Layer 0 Security: What If the PLC and HMI Are Lying?

Klaus Mochalski and Joe Weiss (ACS) explore Layer 0 security in ICS. Learn why network monitoring misses unauthenticated sensor data and how real-time physics monitoring restores true visibility.

Duration:

33 min

Guest in this episode:

Joe Weiss

Managing Partner ACS

FAQ

Facts on the topic

Why are conventional OT network security tools insufficient for protecting industrial facilities?

Network security tools only inspect communication packets after analog sensor measurements have been digitized and transmitted over network protocols. They verify packet formatting, source addresses, and communication destinations, but they cannot determine whether the measurement inside the packet represents physical reality. An incorrect measurement that remains within normal operating limits will pass through network inspection unnoticed.

What is the significance of the question: "Who is lying—the PLC, the HMI, or the valve?"

This scenario highlights a dangerous blind spot in industrial control systems where digital indicators diverge from physical reality. An operator commanded a control valve to open, and both the control room display and the local PLC indicator confirmed the valve was open. However, physical inspection revealed that the valve remained completely closed. Because the communication path reported normal status, the system was entirely unaware of the actual physical state.

Why is the lack of authentication in process sensors such a severe vulnerability?

Field sensors possess no native authentication mechanisms. Actuators, controllers, and transformers automatically accept voltage and current inputs without verifying who sent them or whether the data has been altered. Network monitoring systems take it for granted that sensor data is genuine, leaving critical infrastructure vulnerable to spoofing, calibration drift, and signal manipulation.

How does monitoring sensor physics differ from standard OT network monitoring?

Traditional OT network monitoring inspects digital read/write requests, communication frequencies, and protocol syntax across networked controllers. In contrast, sensor physics monitoring continuously tracks the raw electrical signals generated directly by the sensing elements in real time. It evaluates physical process dynamics before packets ever reach the network or the operating system.

How does securing raw sensor physics justify its budget if considered a non-security investment?

Securing the physical sensor layer directly enhances process efficiency, operational safety, and predictive maintenance. In real-world installations, analyzing raw sensor data uncovers undetected sensor drift, calibration errors, and mechanical degradation that reduce daily plant productivity. The system delivers an immediate return on investment by optimizing uptime and operations, allowing comprehensive cyber protection to come along for the ride without separate capital-intensive security cycles.

Summary

Klaus Mochalski and Joe Weiss explore Layer 0 security in ICS. Learn why network monitoring misses unauthenticated sensor data and how real-time physics monitoring restores true visibility.

https://www.controlglobal.com/blogs/unfettered/blog/55416557/the-plc-says-the-valve-is-open-the-hmi-agrees-but-what-if-neither-is-telling-the-truth

https://ieeexplore.ieee.org/document/9928204

‍
Sound Bites

Joe Weiss: “When people talk about OT, it's misleading. OT came about because control systems consist of pumps and valves and[...] controllers and sensors and actuators and turbines and transformers [...] the engineering hardware things. [...] But what OT practically is today is just the control system networks.”

Joe Weiss: “Network monitoring can't tell you if the data is wrong. They can only tell you if the data is malformed.”

Joe Weiss: “Network monitoring can't tell you if 85 degrees is the correct value. [...] There is nobody in network engineering that can tell you if 85 is the right number or if it's actually 95 or 75.”

Joe Weiss: “The big issue here is if you can't trust what you measure, you have no situational awareness, you have no cyber security, you have no safety, and you have no reliability. And this is what is being ignored in the world of OT security.”

Joe Weiss: “All of our network security monitoring systems and companies make an assumption: The assumption is the sensor is uncompromised, authenticated, and correct. And that's wrong.”

Joe Weiss: “Basically all you're doing is, yes, it's specialized software, but what you're doing is essentially using the equipment that's already installed in the plant. You're not installing anything new.”

Joe Weiss: “This is real-time ROI for efficiency improvements, and cyber comes along for the ride. If you do it any other way, it doesn't work.”

Chapters

00:00 Joe Weiss’s path from nuclear engineering to cybersecurity

02:00 What OT means - and what it leaves out

04:48 The valve says open, but the physical valve is shut

07:24 Why network tools miss incorrect but plausible values

10:41 From Texas City to Stuxnet: when displays mislead operators

14:40 Can process context and anomaly detection close the gap?

17:03 IEC 61850 adds asset context, not sensor authentication

19:34 Why readings inside the normal range can still be wrong

21:58 Monitoring sensor physics at layer zero

24:01 The security blind spot before a sensor value becomes a packet

27:10 A 16-sensor study finds hidden equipment problems

29:21 The productivity payoff: a 3% hourly loss

‍

Keywords

‍

OT security, control system cybersecurity, layer zero, sensor monitoring, industrial control systems, process safety, network monitoring, critical infrastructure

‍