Detection of mis-configuration and hostile attacks in industrial control networks using active querying

A management appliance connected to an industrial control network in which a controller controls one or more field devices, the management appliance comprising:

• a memory;
• and
• a processor, which is configured to:
• run in parallel a passive monitoring process and an active querying process,
• wherein the passive monitoring process (i) continuously intercepts traffic exchanged over the industrial control network, (ii) checks whether the intercepted traffic comprises a code-update transaction that is sent to the controller and based on which the controller updates a code currently used for controlling the field devices, (iii) if the traffic comprises the code-update transaction, checks whether the code-update transaction is legitimate, and (iv) if the code-update transaction is legitimate, uses the code-update transaction to update an up-to-date trustworthy baseline version of the code stored in the management appliance,
• and wherein the active querying process (i) requests the controller to report the code currently used by the controller for controlling the field devices, and (ii) compares the code reported by the controller with the baseline version of the code;
• and
• interact between the passive monitoring process and the active querying process, including issuing a notification (i) if the active querying process detects a discrepancy between the code reported by the controller and the baseline version that is being continuously updated by the passive monitoring process, or (ii) if the passive monitoring process detects that the code-update transaction is illegitimate.

A computer software product, the product comprising a tangible non-transitory computer-readable medium in which program instructions are stored, which instructions, when read by a processor in a management appliance connected to an industrial control network in which a controller controls one or more field devices, cause the processor to:

• run in parallel a passive monitoring process and an active querying process,
• wherein the passive monitoring process (i) continuously intercepts traffic exchanged over the industrial control network, (ii) checks whether the intercepted traffic comprises a code-update transaction that is sent to the controller and based on which the controller updates a code currently used for controlling the field devices, (iii) if the traffic comprises the code-update transaction, checks whether the code-update transaction is legitimate, and (iv) if the code-update transaction is legitimate, uses the code-update transaction to update an up-to-date trustworthy baseline version of the code stored in the management appliance,
• and wherein the active querying process (i) requests the controller to report the code currently used by the controller for controlling the field devices, and (ii) compares the code reported by the controller with the baseline version of the code;
• and
• interact between the passive monitoring process and the active querying process, including issuing a notification (i) if the active querying process detects a discrepancy between the code reported by the controller and the baseline version that is being continuously updated by the passive monitoring process, or (ii) if the passive monitoring process detects that the code-update transaction is illegitimate.