The Hidden Truth About AI Resume Screening Nobody Warns You About: IEC 104 security IEC 62351 profiles threat model

AI resume screening is often treated like an efficiency upgrade: search for “OT,” “SCADA,” “IEC 104,” or “IEC 62351,” and you quickly shortlist candidates who sound relevant. The hidden problem is that resume screening usually optimizes for keyword overlap—not for whether an engineer can reason about packet-level behavior, session and sequence state attack surface, and how security mechanisms actually change what gets verified on the wire.
In other words: you can hire “correctly” by keywords and still end up with teams that don’t understand the IEC 104 security IEC 62351 profiles threat model—and that gap becomes operational risk.
This article walks through the threat-model reality behind IEC 104 security and IEC 62351 profiles, with a defender-first focus on what to test, what to assume attackers will do, and what TLS-based IEC 62351 confidentiality integrity changes for organizations operating OT firewall segmentation testing in production.

Why AI Resume Screening Misses OT Risk Signals in IEC 104

AI screening tools typically score resumes using surface-level signals: mentions of standards, job titles, or past projects. In IT, that sometimes correlates with competency. In OT security—especially for SCADA IEC 104 protocol frames and IEC 62351 profiles—competency is less about having read the spec and more about having modeled how attacks travel through implementation details.
A practical analogy: hiring for “gun safety training” based on whether someone owns a firearm is not the same as verifying whether they understand safe handling under stress. The resume might mention the right equipment (IEC 104), but not the behavioral expertise (how session and sequence state attack surface changes attack feasibility).
Another analogy: you wouldn’t assess aviation maintenance by whether someone has watched aircraft videos. You would look for evidence they can diagnose failures in specific systems under real constraints—like state-dependent, time-sensitive systems. IEC 104 behaves similarly: what happens depends heavily on connection control, APDU type, and sequence/ack handling across I/S/U traffic.
And a third analogy: treating “encryption” as a checkbox is like installing a lock without checking the door frame. TLS-based security can reduce exposure, but only if the organization actually uses the relevant TLS-based IEC 62351 confidentiality integrity profile correctly—and verifies it.
Here are the specific gaps resume screening commonly misses for IEC 104:
1. Statefulness is hard to infer from keywords. IEC 104 security isn’t only about “auth” or “encryption”; it’s about controlling and verifying state transitions and sequence behavior across APDUs.
2. Packet parsing competence is rarely demonstrated on resumes. A candidate might list “IEC 104,” but not have the mindset to target parsing failure modes in SCADA IEC 104 protocol frames.
3. Verification vs configuration is often confused. Security can exist in a standards document and still be absent in runtime behavior. Hiring must test for the ability to perform “did we actually enforce it?” reasoning.
4. Threat-model literacy is not the same as compliance familiarity. IEC 62351 profiles have specific verification goals. Candidates may speak generally about security without being able to map profiles to attacker tactics.
Use these checks to reduce false confidence and identify engineers who can build—and validate—an IEC 104 security IEC 62351 profiles threat model:
– Threat-model phrasing: Do they describe attacks in terms of state, sequence, and verification targets (not just “encryption”)?
– Packet-level debugging examples: Can they reference what happened in traffic captures (APDU categories, control fields, state transitions), not only documentation?
– Security mechanism mapping: Do they distinguish base IEC 104 behavior from IEC 62351 security-enforced behavior, especially around TLS-based IEC 62351 confidentiality integrity?
– Test mindset: Do they describe how they created repeatable test cases, including negative tests (malformed frames, replay attempts, out-of-order sequence)?
– OT integration reality: Do they mention how deployments handle constraints like OT firewall rules, segmentation, monitoring, and operational verification (e.g., OT firewall segmentation testing)?
These checks don’t just filter for “IEC 104 experience.” They filter for the ability to reason about what matters most: what attackers can do to stateful, parsed, command-carrying protocols.
An IEC 104 security IEC 62351 profiles threat model is a structured way to answer: Given the specific IEC 104 communication behavior and the selected IEC 62351 security profile(s), what are the attacker’s viable paths, what assets are at risk, and what controls actually mitigate which threats—at packet level?
A strong threat model for this domain typically includes:
– Assets: authorized control/telemetry integrity, operator trust, session availability, command authenticity, and confidentiality of sensitive data.
– Attacker capabilities: ability to craft or replay frames, manipulate timing, attempt session/control mis-sequencing, and exploit parsing/validation weaknesses.
– Threat vectors: manipulation of session and sequence state attack surface, exploitation of command execution paths within ASDU, and targeting verification gaps between what should be authorized vs what is actually accepted.
– Controls: TLS-based IEC 62351 confidentiality integrity, plus profile-specific verification goals for authorized, unmodified application data/commands.
– Verification plan: tests that validate that enforced behavior matches the profile’s intent—especially around parsing, state handling, and cryptographic protection boundaries.
A useful mental model: think of IEC 62351 security profiles as “operational contracts” between endpoints. Attackers try to find the loopholes in the interpretation of that contract—especially when the protocol’s underlying session and APDU mechanics create room for state confusion.

