DPI SCADA Security: Reviewing the Basics
In Part 1 of this series I explained DPI technology in detail. To review, the traditional IT firewall examines the TCP/IP and Ethernetheaders in the network messages it sees. It then makes decisions whether to allow or block a message based on this limited information.
DPI technology allows the firewall to dig deep into the SCADA protocols that sit on top of TCP/IP and Ethernet. The firewall then determines exactly what the SCADA protocol is being used for and makesbetter decisions on what should be allowed or blocked.
The example I gave in the last article was theseaway management company that used Tofino Modbus DPI firewalls to protect the PLCs runningits canal locks and bridges. By blocking all Modbus write messages(and programming messages), and allowing Modbus Data read messages, the company could improve the safety of the canal system for both the ships in the canals and the public usingthe draw bridges at the locks. Read more