Modbus
The most widely deployed industrial control protocol, published by Modicon in 1979 and still ubiquitous in manufacturing, building automation and utilities. It exists as Modbus RTU and Modbus ASCII over serial lines and as Modbus TCP over Ethernet on port 502. A master polls slaves using simple function codes — 1 and 2 to read coils and discrete inputs, 3 and 4 to read holding and input registers, 5 and 6 to write a single coil or register, 15 and 16 to write multiple — and the protocol carries no authentication, no encryption and no integrity protection beyond a transport checksum. Modbus is core material in ISA/IEC 62443 and OT security curricula.
Why It Matters
In practice Modbus is the clearest illustration of why OT security is an architecture problem rather than a protocol problem: there is no credential to steal because there is no credential. Anyone with routable access to port 502 can read process values or issue a write that changes a setpoint or flips an output, and the device will comply because the protocol was designed for a trusted serial loop in 1979 and never intended to face a network. Nothing in the protocol distinguishes an engineer from an attacker. A later Modbus/TCP Security variant adds TLS and certificate-based authorisation on port 802, but adoption is thin and most installed devices will never support it. Defence is therefore compensating: put the device in a segmented zone, control the conduit into it, allow Modbus only from named engineering hosts, and monitor passively for write function codes from unexpected sources — a read-heavy baseline suddenly showing function code 6 or 16 is a high-value detection. Note also that scanning Modbus devices actively can crash them, which is why passive discovery is the norm. On exams such as ISA/IEC 62443 and OT security certifications, expect questions on why Modbus cannot be secured in place, which function codes are state-changing, and how zone-and-conduit design compensates for an insecure-by-design protocol.
Practice this topic
Test your knowledge of Modbus concepts with exam-style practice questions.
Related Network Security terms
Firewall
A network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules, acting as a barrier between trusted internal networks and untrusted external networks. Firewalls can be hardware appliances, software applications, or cloud-based services. Types include packet-filtering, stateful inspection, application-layer (proxy), and next-generation firewalls (NGFW) that combine traditional filtering with intrusion prevention and deep packet inspection. Properly configured firewalls are the first line of defense in network security and are essential knowledge for Security+, CCNA Security, and CISSP certifications.
VPN (Virtual Private Network)
A technology that creates a secure, encrypted connection (tunnel) over a less secure network such as the internet, allowing remote users to access private network resources safely. VPNs use protocols like IPSec, SSL/TLS, WireGuard, or OpenVPN to encrypt data in transit. Common implementations include site-to-site VPNs connecting office networks and remote-access VPNs for individual users. Split tunneling allows users to route only corporate traffic through the VPN while personal traffic goes directly to the internet. VPN concepts are heavily tested in Security+, CISSP, and network security certifications.
IDS (Intrusion Detection System)
A device or software application that monitors a network or systems for malicious activity or policy violations and generates alerts when suspicious behavior is detected. IDS can be network-based (NIDS), monitoring traffic on network segments, or host-based (HIDS), monitoring activity on individual systems. Detection methods include signature-based (matching known attack patterns), anomaly-based (detecting deviations from normal behavior), and heuristic analysis. Unlike an IPS, an IDS only detects and alerts, it does not actively block threats. Popular IDS tools include Snort, Suricata, and OSSEC.
IPS (Intrusion Prevention System)
A network security tool that monitors network traffic flows to detect and actively prevent identified threats in real time. Unlike an IDS which only alerts, an IPS sits inline with traffic and can drop malicious packets, block connections, or reset sessions automatically. Modern IPS solutions use signature matching, anomaly detection, and behavioral analysis to identify attacks. They are often integrated into next-generation firewalls (NGFW) as a unified threat management feature. IPS is a key component of defense-in-depth strategies and is tested in Security+, CySA+, and CISSP certifications.
DMZ (Demilitarized Zone)
A physical or logical subnet that separates an internal network from untrusted external networks, providing an additional layer of security for public-facing services. Servers in the DMZ (such as web servers, email servers, and DNS servers) are accessible from the internet but isolated from the internal network by firewalls on both sides. If a DMZ server is compromised, the attacker still cannot directly reach internal resources. DMZ architecture is a classic example of defense-in-depth and network segmentation. It is a common topic in Security+, CISSP, and network architecture certifications.
SIEM (Security Information and Event Management)
A software solution that aggregates and analyzes security data from across the organization, including logs from firewalls, servers, endpoints, and applications, to detect threats and support incident response. SIEM platforms provide real-time alerting, correlation of events across multiple sources, dashboards, and compliance reporting. Leading SIEM tools include Splunk, Microsoft Sentinel, IBM QRadar, and Elastic Security. SIEM is the backbone of modern Security Operations Centers (SOCs) and is essential knowledge for CySA+, CISSP, and CISM certifications.