Background: IEC 104 Protocol Frames and Attack Surfaces

To threat-model IEC 104 correctly, you need to understand where flaws hide: in the protocol’s packet structure, its APCI/ASDU state, and the way endpoints handle I/S/U APDUs across a TCP connection.
IEC 104 carries telecontrol information over TCP using APDUs that start with a common structure: a framing and control portion (APCI) followed by application data (ASDU) when relevant.
The key defender viewpoint: attackers don’t need “broken crypto” to cause harm if they can exploit gaps in how the endpoint parses, validates, and sequences state transitions. Many failures occur when implementations incorrectly assume:
– that sequence numbers are monotonic without robust validation,
– that control state is always consistent with prior frames,
– that command execution is only reachable via “well-behaved” client flows,
– that malformed frames can be safely rejected without side effects.
Another analogy: packet parsing is like a customs desk—if a border agent checks identity only after assuming the traveler is already in the correct queue, a clever attacker can create confusion in the queue state and bypass checks. In IEC 104, queue state corresponds to session control and sequence expectations.
The ASDU fields are where the “what command did you mean?” question becomes concrete. If an attacker can influence Type ID, VSQ, COT, CA, or IOA interpretation—or trigger a path where validation differs between base IEC 104 and an IEC 62351-secured mode—they can shift risk from “denial of service” into “unauthorized effect.”
IEC 104 defines traffic behavior that depends on APDU type:
– I-format carries application information and typically includes ASDU with telemetry/control intent.
– S-format provides supervisory acknowledgments without ASDU.
– U-format performs connection control functions.
Even if cryptography is added, the application still depends on state transitions. That is why session and sequence state attack surface remains relevant.
Key defender questions:
– Are START/STOP/Test operations handled correctly with respect to expected session/data-transfer transitions?
– Are out-of-order or unexpected I/S/U frames rejected safely?
– Does sequence-number behavior correctly gate acceptance of new application commands?
A frequent mistake is confusing “TCP connection exists” with “IEC 104 data transfer is authorized.” IEC 104 uses application-level connection control functions (commonly STARTDT, STOPDT, TESTFR) that manage data transfer semantics.
Threat-model walkthrough:
1. An attacker targets the mismatch between TCP liveness and IEC 104 “transfer allowed” state.
2. They attempt to send frames that should be rejected until STARTDT is valid (or to exploit behavior around STOPDT).
3. They probe whether endpoints accept I-format application data when data transfer should be disabled.
4. They use timing and repeated attempts to explore differences in error handling, logging, or side effects.
Analogy: it’s like a factory where the network cable can be unplugged/replugged (TCP), but the production line also has a master switch (STARTDT). If a robot controller trusts “power is on” but not “line is enabled,” unauthorized movement becomes possible.
Even with TLS-based IEC 62351 confidentiality integrity, these state transitions must be verified consistently.
When I-format frames carry an ASDU, attackers get leverage through semantic fields:
– Type ID: what kind of information/command this is.
– VSQ: structure/number of information elements.
– COT: cause of transmission (e.g., interrogation, spontaneous, command context).
– CA: common address identifying a specific endpoint context.
– IOA/information elements: the identifiers and values that map to real-world points.
Threat model mapping:
– Command execution abuse: attacker attempts to craft ASDUs that pass syntactic checks but should be rejected by authorization or profile verification.
– Execution gating gaps: differences in validation paths between base IEC 104 and IEC 62351 secured modes can produce inconsistent behavior.
– State-dependent semantics: some commands should only be valid in certain session/control states; implementations sometimes validate cryptography but not stateful authorization.
Defenders must test: “Does the profile enforcement happen before command execution?” If authorization or verification is applied after some parsing or dispatch, attackers may still trigger harmful behavior.

