{"product_id":"ot-101-foundation-ot-security-specialization-track-ics-village-trainers-sg2027","title":"OT-101 Foundation — OT Security Specialization Track - ICS Village rainers - DCTSG2027","description":"\u003cp\u003e\u003cstrong\u003eName of Training:\u003c\/strong\u003e OT-101 Foundation — OT Security Specialization Track\u003cbr\u003e\u003cstrong\u003eTrainer(s):\u003c\/strong\u003e ICS Village trainers\u003cbr\u003e\u003cstrong\u003eSkill Level:\u003c\/strong\u003e Beginner, Intermediate\u003cbr\u003e\u003cstrong\u003eDates:\u003c\/strong\u003e March 5 – March 6, 2027\u003cbr\u003e\u003cstrong\u003eTime:\u003c\/strong\u003e 9 to 5 pm\u003cbr\u003e\u003cstrong\u003eVenue:\u003c\/strong\u003e TBD\u003cbr\u003e\u003cmeta charset=\"utf-8\"\u003e\u003cstrong\u003eEarly Bird Cost:\u003c\/strong\u003e S$3,900 \u003cmeta charset=\"utf-8\"\u003e(incl. GST, until Dec 31, 2026)\u003cbr\u003e\u003cstrong\u003eRegular Cost:\u003c\/strong\u003e S$4,200 (S$3815 incl. GST)\u003c\/p\u003e\n\u003ch3\u003eShort Summary\u003c\/h3\u003e\n\u003cp\u003eYou already know how to get onto an IT network. This course shows what happens next when that network runs a physical process. Working in small teams on a live industrial plant, students map it, read its traffic, and send their own commands to a PLC and watch the process react, the way FrostyGoop shut off heat to 600 buildings in Ukraine with nothing but legitimate Modbus commands. The focus is the OT attack surface from the attacker's seat: no firewalls to break, no exploits to write, just how exposed a plant already is once you are on the wire.\u003c\/p\u003e\n\u003ch3\u003eCourse Description\u003c\/h3\u003e\n\u003cp\u003eThis is a hands-on, offense-focused foundation in operational technology for people who come from IT and security. It answers one question: once an attacker reaches an OT network, how much can they see and do, and what does it look like?\u003c\/p\u003e\n\u003cp\u003eStudents work in teams of 2 to 4 on a shared ICS Village lab kit (a complete simulated water-treatment plant with a PLC, Modbus and DNP3 devices, an HMI and a monitored network). There is no firewall to defeat, and no memory-corruption exploit. The plant is reached the way most real OT intrusions reach one: through a flat or poorly segmented network and protocols that were never built to say no.\u003c\/p\u003e\n\u003cp\u003eOver two days, teams map the plant, build a passive asset inventory, decode the industrial protocols, send unauthenticated commands to the PLC and watch the process change, and study how real adversaries pivot from IT into OT and live off the land once inside. The course closes with a scored team challenge on the plant.\u003c\/p\u003e\n\u003cp\u003eThis course is for IT security practitioners, SOC analysts, penetration testers, and engineers who are new to OT and want to understand the industrial attack surface firsthand.\u003c\/p\u003e\n\u003ch3\u003eCourse Outline\u003c\/h3\u003e\n\u003ch4\u003eDay 1 - Morning: OT Fundamentals and the Attack Surface\u003c\/h4\u003e\n\u003cp\u003eCore Topics:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe Purdue reference model and OT asset classes: PLCs, HMIs, historians, and engineering workstations.\u003c\/li\u003e\n\u003cli\u003eCommon industrial protocols (Modbus, DNP3, S7) and why they were designed without authentication.\u003c\/li\u003e\n\u003cli\u003eSAIC (Safety, Availability, Integrity, Confidentiality) prioritization versus the IT CIA triad, and why availability and safety change how an OT network is attacked.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003ePractical Applications:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eTeams bring up their own plant and map every component onto the Purdue model.\u003c\/li\u003e\n\u003cli\u003eGet on the network and inventory it passively from traffic alone, and learn why running Nmap on a plant is a beginner's mistake, not a technique.\u003c\/li\u003e\n\u003cli\u003eDecode live Modbus and DNP3 traffic with Wireshark and tshark: reads versus writes, the polling rhythm, and S7 from a sample capture.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eLearning Objectives:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eObjective: Identify OT asset classes and map them onto a Purdue architecture.\u003c\/li\u003e\n\u003cli\u003eObjective: Decode industrial protocol traffic and build a passive asset inventory.\u003c\/li\u003e\n\u003cli\u003eObjective: Explain how the absence of authentication in legacy protocols enables unauthorized control.