{
  "port": 1089,
  "protocol": "tcp",
  "service": "FOUNDATION Fieldbus HSE — Annunciation",
  "oneLiner": "Industrial control: the annunciation (event/alarm) port of FOUNDATION Fieldbus High Speed Ethernet.",
  "whatItIs": "The Fieldbus Foundation, now the FieldComm Group, registered 1089, 1090, and 1091 for FOUNDATION Fieldbus HSE — the 100 Mbit Ethernet layer that connects linking devices, gateways, and controllers in process plants. 1089 carries annunciation, the event and alarm notifications published by field devices. Scanners and ICS asset-inventory tools use the trio 1089-1091 as the signature that a host is process-control equipment rather than IT equipment.",
  "exposure": {
    "verdict": "never",
    "note": "HSE was designed for a closed plant control network with no attacker on it — there is no meaningful transport security. It belongs on an isolated control network behind a firewall or data diode."
  },
  "checkCommand": "nmap -sV -Pn -p 1089-1091 TARGET",
  "links": [
    {
      "title": "IANA port registry — 1089 (ff-annunc, assigned to the Fieldbus Foundation)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1089",
      "kind": "iana"
    },
    {
      "title": "ITI/ICS-Security-Tools — ICS protocol port list (FOUNDATION Fieldbus HSE, 1089-1091)",
      "url": "https://github.com/ITI/ICS-Security-Tools/blob/master/protocols/PORTS.md",
      "kind": "github"
    }
  ]
}