Cybersecurity in process control networks has become increasingly critical due to the rapid digitalization and interconnection of industrial environments. Industrial Control Systems, including SCADA systems, manage essential infrastructure where system availability, data integrity, and secure access are fundamental requirements for safe and reliable operations. This thesis examines the characteristics of process control networks, security standards, and protection methods, with a focus on network segmentation and the Purdue reference model.
The practical part of the thesis presents the creation of an isolated virtual environment in VMware Workstation, where the open-source SIEM platform Wazuh was deployed for centralized event monitoring and threat detection. The experimental environment consisted of Linux and Windows target systems and a Kali Linux attacker machine. All these devices serve as workstations that provide control, visualization, or administration in the OT environment. By simulating attacks such as failed SSH logins, brute-force attempts, file integrity tampering, and the execution of the EICAR test malware, the detection and response capabilities of the Wazuh platform were evaluated.
The experimental results confirmed that Wazuh enables reliable monitoring, timely detection of security anomalies, and enhanced situational awareness in OT environments. Findings indicate that integrating SIEM solutions into process control networks plays an essential role in strengthening cybersecurity and supporting industrial systems in defending against modern cyber threats.
|
