto>Modbus TCP/502</proto>
</rule>
<rule action="ALLOW">
<proto>OPC-UA/4840</proto>
<tls>required</tls>
</rule>
</policy>
/* Suricata ICS Rules */
alert tcp $EXT any -> $OT 502 (
msg:"Modbus Write Coil";
sid:9900001; rev:4;
)
<!-- IEC 62443 Assessment -->
<Assessment std="IEC62443">
<SL now="1" target="3"/>
<Findings crit="4" high="11"/>
</Assessment>
/* Zone Conduit Model */
const zones = {
Enterprise: {SL:2, VLAN:10},
DMZ_OT: {SL:3, VLAN:20},
Control: {SL:3, VLAN:30},
FieldBus: {SL:4, VLAN:40},
};
function assess(s, d) {
if(zones[d].SL > zones[s].SL)
return "BLOCK";
return "ALLOW";
}
async function scan() {
const h = await discover("10.0.0.0/16");
for(const v of h) {
if(v.cvss >= 9.0)
await isolate(v.ip);
}
}
<!-- TTPSEC Firewall — OT-DMZ -->
<policy id="ot-dmz-001">
<rule action="DENY">
<src>0.0.0.0/0</src>
<dst>10.0.3.0/24</dst>
<proto>Modbus TCP/502</proto>
</rule>
<rule action="ALLOW">
<proto>OPC-UA/4840</proto>
<tls>required</tls>
</rule>
</policy>
/* Suricata ICS Rules */
alert tcp $EXT any -> $OT 502 (
msg:"Modbus Write Coil";
sid:9900001; rev:4;
)
<!-- IEC 62443 Assessment -->
<Assessment std="IEC62443">
<SL now="1" target="3"/>
<Findings crit="4" high="11"/>
</Assessment>
/* Zone Conduit Model */
const zones = {
Enterprise: {SL:2, VLAN:10},
DMZ_OT: {SL:3, VLAN:20},
Control: {SL:3, VLAN:30},
FieldBus: {SL:4, VLAN:40},
};
function assess(s, d) {
if(zones[d].SL > zones[s].SL)
return "BLOCK";
return "ALLOW";
}
async function scan() {
const h = await discover("10.0.0.0/16");
for(const v of h) {
if(v.cvss >= 9.0)
await isolate(v.ip);
}
}
<!-- TTPSEC Firewall — OT-DMZ -->
<policy id="ot-dmz-001">
<rule action="DENY">
<src>0.0.0.0/0</src>
<dst>10.0.3.0/24</dst>
<proto>Modbus TCP/502</proto>
</rule>
<rule action="ALLOW">
<proto>OPC-UA/4840</proto>
<tls>required</tls>
</rule>
</policy>
/* Suricata ICS Rules */
alert tcp $EXT any -> $OT 502 (
msg:"Modbus Write Coil";
sid:9900001; rev:4;
)
<!-- IEC 62443 Assessment -->
<Assessment std="IEC62443">
<SL now="1" target="3"/>
<Findings crit="4" high="11"/>
</Assessment>
/* Zone Conduit Model */
const zones = {
Enterprise: {SL:2, VLAN:10},
DMZ_OT: {SL:3, VLAN:20},
Control: {SL:3, VLAN:30},
FieldBus: {SL:4, VLAN:40},
};
function assess(s, d) {
if(zones[d].SL > zones[s].SL)
return "BLOCK";
return "ALLOW";
}
async function scan() {
const h = await discover("10.0.0.0/16");
for(const v of h) {
if(v.cvss >= 9.0)
await isolate(v.ip);
}
}
<!-- TTPSEC Firewall — OT-DMZ -->
<policy id="ot-dmz-001">
<rule action="DENY">
<src>0.0.0.0/0</src>
<dst>10.0.3.0/24</dst>
<proto>Modbus TCP/502</proto>
</rule>
<rule action="ALLOW">
<proto>OPC-UA/4840</proto>
<tls>required</tls>
</rule>
</policy>
/* Suricata ICS Rules */
alert tcp $EXT any -> $OT 502 (
msg:"Modbus Write Coil";
sid:9900001; rev:4;
)
<!-- IEC 62443 Assessment -->
<Assessment std="IEC62443">
<SL now="1" target="3"/>
<Findings crit="4" high="11"/>
</Assessment>
/* Zone Conduit Model */
const zones = {
Enterprise: {SL:2, VLAN:10},
DMZ_OT: {SL:3, VLAN:20},
Control: {SL:3, VLAN:30},
FieldBus: {SL:4, VLAN:40},
};
function assess(s, d) {
if(zones[d].SL > zones[s].SL)
return "BLOCK";
return "ALLOW";
}
async function scan() {
const h = await discover("10.0.0.0/16");
for(const v of h) {
if(v.cvss >= 9.0)
await isolate(v.ip);
}
}
<!-- TTPSEC Firewall — OT-DMZ -->
<policy id="ot-dmz-001">
<rule action="DENY">
<src>0.0.0.0/0</src>
<dst>10.0.3.0/24</dst>
<proto>Modbus TCP/502</proto>
</rule>
<rule action="ALLOW">
<proto>OPC-UA/4840</proto>
<tls>required</tls>
</rule>
</policy>
/* Suricata ICS Rules */
alert tcp $EXT any -> $OT 502 (
msg:"Modbus Write Coil";
sid:9900001; rev:4;
)
<!-- IEC 62443 Assessment -->
<Assessment std="IEC62443">
<SL now="1" target="3"/>
<Findings crit="4" high="11"/>
</Assessment>
/* Zone Conduit Model */
const zones = {
Enterprise: {SL:2, VLAN:10},
DMZ_OT: {SL:3, VLAN:20},
Control: {SL:3, VLAN:30},
FieldBus: {SL:4, VLAN:40},
};
function assess(s, d) {
if(zones[d].SL > zones[s].SL)
return "BLOCK";
return "ALLOW";
}
async function scan() {
const h = await discover("10.0.0.0/16");
for(const v of h) {
if(v.cvss >= 9.0)
await isolate(v.ip);
}
}
<!-- TTPSEC Firewall — OT-DMZ -->
<policy id="ot-dmz-001">
<rule action="DENY">
<src>0.0.0.0/0</src>
<dst>10.0.3.0/24</dst>
<proto>Modbus TCP/502</proto>
</rule>
<rule action="ALLOW">
<proto>OPC-UA/4840</proto>
<tls>required</tls>
</rule>
</policy>
/* Suricata ICS Rules */
alert tcp $EXT any -> $OT 502 (
msg:"Modbus Write Coil";
sid:9900001; rev:4;
)
<!-- IEC 62443 Assessment -->
<Assessment std="IEC62443">
<SL now="1" target="3"/>
<Findings crit="4" high="11"/>
</Assessment>
/* Zone Conduit Model */
const zones = {
Enterprise: {SL:2, VLAN:10},
DMZ_OT: {SL:3, VLAN:20},
Control: {SL:3, VLAN:30},
FieldBus: {SL:4, VLAN:40},
};
function assess(s, d) {
if(zones[d].SL > zones[s].SL)
return "BLOCK";
return "ALLOW";
}
async function scan() {
const h = await discover("10.0.0.0/16");
for(const v of h) {
if(v.cvss >= 9.0)
await isolate(v.ip);
}
}
