Server
Process Historian
A time-series database storing process values, events and alarms for analysis, reporting and compliance.
High criticalityLevel 3 (with Level 3.5 replica)
What it does
Collects tags from control systems and serves queries to engineers, operations and business users.
Typically locatedSite operations zone, typically with a replica in the industrial DMZ for enterprise consumers.
At a glance
PurdueLevel 3 (with Level 3.5 replica)
CategoryServer
Protocolsopc-classic, opc-ua, mqtt
Talks toOPC servers, SCADA / DCS, Enterprise reporting tools, Replica historian
Common vendorsAVEVA, Honeywell, GE Vernova, Inductive Automation
Why should I care?
Process Historian sits at Level 3 (with Level 3.5 replica). Compromise here is not just a data problem — it changes what the physical process does or what operators can see and control.
Common security problems
- Direct enterprise queries into the control zone
- Excessive read accounts
- Large data volumes that mask exfiltration
If it is compromised
- Loss of historical evidence
- Sensitive process/recipe information disclosure
- A pivot point between zones
What to monitor
- Query volume and unusual export activity
- New client accounts
- Replication health
How to defend it
- Replicate outward into the DMZ; never let enterprise reach the control-zone historian
- Least-privilege read accounts
- Alert on bulk export
Hunting
Hunt ideas for this component
Related