Industrial Cybersecurity & IEC 62443 Specialist

Introduction to the cybersecurity module and the core concepts it covers, from the Purdue model to defence in depth.

How the Purdue model splits an industrial network into levels, and how to use it to plan network architecture and security boundaries.

The main differences between OT and IT networks, and why industrial systems have different technical demands from office IT.

Why OT puts availability first while IT puts confidentiality first, and how this changes the way you secure each environment.

What a cyber attack is, the common types of attack, and the real consequences they have for industrial systems and networks.

The basic ideas of cybersecurity and the stages an attacker goes through, from reconnaissance to impact on a control system.

How defence in depth uses multiple layers of technical, physical and procedural controls, so that if one layer fails the next still protects the industrial assets.

How modern control system architectures have taken on IT components such as Ethernet, Windows and remote links, and why this has widened the attack surface.

Recap of the cybersecurity introduction module and the key ideas to carry forward.

Introduction to the IEC 62443 foundational requirements module and how the seven requirements are laid out.

IEC 62443 FR1 identification and authentication control: how users, software and devices are identified and authenticated in an industrial control system.

IEC 62443 FR2 use control: how to enforce the right privileges for users and devices, and keep audit records of their actions.

IEC 62443 FR3 system integrity: how to protect control system software, data and communications from unauthorised changes, and how integrity checks detect tampering.

IEC 62443 FR4 data confidentiality: how encryption and access restriction keep sensitive control system data private, both in transit and at rest.

IEC 62443 FR5 restricted data flow: how segmentation into zones and conduits limits communication between components and enforces the least privilege principle.

IEC 62443 FR6 timely response to events: how to monitor, detect and respond to security events in an industrial control system.

IEC 62443 FR7 resource availability: how redundancy, backup and fault handling keep a control system running under attack or failure.

Recap of the seven IEC 62443 foundational requirements and the parts of the standard covered in this module.

Introduction to the in-depth module and the advanced security controls it covers, from asset management to endpoint protection.

How asset management gives you an accurate inventory of control system devices, and why it is the starting point for OT security.

How network segmentation divides an industrial network into smaller zones with their own purpose, to limit the spread of an attack and improve performance.

How network discovery finds and maps devices on an OT network, and how it supports intrusion detection and asset management tools.

How intrusion detection systems monitor industrial networks for suspicious activity, the difference between signature and anomaly detection, and where to place sensors.

How to set up secure remote access to control systems, so vendors and engineers can connect without opening the plant to attack.

How SIEM tools collect and correlate security events from across the plant to support threat detection, compliance reporting and incident management in OT.

How endpoint protection monitors and protects workstations, servers and controllers against malware and misuse, and what makes this harder in industrial settings.

Recap of the in-depth module and the advanced security controls covered.

Review of the whole course, summarising the key control system and cybersecurity topics studied in each module.

Introduction to the networks section and why network security matters so much for industrial control systems.

Standard industrial network technology: ICS and SCADA networks, common industrial protocols, and the specific security issues these networks raise for operators.

How the OSI seven-layer model describes network communication, from cables at layer 1 up to applications at layer 7, and what each layer means for security.

The physical layer in industrial networks: cables, connectors, fibre and electrical signals, and why physical protection is the base of network security.

Deep dive into OSI layer 1, covering physical security and its effect on the reliability and performance of industrial networks.

The data link layer and how it moves frames between devices on a local industrial network, with its main security risks.

Deep dive into OSI layer 2: how MAC addresses and switching manage local traffic, and the attacks and controls that apply at the data link layer.

How switching and routing work in industrial networks, how switches and routers differ, and how to configure them for reliability and security.

The network layer and how IP addressing and routing carry traffic between industrial network segments, with the security risks found at layer 3.

Deep dive into OSI layer 3: IP addressing logic, subnets and how routers direct traffic across different networks in an industrial plant.

How IPsec provides authentication, encryption and integrity for traffic across industrial networks, and how tunnel and transport modes are used in practice.

How network address translation and firewalls protect the boundaries of industrial networks, and how the main firewall types differ in what they inspect.

Advanced network segmentation strategies for isolating critical assets in industrial environments, so a breach in one area cannot easily reach safety or control systems.

How logical segmentation with VLANs and layer 3 switches creates network boundaries without physical separation, and the security benefits and limits of this approach.

The transport layer, TCP and UDP, ports and sessions, and how it supports reliable, real-time and secure communication in industrial networks.

The application layer in control systems, where users, HMIs and applications interact, and how to secure industrial protocols there.

How DNS works, the attacks that target it such as spoofing and cache poisoning, and how to secure name resolution in industrial networks.

The difference between managed and unmanaged industrial switches, and why managed switches with VLANs, port security and monitoring give better security control.

How quality of service prioritises time-critical control traffic on industrial networks, so that safety and control messages are not delayed by less important data.

A closer look at QoS mechanisms such as traffic classification, queuing and priority tagging, and how to apply them on industrial switches and routers.

How network monitoring and logging give visibility of industrial networks, what to log, and how the records help detect and investigate security problems.

The main network security tools used in industrial control systems, such as firewalls, intrusion detection and network analysers, and what each one is good for.

Network security best practices and hardening steps for industrial control systems, from clear security policies to disabling unused ports and services.

Why time synchronisation matters for automation, event logging and security, and how scalable time distribution is designed across an industrial network.

How Precision Time Protocol (IEEE 1588) synchronises industrial devices to sub-microsecond accuracy, the role of grandmaster clocks, and how to secure it.