Master ICS/OT Cybersecurity: Fundamental to Advanced-Part 1

Explore the Purdue model, an evolving enterprise reference architecture that links OT and IT across levels—from equipment to cloud—and defines cybersecurity controls, including the DMZ concept.

Describe level zero basics, including sensors, actuators, and smart devices, whose 4–20 mA signals feed level one controllers, with pressure transmitters, thermocouples, RTDs, and flow transmitters for instrumentation and pumps.

Level one devices fetch signals from level zero and feed level two, using PLCs, control processors, relays, and microcontrollers that autonomously execute continuous commands with low bandwidth and proprietary protocols.

Level two, the local supervisory level, monitors and controls a single process, isolating functions and increasing cybersecurity scope with Windows, Linux, TCP/IP, and time-sensitive networks.

Explore level three systems, including customized devices, management servers, MES real-time data collection, and site-wide historians and supervisors, with common TCP/IP and Ethernet communications.

Level 3.5 establishes a DMZ between IT and OT with firewalls and proxies to block north-south and lateral movement, discussing patch management placement and internet exposure and convergence considerations.

Level 4 covers local site business networks with enterprise connectivity and direct internet access, including local workstations, file and print servers, phone systems, and Active Directory.

Explore the enterprise level of the Purdue model, where Active Directory, ERP, DNS, and web servers support manufacturing operations with no trust to level three and below.

Examine the Purdue model from level zero to five, detailing demarcation, lan, instrument bus, and manufacturing zone servers. Explore dmz firewalls, patch servers, historian, remote access, and enterprise domain controllers.

Explore the extended Purdue model for ICS/OT security, detailing levels zero to five and zones from safety to enterprise, with device roles, DMZ concepts, and risk profiles.

Explore a future Purdue model where IT and data convergence push data to the cloud for analysis and maintenance prediction, across level zero to five with DMZs and IoT components.

Explore the five programming languages defined by IC 61131—sequential function chart, functional block diagram, ladder logic, structured text, and instruction list—applied to MIDI controllers and PLC systems.

Explain sequential function chart basics: coordinate discrete process sequences with steps and transitions, modelable by state diagrams or Petri networks, featuring alternative and parallel branching and initialization and end steps.

Explore function block diagrams, wiring inputs to blocks that perform operations from add and subtract to multiplication, division, mod, square root, and exponential, with timers and custom blocks driving outputs.

Ladder logic is a graphical programming language used in PLCs to control and automate industrial processes, with ladder rungs, input contacts (NO/NC), and coils that implement series and parallel logic.

Structured text is a high-level language for industrial control that enables precise, modular programs with variables, data types, operators, control structures, and libraries for mathematical and statistical calculations.

Explore instruction list programming as a low-level, sequential language used in PLCs to control automation with instructions, registers, addresses, and jump functions guiding execution.

Explore field devices and processes, including a pneumatic control valve with a positioner and diaphragm, manual isolation valves, and 4 to 20 mA signals guiding robotic arms and plant flow.

Explore the seven OSI layers and the TCP/IP model, learn what each layer does—from physical to application—and how these layers guide protocol placement, addressing, and traffic analysis.

Explore the TCP/IP model, its four layers, and how TCP and UDP enable reliable and unreliable data delivery, routing, addressing, and physical media like Ethernet and Wi‑Fi.

Learn how Ethernet/IP uses the SIP protocol in industrial control systems, operating across OSI layers with TCP/IP and UDP for explicit and implicit messaging, enabling active infrastructure and scalable networks.

Analyze CIP Ethernet/IP traffic with Wireshark, decode MAC and IP addresses, examine TCP/UDP ports (44818, 137–138), and explore connected and unconnected CIP messages including Get Attributes All.

Master the Modbus protocol in industrial control system contexts, including RTU, ASCII, Plus, and TCP/IP variants, with physical layers RS-232/RS-485, node addresses, and traffic dissection insights via Wireshark.

Analyze Modbus TCP traffic with Wireshark, filtering modbus packets, exploring protocol hierarchy and port 502, and examining function codes like write single coil, read coils, and read holding registers.

Learn to simulate a Modbus master, read and write coils and holding registers via command-line tools, and practice Modbus hacking using ModbusPal across Windows and Linux.