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003eDay 1 - Afternoon: Threat Actors and Living off the Land\u003c\/h4\u003e\n\u003cp\u003eCore Topics:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eHow real-world adversaries pivot from IT into OT: case studies of Volt Typhoon, the CyberAv3ngers \/ Unitronics campaign, FrostyGoop, and Industroyer2 \/ PIPEDREAM.\u003c\/li\u003e\n\u003cli\u003eLiving off the Land in OT: abuse of legitimate engineering software and native functionality rather than malware.\u003c\/li\u003e\n\u003cli\u003eAdapt the incident-handling lifecycle for physical processes so attackers understand what defenders will and won't see, and what forces a shutdown.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003ePractical Applications:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eTeams send an unauthenticated Modbus command to their own PLC and watch the process change on the HMI, then find that same command back in the capture. This is FrostyGoop in miniature: the 2024 attack on a Lviv heating utility used exactly this: legitimate Modbus TCP writes, no exploit and no malware on the controllers, leaving 600+ apartment buildings without heat for two days in winter.\u003c\/li\u003e\n\u003cli\u003eExplore what else the protocol allows with no credentials: read and write registers and coils, and reason about the physical effect of each.\u003c\/li\u003e\n\u003cli\u003eTrace a staged intrusion across the plant's own logs and captured traffic to reconstruct the timeline and see what the activity looked like from the inside.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eLearning Objectives:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eObjective: Send industrial protocol commands to a PLC and predict and observe the physical effect.\u003c\/li\u003e\n\u003cli\u003eObjective: Attribute observed techniques to documented OT threat actor behaviors.\u003c\/li\u003e\n\u003cli\u003eObjective: Explain how legitimate functionality, not malware, drives most OT impact.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003eDay 2 - Morning: Going Deeper into the Systems\u003c\/h4\u003e\n\u003cp\u003eCore Topics:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eInside the PLC: logic, I\/O, registers and coils, and what an attacker can reach without special tooling.\u003c\/li\u003e\n\u003cli\u003eThe HMI and engineering workstation as targets and as pivots.\u003c\/li\u003e\n\u003cli\u003eDNP3 and other protocols beyond Modbus: what changes for an attacker and what stays the same.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003ePractical Applications:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eTeams dig into their PLCs ' registers and coils, manipulate setpoints and outputs, and map each change to what the plant does.\u003c\/li\u003e\n\u003cli\u003eUse the HMI's own view to confirm the effect and to understand what an operator would and wouldn't notice.\u003c\/li\u003e\n\u003cli\u003eCompare attacking over Modbus versus DNP3 on the same plant.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eLearning Objectives:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eObjective: Enumerate and manipulate PLC registers and coils and tie each to a physical effect.\u003c\/li\u003e\n\u003cli\u003eObjective: Describe how an attacker uses the HMI and engineering workstation as targets and pivots.\u003c\/li\u003e\n\u003cli\u003eObjective: Generalize protocol attack concepts across Modbus and DNP3.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003eDay 2 - Afternoon: Scored Team Challenge\u003c\/h4\u003e\n\u003cp\u003eCore Topics:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eStealth versus impact: what a careful attacker does differently from a loud one.\u003c\/li\u003e\n\u003cli\u003eWhat the morning's activity left behind in logs and captures.\u003c\/li\u003e\n\u003cli\u003eWhere defenses would have changed the outcome (context, not a defensive lab).\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003ePractical Applications:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eScored team challenge: each team is given objectives on the plant (reach a device, achieve a specific process effect, and do it without tripping the obvious alerts) and works on them on the clock.\u003c\/li\u003e\n\u003cli\u003eDebrief: teams walk through their approach, compare what worked, and see what a defender would have caught.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eLearning Objectives:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eObjective: Chain the course's techniques into a goal-driven attack on a live process.\u003c\/li\u003e\n\u003cli\u003eObjective: Reason about detection and stealth from the attacker's side.