EC-Council CCT Lab – IDMZ Security Controls

🏭

Lab Environment – Scenario

Hayes, a security professional, was tasked with the implementation of security controls for an industrial network at the Purdue level 3.5 (IDMZ). Hayes verified all the possible attack vectors on the IDMZ level and deployed a security control that fortifies the IDMZ against cyber-attacks.

Identify the security control implemented by Hayes in the above scenario.

⚙

Network Simulation – IDMZ Scan

idmz-scanner@purdue-L3.5 ~

❓

Select the correct answer:

Hint: Think about what is specific to OT/ICS environments at the IDMZ level. The Purdue model level 3.5 acts as a buffer zone between the enterprise IT network and the industrial control systems. The correct security control directly governs the types of commands that are permitted to reach field devices like RTUs and PLCs.

📖

Mini Lesson

Definition What is the IDMZ?

The Industrial Demilitarized Zone (IDMZ) sits at Purdue level 3.5, acting as a secure buffer between the enterprise IT network (levels 4–5) and the industrial control system (ICS) network (levels 0–3). Its purpose is to strictly control and inspect all traffic that crosses between the corporate and operational technology (OT) environments.

How It Works Authorized RTU & PLC Commands

Remote Terminal Units (RTUs) and Programmable Logic Controllers (PLCs) are the field devices that directly operate physical processes — pumps, valves, sensors, and switches. By restricting communication to only authorized RTU and PLC commands at the IDMZ, organizations ensure that no unauthorized instruction can pass from the enterprise network to the control network. This is typically enforced through deep packet inspection firewalls and application-layer whitelisting that understand industrial protocols like Modbus, DNP3, and EtherNet/IP.

Why It Matters

If an attacker compromises the enterprise IT network, the IDMZ is the last line of defense before they can reach the OT systems that control physical processes. Allowing only authorized commands prevents an attacker from injecting malicious instructions that could cause equipment damage, safety incidents, or production shutdowns. Unlike generic IT security controls (firewalls, anti-DoS), this control is purpose-built for industrial environments.

Real-World Example

In the Stuxnet attack on Iran's uranium enrichment facility, malicious code sent unauthorized commands to PLCs controlling centrifuge motors, causing them to spin at destructive speeds while reporting normal readings. Had strict authorized-command whitelisting been enforced at the IDMZ, the rogue PLC instructions could have been blocked before reaching the centrifuges.

Key Takeaway

At Purdue level 3.5 (IDMZ), the most critical security control is ensuring that only authorized RTU and PLC commands are allowed to pass between the IT and OT networks. This is what differentiates ICS-specific security from standard enterprise security measures.