Fundamentals of OT Cybersecurity (ICS/SCADA)

Explore the HMI controller and the DCS distributed control system, examine different process types, and define the engineering workstation and the control room and their main functionalities.

Follow a fictional production line that turns raw material into a useless product through shaping and painting to change its color, then packages or discards the final output.

Identify the production phases by detailing manual inputs, the first and second processes, and their interconnected outputs as inputs, highlighting the split operations and the continuous flow across processes.

Explain discrete vs process manufacturing through lego style part assembly versus irreversible raw material changes, using car assembly and cooking examples, and discuss batch or single product production.

Define the type of process, process one and process two, and explore what constitutes a plant in the OT world, guiding you to answer before the next video.

Describe how process one and process two enact a continuous change to raw material, preventing return to its original state, and distinguish plant, processes, and operational technology.

Discover how a distributed control system provides supervisory monitoring and control for operational technology, detailing controllers, field devices, and input/output modules that execute processing logic.

Explore how plant control uses position sensors, input/output modules, and actuators, with connected controllers and high-speed links, to synchronize shaping, painting, and material movement.

The distributed control system (DCS) uses distributed controllers, high-speed local connectivity, and native SCADA interfaces from the same vendor to enable integrated, redundancy, process-oriented operation.

Explore distributed control systems by examining modular DCS controllers with input/output modules, redundant processors, and DIN rail cabinets. Learn how high-speed interfaces enable supervisory and control connectivity.

Understand how DCS controller programming languages vary by vendor, and why cross-vendor compatibility isn't direct across ladder logic diagram, function block diagram, sequential function chart, instruction list, and structured text.

Explore the DCS, a native SCADA from the same vendor, with integrated control and supervisory functions. See how distributed controllers and redundancy enable reliable, process-oriented operations locally.

Explore the human machine interface (HMI) as the operator window to monitor and control DCS processes, with alarms, visualizations, and connectivity via local, built-in, tablet, serial, Ethernet, or wireless options.

Explore the dcs layout spanning plant, sensors, actuators, control, and supervision, and learn how the data historian logs historical process data while engineering workstations manage firmware upgrades and io configuration.

examine human machine interfaces and distributed control concepts, including hmi, local controllers, supervisors, historians, and ip-based control rooms in industrial processes; compare distributed and centralized control and data flow.

Introduce the final set of operational technology cybersecurity terms—SCADA, MTU, RTU, PLC, PAC, and IED—in section 3 as the course deepens.

Learn how SCADA enables supervisory control and data acquisition across large, remote areas with slow connectivity, emphasizing telemetry collection, event-driven monitoring, and remote HMI control.

Identify three SCADA components: HMI, SCADA server, and field devices, and learn how PLCs, RTUs, PACs, and IEDs connect through server with programmable display and logic over low bandwidth links.

Explore the scada server (mtu) at the master control center, collecting data from RTUs, PLCs, PACs, and IEDs, and enabling HMI access and remote control via OPC and Modbus.

Learn how the PLC acts as a rugged core of SCADA and DCS, with I/O, memory, ladder logic or structured text, interfacing with HMIs and communicating via Modus, OPC, S7.

Compare RTUs and PLCs, noting RTUs have lower processing power and rugged, low-power design for remote sites, while PLCs offer higher processing power and large I/O capacity.

Explore programmable automation controllers (PACs) and how they differ from PLCs, featuring higher processing power, larger storage, more I/O options, and integration with organizational databases and in-device development.

Explore intelligent electronic devices (IEDs) that act as microprocessor-based controllers in the electric power industry, connecting to MTU or RTUs for protection and fast circuit breaker actions.

Explore how SCADA alarms differentiate actionable alerts from ordinary events, how vendors define critical alarm conditions, and how tuning and maintenance affect notifications and procedures.

SCADA connections use diverse media (VSAT, Ethernet, fiber, and wireless), tolerating latency as RTUs operate offline until reconnection, with middleware servers linking MTUs for scalable, flexible multi-site control.

Learn how SCADA systems monitor and control industrial processes using HMI and real-time data. Explore device roles from MTU and RTU to PLC, PAC, and IED.

Explore the IT/OT gap, define OT terminology, and examine the Purdue reference model for OT networks while contrasting IT components within operational technology.

Navigate the terminology of operational technology by examining why industries differ and how SCADA, DCS, IACS/ICS, PLCs, RTUs, and safety instruments shape industry OT solutions with supervisory, control, and automation.