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eDifficulty Level\u003c\/h3\u003e\n\u003cp\u003eBeginner - The student has an interest in the topic presented and general technology knowledge that a power user or undergraduate student may have acquired. Intermediate - The student has education and some experience in the field and familiarity with the topic being presented, with foundational knowledge the course will leverage to provide practical skills.\u003c\/p\u003e\n\u003ch3\u003eSuggested Prerequisites\u003c\/h3\u003e\n\u003cp\u003eComfortable on a command line and with basic IP networking (addresses, ports, what a packet capture is). Some Wireshark experience helps. No OT or ICS experience needed.\u003c\/p\u003e\n\u003ch3\u003eWhat Students Should Bring\u003c\/h3\u003e\n\u003cp\u003eA laptop with a wired Ethernet port (a USB Ethernet adapter is fine), local admin rights, and Wireshark installed. A personal or lab machine is strongly recommended, since corporate-managed laptops that block network changes or unsigned tools often cause problems. No internet connection is needed for the labs; everything runs on the provided kit. A short setup sheet will be sent before class.\u003c\/p\u003e\n\u003ch3\u003eWhat the Trainer Will Provide\u003c\/h3\u003e\n\u003cp\u003eICS Village provides the full lab environment on its own hardware kits. Teams of 2 to 4 share a kit for the duration of the class: a complete simulated water-treatment plant with a PLC, Modbus and DNP3 devices, an HMI and a monitored network, along with lab workbooks, a sample traffic pack, and the scored team challenge. No external platform, cloud range, or internet access is required.\u003c\/p\u003e\n\u003ch3\u003eTrainer(s) Bio\u003c\/h3\u003e\n\u003cp\u003eTaught by ICS Village trainers: senior OT and critical-infrastructure security practitioners who build and run the ICS Village hands-on training program and its lab kits. Named instructors and short bios will be confirmed before submission.\u003c\/p\u003e\n\u003ch3\u003eProficiency Exam\u003c\/h3\u003e\n\u003cp\u003eEach lab ends in an automated check on the team's kit that prints a unique flag when the work is correct. Checks cover protocol decoding, passive asset inventory, PLC register and coil manipulation, intrusion timeline reconstruction, and the scored team challenge. Teams that capture 80% or more of the flags receive an ICS Village certificate of proficiency.\u003c\/p\u003e\n\u003chr\u003e\n\u003csection class=\"registration-terms\"\u003e\n\u003ch3\u003eRegistration Terms and Conditions\u003c\/h3\u003e\n\u003cp\u003eTrainings are refundable before January 29, 2027, minus a non-refundable processing fee of $350.\u003c\/p\u003e\n\u003cp\u003eBetween January 30, 2027 and February 28, 2027 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.\u003c\/p\u003e\n\u003cp\u003eAll trainings are non-refundable after Feb 28, 2027.\u003c\/p\u003e\n\u003cp\u003eTraining tickets may be transferred to another student. Please email us at training@defcon.org for specifics.\u003c\/p\u003e\n\u003cp\u003eIf a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).\u003c\/p\u003e\n\u003cp\u003eFailure to attend the training without prior written notification will be considered a no-show. No refund will be given.\u003c\/p\u003e\n\u003cp\u003eDEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.\u003c\/p\u003e\n\u003cp\u003eBy purchasing this ticket you agree to abide by the \u003ca href=\"https:\/\/defcon.org\/html\/links\/dc-code-of-conduct.html\"\u003eDEF CON Training Code of Conduct\u003c\/a\u003e and the registration terms and conditions listed above.\u003c\/p\u003e\n\u003cp\u003eSeveral breaks will be included throughout the day. Please note that food is not included.\u003c\/p\u003e\n\u003cp\u003e\u003cmeta charset=\"utf-8\"\u003eAll courses come with a certificate, contingent on attendance at 75% of course sessions. Students who pass the end-of-course evaluation will be issued a certificate of proficiency. All other students with sufficient course attendance will be issued a certificate of completion. Students are responsible for making sure their attendance is recorded at the start of the day and after returning from lunch.\u003c\/p\u003e\n\u003c\/section\u003e","brand":"Singapore 2027","offers":[{"title":"Default Title","offer_id":63496775499916,"sku":null,"price":3900.0,"currency_code":"SGD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0750\/9042\/8044\/files\/DCT400x400.png?v=1793205353","url":"https:\/\/sg.shop.defcon.org\/products\/ot-101-foundation-ot-security-specialization-track-ics-village-trainers-sg2027","provider":"DEF CON SG","version":"1.0","type":"link"}