Trend: TLS-Based IEC 62351 Confidentiality Integrity Gets Adopted

Organizations increasingly adopt security extensions so they can claim reduced risk—particularly by using TLS-based profiles. This shift changes the defender playbook from “trust the network” to “assume attackers can see and craft traffic.”
With TLS-based IEC 62351 confidentiality integrity, the core promise is that confidentiality and integrity protection are enforced according to the IEC 62351 family’s security profiles.
Defender implications:
– Eavesdropping and simple tampering become harder (integrity protection).
– But packet-level logic still matters: attackers can still attempt state confusion, replay strategies, or abuse parser/validation differences depending on how the implementation binds security to session behavior.
– The threat model must reflect what TLS guarantees—and what it doesn’t automatically guarantee.
Analogy: TLS is like putting every letter in an envelope and sealing it. But if the recipient still interprets the letter’s “signature” field based on a separate checkbox that can be manipulated, the attacker can still exploit the recipient’s decision logic. In IEC 104 terms, cryptography reduces tampering, but the endpoint’s session control handling and sequence-number behavior must still be correct.
TLS reduces certain network attacks, but OT networks still rely on segmentation, firewall rules, and traffic shaping. That’s where OT firewall segmentation testing matters: it verifies that your network policy matches your security assumptions.
Common real-world patterns to test:
– Only approved IEC 104 endpoints can initiate sessions.
– STARTDT/STOPDT flows are correctly reachable only through intended paths.
– Logs correlate across network and application layers for both allowed and denied traffic attempts.
Defenders should not stop at “connections work.” They should test denial paths: malformed APDUs, out-of-order frames, unexpected state transitions, and replay-like patterns.
Base IEC 104:
– Primarily relies on network trust.
– Does not inherently provide cryptographic peer authentication, confidentiality, or cryptographic integrity for application messages.
– State and sequence handling remain major risk drivers because attackers may craft frames that are accepted if implementation validation is weak.
IEC 62351-secured IEC 104 (TLS-based profile):
– Adds TLS-based IEC 62351 confidentiality integrity so tampering/eavesdropping are constrained.
– Still requires correct enforcement of authorized, unmodified APDUs and consistent session and sequence state attack surface handling.
– Verification now includes “Did the endpoint enforce the profile correctly before acting?”

Insight: Build a Threat Model Tied to Packet-Level Reality

If your threat model is written like a compliance checklist, it will miss the most actionable failures. The right approach ties each threat to a packet behavior, a state transition, and a verification target.
Map IEC 62351 profiles to categories of threats your engineers must consider:
– Confidentiality-related threats: unauthorized observation of telemetry/control data.
– Integrity/authenticity threats: unauthorized changes to application messages.
– Session/state threats: acceptance of commands when IEC 104 control state is not authorized.
– Sequence/ordering threats: out-of-order, replay-like, or sequence-confusion scenarios affecting I/S/U behavior.
– Parsing/validation threats: malformed SCADA IEC 104 protocol frames that trigger dangerous parsing or unsafe dispatch.
Crucially, you should document which controls address which categories. Don’t assume that “TLS is enabled” implies mitigation for state threats.
Threat modeling for IEC 104 security must include verification goals similar in spirit to what IEC TS guidance describes: authorized APDUs should be validated, unmodified, and accepted only when all required conditions hold.
For defenders, this becomes a testing contract:
– Verify that security checks occur before application dispatch.
– Verify that session control and sequence rules gate acceptance of I-format frames carrying ASDU.
– Verify that the parser rejects invalid frames safely (no partial state updates).
This is where many “keyword-hired” teams break. They might know that “IEC 104 has STARTDT/STOPDT,” but not how implementations fail when state is inconsistent.
Test targets:
– STARTDT transitions: can I-format data be accepted only when transfer is enabled?
– STOPDT transitions: are I-format frames rejected without side effects?
– Sequence handling: are acknowledgments and sequencing constraints enforced properly?
– Error handling: does the endpoint fail closed, with consistent state rollback?
Think of sequence numbers as the conductor’s baton in an orchestra. If the conductor’s tempo is assumed but not verified, musicians (frames) can start playing at the wrong time, potentially triggering the wrong notes (command execution).
Even with TLS, parsing risks remain because endpoints must still interpret the decrypted payload structure correctly.
Packet-level test targets:
– Boundary conditions for frame length fields and control bytes.
– ASDU field constraints (Type ID ranges, VSQ structure sizes, COT interpretations).
– Rejection behavior for malformed or inconsistent APCI/ASDU combinations.
– Robustness against fuzzed-but-syntactically-plausible frames.
Defender mindset: if the endpoint can be confused into “interpreting something different than intended,” attackers can steer command semantics.

