OT-101 Foundation — OT Security Specialization Track - ICS Village rainers - DCTSG2027

Day 1 - Morning: OT Fundamentals and the Attack Surface

Core Topics:

• The Purdue reference model and OT asset classes: PLCs, HMIs, historians, and engineering workstations.
• Common industrial protocols (Modbus, DNP3, S7) and why they were designed without authentication.
• SAIC (Safety, Availability, Integrity, Confidentiality) prioritization versus the IT CIA triad, and why availability and safety change how an OT network is attacked.

Practical Applications:

• Teams bring up their own plant and map every component onto the Purdue model.
• Get on the network and inventory it passively from traffic alone, and learn why running Nmap on a plant is a beginner's mistake, not a technique.
• Decode live Modbus and DNP3 traffic with Wireshark and tshark: reads versus writes, the polling rhythm, and S7 from a sample capture.

Learning Objectives:

• Objective: Identify OT asset classes and map them onto a Purdue architecture.
• Objective: Decode industrial protocol traffic and build a passive asset inventory.
• Objective: Explain how the absence of authentication in legacy protocols enables unauthorized control.

Day 1 - Afternoon: Threat Actors and Living off the Land

Core Topics:

• How real-world adversaries pivot from IT into OT: case studies of Volt Typhoon, the CyberAv3ngers / Unitronics campaign, FrostyGoop, and Industroyer2 / PIPEDREAM.
• Living off the Land in OT: abuse of legitimate engineering software and native functionality rather than malware.
• Adapt the incident-handling lifecycle for physical processes so attackers understand what defenders will and won't see, and what forces a shutdown.

Practical Applications:

• Teams send an unauthenticated Modbus command to their own PLC and watch the process change on the HMI, then find that same command back in the capture. This is FrostyGoop in miniature: the 2024 attack on a Lviv heating utility used exactly this: legitimate Modbus TCP writes, no exploit and no malware on the controllers, leaving 600+ apartment buildings without heat for two days in winter.
• Explore what else the protocol allows with no credentials: read and write registers and coils, and reason about the physical effect of each.
• Trace a staged intrusion across the plant's own logs and captured traffic to reconstruct the timeline and see what the activity looked like from the inside.

Learning Objectives:

• Objective: Send industrial protocol commands to a PLC and predict and observe the physical effect.
• Objective: Attribute observed techniques to documented OT threat actor behaviors.
• Objective: Explain how legitimate functionality, not malware, drives most OT impact.

Day 2 - Morning: Going Deeper into the Systems

Core Topics:

• Inside the PLC: logic, I/O, registers and coils, and what an attacker can reach without special tooling.
• The HMI and engineering workstation as targets and as pivots.
• DNP3 and other protocols beyond Modbus: what changes for an attacker and what stays the same.

Practical Applications:

• Teams dig into their PLCs ' registers and coils, manipulate setpoints and outputs, and map each change to what the plant does.
• Use the HMI's own view to confirm the effect and to understand what an operator would and wouldn't notice.
• Compare attacking over Modbus versus DNP3 on the same plant.

Learning Objectives:

• Objective: Enumerate and manipulate PLC registers and coils and tie each to a physical effect.
• Objective: Describe how an attacker uses the HMI and engineering workstation as targets and pivots.
• Objective: Generalize protocol attack concepts across Modbus and DNP3.

Day 2 - Afternoon: Scored Team Challenge

Core Topics:

• Stealth versus impact: what a careful attacker does differently from a loud one.
• What the morning's activity left behind in logs and captures.
• Where defenses would have changed the outcome (context, not a defensive lab).

Practical Applications:

• Scored team challenge: each team is given objectives on the plant (reach a device, achieve a specific process effect, and do it without tripping the obvious alerts) and works on them on the clock.
• Debrief: teams walk through their approach, compare what worked, and see what a defender would have caught.

Learning Objectives:

• Objective: Chain the course's techniques into a goal-driven attack on a live process.
• Objective: Reason about detection and stealth from the attacker's side.