Define operational technology as hardware and software that detect and cause change through monitoring or control of equipment, assets, and processes, including ICS like SCADA and DCS and cyber-physical systems.

Explore the IT/OT gap, highlighting similarities and critical differences where confidentiality versus safety dictates priorities, and explain firewall terms like fail open versus fail closed in OT contexts.

Recognize that OT network design demands more depth and layers than IT, going beyond local networks, wireless, VLANs, and data center to connect endpoints across branches and cloud.

Examine how the safety instrumented system sits alongside OT processes, define level zero as field devices with actuators and sensors on the plant floor, and map OT layers.

Describe level one in OT cybersecurity as the automation layer with plcs, rtus, and dcs controllers, using the field bus to connect controllers to sensors and actuators.

Identify the level two supervisory components: the HMI, engineering workstations, SCADA servers, and data historian. Explain their connections to PLCs, RTUs, and controls via Ethernet, fiber, UTP, or serial.

Explore level three's manufacturing execution system, delivering full visibility from start to end of operations to optimize production, quality, and cost through process and production management.

Explore level four management related to enterprise resource planning, tracking production, updating the product database, inventory counts, packing status, and warehouse readiness.

Explore how enterprise networks isolate OT levels from IT and internet exposure using Ethernet links. Learn how physical or logical isolation, via firewalls and access control lists, preserves security.

Learn how the Purdue reference model structures OT and IT networks into layered zones, enabling segmentation and micro-segmentation with a DMZ, firewalls, and remote maintenance.

Explain how operational technology integrates IT components—servers, workstations, routers, switches, firewalls, and endpoint protection—with non-IT devices like PLCs and RTUs, and industrial protocols like Modbus and OPC.

Understand how industrial protocols and PLC/RTU differ from IT components. Deploy antivirus, firewalls, and access controls to secure OT devices, and recognize that many protocols are insecure by design.

Compare IT and OT in cybersecurity and explore which is easier to hack, considering ethical hackers and attackers' perspectives.

Compare IT and OT cybersecurity by examining exposure, isolation, and safety priorities, and discuss insecure-by-design OT components and security controls that mitigate risk.

Air-gapped OT networks may be logically or physically isolated, but isolation is not perfect. Remote maintenance, phishing, USB access, and zero-day malware demand OT cybersecurity controls at lower levels.

The lecture contrasts IT and OT cyber security, describing encryption tradeoffs, data encryption needs for data historian, email, inventory, ERP, and highlighting patch management, legacy systems, and cautious penetration testing.

Highlight IT and OT cybersecurity awareness gaps and risks in operational technology, including availability, latency, safety instrumented systems, and the impact on plant processes.

In OT versus IT, safety takes precedence over confidentiality, with integrity and availability following, as commands to a PLC must remain unaltered to prevent unsafe set points.

Clarifies the IT-OT gap and terminology, maps the Purdue reference model levels 0–5 from field devices to IT, and highlights differences between information technology and operational technology.

Explore operational technology and communication protocols, perform a deep Modbus analysis, review the Morbus RFC, and practice labs with Modsim Modscan, Wireshark, and HMI connections to Modsim via Winlog light.

Differentiate digital value and analog value by explaining discrete binary outputs and continuous signals like temperature, speed, and pressure. Explain how OT protocols carry information and commands for supervisory.

Read input values, discrete or analog, as tags for the PLC and the HMI. Understand how OT industrial protocols move level data and sensor information as bits and bytes.

The lecture explains how a write level command from the HMI sets a PLC target. The PLC monitors the level and drives discrete or analog actuators to control the motor.

Explore industrial protocols used in process automation and building management, including Modbus, CIP, DNP3, OPC UA, IEC 61850, and insecure-by-design security considerations for open versus vendor-owned standards.

Explore Modbus, the oldest widely deployed OT protocol, designed in 1979 by Modicon and now an open standard; it uses a compact request–reply model within TCP as an application-layer protocol.

Explore Modbus communication types, from ASCII to RTU serial formats and TCP, noting master/slave vs client/server roles, incompatibilities, and how baud rate and distance affect serial speed.

Describe Modbus TCP client-server communication over Ethernet, where a client reads or writes to a PLC and receives responses or error messages.

Explore modbus tcp memory addressing on the plc and server sides, mapping coils, discrete inputs, input registers, and holding registers to addresses 1 to 9999 that define type and access.