Forecast: Agentic Security Workflows Will Raise the Bar

Security teams are moving toward repeatable, auditable workflows. Agentic systems—when properly bounded—can reduce human variability in threat-model execution.
The near future: agentic security workflows will generate and execute IEC 104 test plans using constraints tied to the threat model. Instead of relying on “someone knows what to test,” systems will:
– create test cases derived from the IEC 104 security IEC 62351 profiles threat model,
– enforce deterministic execution order (and stop when prerequisites fail),
– produce evidence bundles linking packet traces to expected verification outcomes.
Analogy: this is like shifting from manual cooking to a calibrated recipe printer. The output isn’t just “tasty”; it’s repeatable under the same measured inputs, and deviations become obvious.
OT firewall segmentation testing will increasingly be validated as evidence, not folklore. Workflows will confirm that segmentation rules match the security posture claimed by the IEC 62351 configuration.
Actionable KPI list:
– Tool-call limits (how many test operations per run, preventing runaway scanning)
– Approval gates (high-impact tests require explicit sign-off)
– Idempotency (re-running tests won’t cause duplicate effects on OT systems)
– State transition coverage (STARTDT/STOPDT/TESTFR paths exercised)
– Negative test rate (proportion of tests validating safe rejection)
Future implication: organizations that don’t formalize these KPIs will be unable to demonstrate consistency as attacker techniques evolve.

Call to Action: Train Hiring and Testing Around IEC 104 Risk

The fastest way to reduce IEC 104 OT risk is to align hiring rubrics and test engineering around the IEC 104 security IEC 62351 profiles threat model, not around surface keywords.
Modify your screening criteria so “IEC 104” mentions are necessary but not sufficient. Require evidence of threat modeling and verification competence:
– Ability to explain session and sequence state attack surface in practical terms.
– Ability to describe how TLS-based IEC 62351 confidentiality integrity affects attacker paths.
– Comfort with packet parsing and negative testing using SCADA IEC 104 protocol frames.
– Experience validating that authorized APDUs are verified before command execution.
Interview prompt examples (use as rubric anchors):
– “Walk me through what STARTDT changes compared to TCP connection liveness.”
– “What failures remain after TLS-based IEC 62351 is enabled?”
– “Which ASDU fields do you treat as security-relevant, and why?”
An OT readiness sprint compresses time-to-evidence. Do it in a sequence that mirrors how attackers think:
1. Threat model → finalize categories tied to session/state, sequence, parsing, and authorization.
2. Test plan → convert threats into packet-level tests: state transitions, out-of-order frames, malformed APDUs.
3. Fixes → prioritize “fail closed” behavior, verification-before-dispatch, and consistent state rollback.
4. Evidence → capture traces and test results as compliance artifacts tied to the profile.
Checklist: verify TLS-based IEC 62351 and state/sequence protections
– Confirm TLS-based IEC 62351 confidentiality integrity is actually active for IEC 104 traffic flows.
– Validate STARTDT/STOPDT gating of I-format application data acceptance.
– Test sequence-number and supervisory acknowledgment behavior under disorder/replay-like scenarios.
– Ensure parsing rejects malformed SCADA IEC 104 protocol frames without unsafe side effects.
– Validate ASDU command execution only occurs after authorized, unmodified APDU verification.

Conclusion: Stop Hiring for Keywords, Start Hiring for Threats

AI resume screening will continue to reward keyword overlap. But IEC 104 security—especially when combined with IEC 62351 profiles—demands threat reasoning tied to packet-level reality.
The next-step takeaway: align people, testing, and IEC 62351 security profiles
– Hire for threat-model literacy: session/state, sequence behavior, and parsing targets.
– Test for verification-before-dispatch: ensure authorized APDUs are validated in the correct place in the execution path.
– Institutionalize OT firewall segmentation testing as evidence, not assumptions.
– Prepare for the future: agentic workflows will raise expectations for repeatability, auditability, and KPI-driven proof that controls actually work.
If you adopt that mindset, you stop building “secure-sounding” teams and start building teams that can withstand the real IEC 104 security IEC 62351 profiles threat model—where the difference between safety and incident is often hiding in state, sequence, and what your endpoint does with decrypted bytes.