WEEK 13
OT & Industrial Cybersecurity
Operational scenario
Odd Modbus writes are hitting the simulated water-treatment PLC. Investigate without stopping the process.
Week completion
0%
~10 hours this week
Assessment: Knowledge check 12; acronym quiz 7
Deliverable: OT zone / conduit + IR plan
Learning objectives
- Apply IT/OT differences, the Purdue Model and 62443 zones/levels
- Respond safely in production
Classroom topics
- IT vs OT
- ICS / SCADA / DCS / PLC / HMI / SIS / RTU
- Historians
- Industrial protocols (Modbus TCP, DNP3, OPC UA, EtherNet/IP, PROFINET, BACnet, MQTT)
- IDMZ; data diodes
- Secure remote access
Standards · vocabulary
NIST SP 800-82r3ISA/IEC 62443MITRE ATT&CK for ICS
ICSSCADAPLCHMIDCSSISRTU
Open glossaryCompetency demonstrated: Applies OT security and safe IR.
Four-mode learning matrix
~1.5 h
Physical hands-on lab
Connect a simulated PLC + HMI; observe a safe process loop.
~2 h
Docker container lab
Lab 15 — Investigate a simulated IT-to-OT intrusion.
~0.5 h
AR/VR immersive scenario
Explore an industrial facility; identify PLCs / HMIs / EWS / SIS; navigate Purdue. Role: OT engineer.
No headset? Desktop Purdue navigator + cards. Printed and mobile versions are also available.
Individual technical assignment
Draw a site's Purdue-model zones & conduits.
Team exercise
Plan safe IR for an OT incident without stopping the process.
Required hardware
- PLC training kit or simulator
- HMI simulator
- Sensors
Required software
- OpenPLC / process simulator
- Wireshark (Modbus dissector)
Workplace application
OT security specialists are among the scarcest and best-paid roles in the field.
Docker progression step
L15 Investigating a simulated IT-to-OT intrusion
Open the Docker rangeTrace the pivot from webapp → jump → historian → plc-sim; build the timeline.
Lab evidence to collect
Safety controls — confirm before starting
Reflection & rubric for week 13 Modes tracked: 0/5