Examine PLC memory address types and values, including coil and discrete input 0/1 values and 16-bit words extended across addresses, with byte order differences across vendors for read and write.

Examine how Modbus TCP and Modbus RTU use different structures and formats, making them incompatible.

Explain how Modbus TCP differs from Modbus RTU by detailing the Modbus application protocol header and the Modbus protocol data unit, and how TCP handles errors (port 502).

Learn the Modbus tcp header, where seven bytes leave 249 bytes for the data unit, and include a transactional id, unit id, zeros for protocol id, and a length field.

Master the Modbus PDU, where a function code byte and remaining bytes define unit id and address ranges, with a header carrying transaction id and length in Ethernet IP/TCP stack.

Learn to build a Modbus TCP read input registers request for temperature at address 100, and compare zero versus one addressing and byte order implications.

Decode Modbus TCP request by parsing ethernet frame, transaction ID, protocol ID, length, unit ID 2, and function code 3 to read a holding register at address 200 (0xC8).

Explore Modbus function codes in OT and SCADA, including read discrete input, read coils, and write coils or registers, with start and count ranges and file read/write for firmware upgrades.

Discover how Modbus RFCs guide open protocol use, detailing the application protocol header, PDU, RTU and TCP variants, and common function codes for data access and cybersecurity relevance.

Explore hands-on Modbus communication using mode scan and mode sim to simulate an HMI to PLC link over Modbus TCP, configuring addresses, unit ID, holding registers, coils, and input registers.

Explore Wireshark analysis of Modbus by loading a packet capture, applying Modbus display filters, and examining queries and responses between two hosts to understand conversations and basic protocol details.

Analyze Modbus TCP packets in Wireshark by tracing transaction IDs, protocol identifier, and unit IDs; interpret read coils (0x01) and read input registers (0x04) requests and responses, including byte counts.

configure an hmi with winlog lite to connect a modbus tcp simulator, set up channels, a device, and gates for coils and input registers, and design a template switch.

Explore operational technology protocols, including Modbus history, memory, input/output, addressing, and function codes, study the Modbus TCP segment, and complete labs with an HMI and Wireshark analysis.

Explore cybersecurity controls for operational technology, including endpoint security, identity and access management, and secure remote access, with next-generation firewall, intrusion prevention, and intrusion detection for an integrated, compliant approach.

Understand the operation you are securing to protect OT systems; this fundamental training emphasizes identifying risks, studying the operation, applying third-party recommendations, and considering environment and maintenance factors.

Learn how network asset discovery builds visibility by tracking all active and inactive assets, mapping their relationships, and classifying hardware, software, and licenses to secure operations.

Explore agentless network discovery for OT environments, using passive scanning and port mirroring to identify assets, applications, vulnerabilities, and baseline normal traffic without impacting operations.

Visualize network asset discovery in real time with graphs and mind-map style charts to understand asset relationships, traffic flow, baselines, and abnormal activity.

Explore endpoint security for OT, covering agent-based protection, offline solutions, endpoint detection and response, vulnerability scanning, patch management, and advanced whitelisting to block malware and ransomware.

Explore identity and access management for secure ot environments, covering ldap user stores, authentication with passwords and multi-factor methods, rbac provisioning, and reporting of login events.

Intrusion detection systems monitor network traffic passively, raising alarms when they detect anomalies, enabling baselining, parameter boundary and protocol conformity checks, and investigation of unexpected commands in operational technology environments.

Explain how next generation firewall and intrusion prevention operate inline to inspect traffic and block malicious connections, using whitelisting, protocol awareness (modbus), and DPI.

Network access control orchestrates the network with agentless, centralized management, enabling automation, 100% visibility of internal assets, and policy-compliant integration across OT environments.

Define secure remote access with scheduled start and end times, enforce two-factor authentication, VPN, endpoint protection, and session recording for compliance.

Acknowledge that OT components are not secure by design. Integrate security controls in design, including HMI authentication and boundary checks, and apply PLC SDLC-like practices for OT.

Explore OT cybersecurity compliance, including country-specific laws and standards, documentation, and integration with existing systems, plus training, testing, change management, and exception processes for secure deployments.

Learn how to secure OT through visibility, agentless asset discovery, endpoint protection, and IAM, while evaluating intrusion detection, next-gen firewalls, network access control, and OT compliance.