Explore DNP3, a bidirectional, real-time protocol for master stations and outstations in substations, featuring timestamping, time synchronization, CRC-based reliability, and secure DNP with session keys.

Analyze DNP3 traffic with Wireshark, inspecting Ethernet, IP, and TCP headers, then explore read, write, select, operate, and confirm function codes and data objects.

Learn about IEC61850-GOOSE and MMS protocols, a high-speed multicast, peer-to-peer layer-2 communication for substation protection, control, and automation using a publish-subscribe model and binary data.

Discover the IEC 61850 MMS protocol, a TCP/IP-based, text-based client–server standard for reporting and controlling in power systems between substations and remote control centers, with authentication, encryption, and access control.

Discover OPC classic and OPC UA, including data, alarm and historic data exchange, unified architecture, platform independence, and security features like encryption and firewall-friendly communication.

Explore the ICC protocol, an inter control center protocol enabling secure, reliable data exchange between utility control centers from owners and vendors, to configure and operate remote devices via TLS.

Explore wired and wireless communication media in industrial control systems, including coaxial and twisted pair cables, optical fibers, and wireless options like Bluetooth, Wi-Fi, Zigbee, RFID.

Identify popular media connectors used in internet and serial communications, including RJ-45, RJ-11, RS-232, and RS-485, and recognize optical fiber connectors such as SC, ST, LC, FC, and MTP/MPO.

Explore the 802.11 wireless family, covering wireless local area networks, frequency bands, data rates, and modulation techniques, plus security evolution from WEP to WPA3 and encryption with CCMP and ARC4.

Explore common wireless attacks such as piggybacking, wardriving, evil twin, sniffing, shoulder surfing, and denial of service, and how authentication and authorization protect open networks.

Explore Zigbee, a low power, low data rate wireless standard based on 802.15.4 for home and industrial automation, using mesh networking and master, link, and network keys.

Explore Bluetooth fundamentals on the 2.4 GHz band with 1–3 Mbps and 1–100 m range, and compare Bluetooth low energy with Bluetooth classic, including numeric comparison, passkey entry, and out-of-band.

Explore Wireless HART, an 802154 radio protocol that uses a 2.4GHz mesh network with TDMA and a network manager to secure devices via encryption and join keys.

Explore ISO/IEC 111 for industrial automation, featuring mesh networking with backbone routers and field devices, IPv6 over 6LoWPAN, and symmetric and asymmetric encryption protecting against replay attacks.

Learn how RFID uses radio waves to identify and track assets in industrial control systems. Explore passive and active RFID, and ISO 15693 high-frequency standards.

Explore cellular communication from 2G to 5G, including spectrum shifts, network evolution, and how access networks, backhaul, core networks, and base stations connect devices for voice and video calls.

Explore satellite communication with VSAT and BGN, comparing fixed vs portable terminals, line-of-sight requirements, weather impact, and data rates. StarLink exemplifies a hybrid VSAT–BGN system with auto-tracking and low-earth-orbit advantages.

Explain how Windows dominates industrial systems, outline end-of-life dates for various editions, and stress that end-of-life means no patches and growing vulnerabilities.

Understand the fixed lifecycle policy and Microsoft support models, including mainstream, extended, ESU, and LTSC and SAC servicing channels for enterprise stability.

Explore how compatibility matrices map operating system versions and third-party software to industrial applications, highlighting Siemens product versions, service packs, and the need to upgrade OS and Java when unsupported.

Practice hands-on PowerShell basics on Windows to explore commands, use Get-Help and Get-Command, and inspect object members with Get-Member, preparing for Windows hardening and Windows Defender Firewall tasks.

Learn how to locate and navigate the current working directory path with get-location and set-location in powershell, exploring paths like users and documents, and list running processes with get-process.

Master PowerShell basics by listing hotfix updates with Get-Hotfix and viewing install details, then review firewall rules with Get-FirewallRule all and inspect object properties using Get-Member.

Learn to use PowerShell to create, write, and read files, calculate a file hash with Get-FileHash, understand execution policy types, and list local users.

Explore PowerShell network commands such as get-netadapter and get-netroute to view adapters and routing tables. Practice disabling and enabling net adapter binding, and examine tcp settings and component IDs.

Explore PowerShell commands to inspect system health and inventory using Get-EventLog, Get-WmiObject, and Win32 classes. Filter results with pipe and select-string, monitor services, and test network connectivity.