Penetration testing of OPC as part of process control systems

Abstract

We have performed penetration testing on OPC, which is a central component in process control systems on oil installations. We have shown how a malicious user with different privileges - outside the network, access to the signalling path and physical access to the OPC server - can fairly easily compromise the integrity, availability and confidentiality of the system. Our tentative tests demonstrate that full-scale penetration testing of process control systems in offshore installations is necessary in order to sensitise the oil and gas industry to the evolving threats. © 2008 Springer-Verlag Berlin Heidelberg.