Server
OPC Server
A translation service exposing device data through OPC interfaces to client applications.
High criticalityLevel 2 – Level 3
What it does
Bridges native controller protocols and OPC clients such as historians and HMIs.
Typically locatedSite operations zone or industrial DMZ, depending on data flow design.
At a glance
PurdueLevel 2 – Level 3
CategoryServer
Protocolsopc-classic, opc-ua, modbus-tcp
Talks toControllers, Historian, HMI, MES
Common vendorsKepware, Siemens, Matrikon, Inductive Automation
Why should I care?
OPC Server sits at Level 2 – Level 3. Compromise here is not just a data problem — it changes what the physical process does or what operators can see and control.
Common security problems
- DCOM weakening for OPC Classic
- Anonymous OPC UA endpoints
- Bridging zones by design
If it is compromised
- A pivot between enterprise and control zones; write access to devices
What to monitor
- Client sessions and certificates
- Write operations
- Endpoint security policy in use
How to defend it
- Prefer OPC UA with Sign&Encrypt
- Place cross-zone OPC in the DMZ
- Deny write where only reads are required
Hunting
Hunt ideas for this component
Related