OT & Industrial Cybersecurity Bootcamp (SCADA, PLC, Modbus)

Explore why OT security differs from IT, prioritizing safety and availability over confidentiality, embracing 30-year deployment lifespans, Modbus risks, and humility when approaching OT controls.

Identify five IT reflexes that disrupt OT environments—patching, active scanning, rebooting, trusting outdated diagrams, and underestimating attackers—and replace them with risk-based, coordinated controls.

Examine real human consequences of OT failures through cases like Stuxnet, Ukraine power grid outages, and Frosty Goop, highlighting Modbus, SIS, and the IT/OT seam.

Translate PLC data into operator-facing visuals with alarms and flow indicators. Defend Windows-based HMIs in OT by hardening the host and monitoring HMI software and PLC traffic.

Clarifies OT terminology by unpacking BPCS, DCS, SCADA, and SIS, explains architectural differences and why the SIS must be kept separate, helping defenders identify which system runs production.

Take a layer-by-layer walkthrough of a virtual chemical plant to see how process, field instrumentation, control, supervision, operations, and enterprise IT connect, including PLCs, HMIs, historian, ERP, and safety systems.

Discover why a Purdue reference model provides a common logical home for OT devices, enabling faster risk assessments, audits, and incident response across PLCs, HMIs, and engineering workstations.

Explore the Purdue reference model for industrial control systems, from level zero to level five, plus the industrial DMZ, and the rules for communication between adjacent levels.

Learn to apply security controls to Purdue layers using IEC 62443, focusing on zones, conduits, security levels (SL1–SL4), and the seven foundational requirements to assess OT security.

Explore how IT/OT convergence challenges the Purdue model, revealing breaks like cloud-connected PLCs, industrial IoT, virtualization, vendor remote access, and data lakes, with risk-based defense recommendations.

Map a municipal water treatment plant to Purdue levels and six, two, four, four, three zones, detailing PLCs, RTUs, HMIs, DMZ, and secure conduits with firewall rules.

Examine how ICS protocols like Modbus, DNP3, and OPC UA were not designed with authentication, encryption, or integrity in mind, leading to trust-everything networks and the need for secure perimeters.

Walks through a real Modbus tcp packet, decoding transaction id, length, unit id, and function code 3 to read a holding register at 0101 hex and interpret the response.

Explore DNP-3 fundamentals for North American utilities, detailing its layered architecture, object groups, timestamped events, and secure authentication with HMAC and two modes.

Siemens S7-COM over TCP port 102 enables read, write, and programming of PLCs. Older S7-COM uses no authentication, and S7-COM+ adds authentication and TLS upgrades for defense.

Learn how OPC UA provides security-by-design in industrial control systems, featuring mutual authentication, encryption, and role-based access across a flexible client-server model with a rich address space.

Identify EtherNet/IP and Profinet on the wire, recognize CIP as the common industrial protocol with its safety, sync, and motion variants, and note their real-time and diagnostic traffic.

Deliver a quick cheat sheet mapping protocols to ports and purposes for incident response, including Modbus TCP 502 and DNP3 20000, and note that most defaults lack encryption or authentication.

Explore six open-source tools in a home lab to practice OT skills end-to-end, including OpenPLC, ModbusPal, Conpot, Wireshark, Zeek, and GRF-ICSv2, with guidance on safe lab architecture.

Isolate your lab with a host-only network to prevent leakage and use snapshots to roll back experiments; configure a control PLC and HMI network and a management network for analysis.

Discover where to download VirtualBox, VMware, OpenPLC, Modbus pal, Conpot, Wireshark, Zeek, and other ICS tools, plus a 40-page setup PDF organized into seven sections.

Define seven success criteria for a working OT lab: booting VMs and OpenPLC serving Modbus, Modbus PAL reads, Wireshark and Zeek logging, and simulating a plant attack.

Understand the Asante-Lee ICS kill chain, a two-stage model where IT intrusion leads to OT intrusion and impact, with the boundary between stages providing key defense opportunities.

Learn how attackers use Shodan and Census to identify internet-facing OT assets, uncover Modbus devices, Siemens S7 PLCs, and building management systems, and why defenders must search their own exposure.

Explore Shodan's interface and query language to identify exposed OT assets, including Modbus devices. Learn practical defense tips, saving searches, and monitoring exposure.

Learn the three top initial access patterns in OT: USB media, phishing, and vendor remote access—and the practical defenses, including USB controls, phishing-resistant practices, and vendor access governance.

Explore how IT-to-OT lateral movement occurs across three paths—engineering workstation, historian, and DMZ boundary firewall—and how to stop it with MFA, separate credentials, and strict access controls.

Trace the Stuxnet blueprint: a worm targeting Siemens S7 PLCs that damaged centrifuges, spread via USB, used four zero-days and stolen certificates, and shaped modern OT cybersecurity.

Indestroyer, also called Crash Override, shows a modular, ICS-native malware that autonomously opens and closes substation breakers via native protocol commands.

Triton and Trisis targeted the safety instrumented system at a petrochemical plant, aiming to disable the SIS rather than damage it, revealing how attackers exploit safety-control weaknesses.

Explore four patterns in OT-targeted activity—Sandworm's Indestroyer 2, Frosty Goop, OT ransomware, and emerging AI-enabled recon—showing defenders must continuously iterate, deploy segmentation, and stay current with threat intel.

Distill cross-cutting lessons: apply the Asante-Lee two-stage model—IT compromise followed by OT impact—prioritize identity hygiene, visibility, protocol monitoring, and IT-OT seam defense, and practice tabletop exercises.

Build and maintain an OT asset inventory as the foundation for defense, using passive discovery, configuration extraction, and annual physical walkdowns to identify devices, criticality, connections, including fifteen attributes.

Segment the OT network into zones with a DMZ IT-OT boundary, enforce firewall rules, and audit quarterly to monitor boundary traffic and prevent cross-zone attacks.

Learn how segmentation is enforced with firewalls, unidirectional gateways, and data diodes, including OT-specific firewalls that parse Modbus, DNP3, IEC protocols, and industrial traffic.

This lecture explains secure remote access for OT via a DMZ jump host, MFA, RBAC, session recording, time-limited access, and ZTNA, with a phased implementation roadmap.

Implement three layers of OT backups—PLC programs and configurations, HMI configurations, and supporting systems—and verify restorations with offline, off-site backups and annual testing.

Identify and mitigate supply chain and vendor risk by recognizing patterns of vendor compromise, malicious updates, and hardware tampering, and enforce controls like sboms, code signing, and restricted vendor access.

Master the engineering workstation hardening checklist to secure OT environments with a dedicated EWS, identity controls, restricted network access, application allow listing, rebuild discipline, and change-management.

Prioritize passive observation and configuration extraction to see what's on the OT network. Active scanning can crash aging OT devices; coordinate with operations and use OT-aware tools if necessary.

Compare span ports and network taps for OT visibility, explain when to deploy taps at IT-OT boundaries and high-value choke points, and outline practical tap types and considerations.

Explore three commercial OT visibility platforms—Nozomi Networks, Clarity, and Dragos—that deploy passive sensors, map devices, learn baselines, surface anomalies, and provide centralized management, threat intelligence, and vulnerability insights.

Define normal in OT by enumerating devices, connections, and protocols and baselining two weeks of clean traffic to enable anomaly-driven detections with Zeek and SIEM.

Demonstrates writing a Zeek detection rule to catch Modbus write storms by counting writes per source and destination pair (function codes 6 or 16) within a minute, with tuning guidance.