Introduction

The Foundation No One Gave You

Sit in on almost any meeting about industrial systems and the acronyms arrive within minutes. Someone mentions that the PLC on line three needs a firmware review. Someone else asks whether the HMI is on the same network as the historian. A vendor presentation shows the Purdue Model with arrows crossing between levels, and a job description asks for "working knowledge of SCADA and DCS environments." Everyone in the room nods, and it is easy to assume that everyone else already understands what is being said. Very often they do not. In 2024, US employers posted more than 180,000 OT-related cybersecurity positions, according to CompTIA's analysis of Lightcast job-posting data, and that work starts from knowing how industrial control systems run. The people being asked to fill those roles tend to arrive from one of two directions, and each group is missing half of the picture. Engineers who have spent years inside a plant know the process intimately but were never taught to describe the systems that run it in a structured way, let alone think about how those systems could be attacked. IT professionals moving into operational technology know networks, servers, and security well, but many of them have never stood in front of a PLC cabinet or watched an operator run a process from a control room. Both groups are expected to pick up the foundation along the way. This book is that foundation, written down in one place. When you finish it, you will be able to walk into an industrial environment, look at what is in front of you, and understand what each piece is, what it does, and how it connects to the rest.

You Are Not Supposed to Already Know This

If the vocabulary of industrial control has ever made you feel behind, the problem is not you. This language was never designed to be easy to pick up. Industrial control systems were built by engineers whose job was to keep a physical process running: water treated, power generated, product moving down a line. Making the architecture legible to an outsider was not part of the brief. Terms grew up inside individual industries and vendors, the same idea sometimes acquired several names, and a great deal of knowledge was passed from one person to the next on the job rather than written down. The result is a field where experienced people use dense shorthand without noticing, and newcomers have no obvious place to start. This book takes a deliberate approach to that problem. Every term is defined the first time it appears, in plain language, and then used consistently. Each idea is explained once, in the chapter where it belongs, and later chapters point back to it instead of repeating it. Where an analogy helps, you will find one, and where a comparison is clearer as a table, you will find a table. You need general engineering or IT knowledge to follow along, the kind anyone working near these systems already has. You do not need to know anything about industrial control systems themselves. That is the whole point.

Who This Book Is For

This book is written for engineers, technicians, and IT professionals who have heard of ICS, PLC, SCADA, or OT but have never had formal training in any of them. You might be an electrical or mechanical engineer whose work sits next to automated equipment, and you want to understand the control side as well as you understand the hardware. You might be a technician who works with individual devices every day and wants to see how they fit into the larger system. You might be a network or security professional whose responsibilities now reach into a plant, a utility, or a pipeline, and who needs to understand what is on the other side of that boundary before making any decisions about it. You might also be someone preparing for a move into OT cybersecurity, who has realized that you cannot protect a system you do not understand. What these readers share is a solid grounding in their own domain and a gap where industrial control systems should be. By the last chapter, you should be able to explain what an ICS is and how it differs from IT, name the key components and describe how they connect, read a Purdue Model diagram, understand at a basic level how industrial networks and protocols work and what normal traffic on them looks like, and feel ready to begin serious training in ICS and OT security.

How the Book Is Organized

The thirteen chapters are arranged in three parts, each answering one question, followed by a closing chapter. Part 1 asks what an industrial control system is and why it is different from the IT systems you already know. It covers what these systems do and where they are found, the priority order that puts safety and availability ahead of everything else, the Purdue Model that organizes every industrial environment into levels, and what it is actually like to run a plant from a control room. Part 2 asks what the components are and how they connect. It takes each major device in turn: the programmable logic controller, the operator's screen and the supervisory systems behind it, the distributed control system, the remote units and field devices at the edge of the process, and the engineering workstations and historians that sit above them, then shows how data flows through all of them together. Part 3 asks how industrial networks operate and why they look nothing like ordinary corporate networks. It covers the serial protocols that started it all, the arrival of Ethernet on the plant floor, the bridge between plant and business systems, how industrial networks are laid out for resilience, and what normal traffic on them looks like. The order is intentional. Knowing what an ICS is prepares you to recognize the components, and knowing the components prepares you to follow how the network connects them. Chapter 13 then steps back and names what all of this means for security.

How to Read It

If industrial control systems are new to you, read the chapters in order the first time. Each one assumes the vocabulary of the chapters before it, and later chapters refer back to where a term was first explained rather than defining it again. That said, you do not have to read every page with equal care. If a topic is already familiar ground, for example if you have programmed PLCs for years, skim that chapter to pick up the terms the rest of the book uses and move on. If a topic is new territory, give it a second read, because the later chapters build directly on it. Every chapter ends with a short Reflect section of questions that ask you to apply what you have just read to your own work or to a facility you know. They are worth the few minutes they take. Pausing to recall and apply an idea does far more to make it stick than reading on, and the questions will often show you which parts of a chapter you understood and which parts you only followed. Keep a page of notes as you go, especially of terms you hear at work and now recognize. By the end of Part 1 you will have the language, and by the end of Part 3 you should be able to look at an ICS architecture diagram and read it.

Where This Book Leads

This book teaches you what industrial control systems are. It does not teach you how to secure them, and it is deliberately limited to that scope. The reason is practical: every serious conversation about ICS security assumes you already understand the systems, and trying to learn both at once usually means learning neither well. Security does come up along the way, because some design choices only make sense once you see what they leave exposed. Where it does, it is named briefly and pointed forward. Chapter 13 then gathers those threads together and looks squarely at the result: industrial protocols that accept commands from anyone, legacy equipment that cannot be patched, and networks engineered for reliability rather than defense. None of that is a criticism of the engineers who built these systems. It is the natural consequence of the priorities you will meet in Chapter 2. For readers who want to continue from understanding to protecting, HKSM's ICS/OT Cybersecurity Fundamentals course picks up exactly where this book stops, and Chapter 13 explains the options.

What's Next

Chapter 1 starts with something you used this morning without thinking about it. The water from your tap, the power behind your light switch, and the fuel in your car all passed through computers that have no keyboard, no screen of their own, and no tolerance for being switched off. Before you can understand how those computers are built and connected, you need a clear picture of what they are, what makes them different from every other computer you have used, and how many industries quietly depend on them.

Reflect

• Which ICS terms have you heard at work or in job descriptions that you could not confidently explain to a colleague today?
• Do you come to this subject from the plant side or the IT side, and what do you think the other side knows that you do not?
• Which of the three parts of this book covers the area where your own knowledge is weakest, and how will you know when you have closed that gap?
• When was the last time you nodded along in a meeting about industrial systems without being sure what was being discussed?