Phase 10 - ICS and Operational Technology Security
Duration: 4 weeks (Month 21)
Objective: assess industrial environments with safety, availability, engineering ownership, and
process consequences ahead of conventional IT assumptions.
Deep guides: WARMUP.md introduces safety-constrained OT security, passive evidence, protocols, and consequence-driven risk; HITCHHIKERS-GUIDE.md defines the safe assessment and hardening workflow.
Required Theory
- Safety vs security, deterministic operations, long asset life, vendor constraints, maintenance windows, physical process, and consequence-driven risk.
- Purdue model as a communication aid, zones/conduits, PLCs, RTUs, HMIs, SCADA, historians, engineering workstations, safety instrumented systems, and remote access.
- Modbus/TCP, DNP3, OPC UA, Profinet concepts; authentication/integrity limitations and secure deployment options.
- Passive asset inventory, industrial DMZ, jump hosts, unidirectional flow concepts, allowlisting, time synchronization, backups, change control, and safety-aware incident response.
- Vulnerability management with unpatchable systems, compensating controls, vendor coordination, recovery images, and cloud-connected industrial systems.
Safe Simulation Labs
| Lab | Deliverable |
|---|---|
| 10.1 Simulated plant | container/VM process simulator with PLC/HMI/historian-style components and synthetic values |
| 10.2 Protocol analysis | annotate normal Modbus and OPC UA/DNP3-style training captures; no real-device probing |
| 10.3 Passive inventory | infer assets, roles, flows, firmware fields, confidence, and blind spots from supplied data |
| 10.4 Segmentation | zones/conduits, industrial DMZ, vendor access, historian/cloud path, firewall matrix |
| 10.5 OT IR playbook | safety authority, evidence, isolation options, manual operation, vendor and recovery decisions |
| 10.6 Cloud-connected threat model | device/gateway/cloud/operator/supply-chain trust boundaries |
| 10.7 Vulnerability plan | criticality, exposure, consequence, compensating controls, outage and vendor constraints |
| 10.8 Detection | tested alerts on synthetic protocol misuse and architecture-policy violations |
Runnable lab portfolio
- Passive OT Asset Inventory
- OT Zone and Conduit Policy Validator
- Safety-Aware OT Response Decision Engine
All fixtures are simulated. The labs emphasize passive evidence, industrial segmentation, change ownership, safety approval, manual-operation readiness, evidence preservation, and recovery.
No active scanning, fuzzing, write commands, or control manipulation may target real industrial equipment or networks.
Capstone - OT Security Assessment Package
Assess the simulated Aegis Transit water-control environment:
- architecture and process-safety context;
- asset inventory and data-quality limitations;
- threat model and consequence analysis;
- zones, conduits, remote access, and cloud integration;
- passive monitoring and detection plan;
- backup/recovery and safety-aware incident playbook;
- prioritized vulnerability plan;
- engineering report and one-page executive risk memo.
Include a joint decision table stating which actions require control engineer, safety officer, operations, vendor, legal, and executive approval.
Tools and Sources
Wireshark with industrial dissectors, Zeek/Suricata concepts, safe protocol simulators and supplied pcaps, diagramming and asset-inventory tools. Read NIST SP 800-82, CISA ICS guidance, ISA/IEC 62443 concepts, MITRE ATT&CK for ICS, vendor hardening/protocol documentation, and public safety-focused incident analyses.
Measures and Evaluation
-
Every recommendation states safety, availability, recovery, and owner implications.
-
Inventory confidence and passive-monitoring gaps are explicit.
-
Segmentation rules correspond to approved operational flows.
-
Incident actions contain decision authority and fallback/manual-operation requirements.
-
Cloud connection uses least privilege, buffering, authentication, and failure-safe behavior.
-
Explain why immediate isolation or patching may be dangerous.
-
Distinguish control, monitoring, safety, and enterprise zones.
-
Review remote vendor access and historian replication.
-
Prioritize vulnerabilities by consequence and exposure, not CVSS alone.
-
Brief both plant engineering and executives without losing essential context.
Required Build Work
Build a passive inventory normalizer in Python or Go that consumes only supplied synthetic records or pcaps, assigns stable asset identities, records confidence and source, and exports a zone/conduit review table. Add tests for duplicate addresses, changed firmware labels, clock skew, missing fields, and conflicting observations.
Common Mistakes and Interview Questions
Mistakes: active discovery by default, blind IT patch SLAs, treating Purdue levels as physical truth, ignoring process state, deploying inline controls without failure analysis, and excluding operators.
Interview prompts: secure remote maintenance; respond to suspicious HMI behavior; connect a plant historian to cloud analytics; handle an unpatchable PLC; design passive inventory; negotiate containment with operations.
Portfolio and Stretch
Publish only simulated diagrams, synthetic captures, rules, and reports. Stretch: digital-twin safety model, asset identity lifecycle, secure gateway prototype, tabletop with control engineers, or deeper IEC 62443 zone/conduit evidence mapping.