Advanced CIP Security Training

Online, Available in English

Prerequisites:

Completion of Basic CIP Security training or equivalent hands-on OT/ICS experience. Familiarity with Linux CLI, networking concepts, and prior Wireshark use expected.
 

Target Audience:

OT/ICS security engineers, penetration testers, incident responders, and security architects with existing exposure to ICS/OT environments.

Learning Outcomes

Upon completing this 2-day training, participants will be able to:

• Apply MITRE ATT&CK for ICS to analyze advanced adversary TTPs including the ICS Kill Chain and lateral movement techniques
• Conduct active OT network reconnaissance using nmap and Metasploit ICS modules in a controlled lab environment
• Exploit and analyze Modbus protocol vulnerabilities using Lab Shock; understand the defensive implications
• Design and implement advanced OT network segmentation using pfSense with a multi-zone DMZ and Snort-based IDS rules
• Perform digital forensics on ICS environments including PLC ladder logic analysis and network artifact examination
• Lead or contribute to an ICS-specific incident response process aligned to operational continuity requirements
• Align an OT security program to IEC 62443 security levels and NIST CSF maturity tiers
• Complete a multi-stage CTF challenge integrating offensive reconnaissance, protocol exploitation, forensics, and defensive remediation

Lab Summary:

All labs are delivered via Skillable hosted virtual machines (1–2 VMs per participant). No local installation required. Labs 1 and 2 use existing OPSWAT Academy lab assets. Labs 3, 4a, and 4b are new builds.

• Lab 1: Lab Shock Advanced — Modbus Protocol Manipulation - Force-write PLC coils and holding registers; replay and modify Modbus commands using Lab Shock
• Lab 2: nmap + Metasploit ICS Target Exploitation - Enumerate OT services with nmap; execute Metasploit ICS modules against simulated PLC target
• Lab 3: Advanced pfSense — Multi-Zone ICS + Snort IDS - Build IT/OT DMZ with pfSense; configure Snort rules to detect Modbus function code anomalies
• Lab 4: Advanced CIP CTF — Stage 1: Recon & Exploitation - OT network enumeration, service identification, and Modbus exploitation using skills from Labs 1 and 2
• Lab 5: Advanced CIP CTF — Stage 2: Forensics & Remediation -Trace kill chain from captured artifacts; remediate environment using pfSense rules. Scored challenge.

Outline:

M1: Advanced Threat Landscape & ICS Attack Techniques Deep-dive into ICS attack stages; adversary TTPs beyond the basics

• L1 – MITRE ATT&CK for ICS Deep Dive Reconnaissance through Impact; technique analysis with real case examples
• L2 – ICS Kill Chain & Lateral Movement How attackers move from IT to OT; living-off-the-land in ICS networks
• L3 – Advanced Case Studies

M2: Active Reconnaissance & OT Exploitation Using offensive tools responsibly in a controlled lab environment to understand the attacker perspective

• L1 – Lab 1: Lab Shock Advanced — Modbus Protocol Manipulation Force-write PLC coils and registers; replay and modify Modbus commands using Lab Shock
• L2 – Lab 2: nmap + Metasploit Against ICS Target Enumerate OT network services with nmap; run Metasploit ICS modules against simulated PLC
• L3 – Debrief: Defender Perspective What these attacks look like on the wire; detection opportunities at each stage

M3: Protocol Exploitation & Defense Modbus and DNP3 weaknesses; securing legacy protocols in modern OT architectures

• L1 – Protocol Weakness Deep Dive Modbus coil/register abuse, DNP3 spoofing, PROFINET vulnerabilities
• L2 – Securing OT Protocols Encryption wrappers, authentication overlays, allowlisting by function code
• L3 – Group Exercise Map a protocol attack to a MITRE ATT&CK ICS technique; recommend countermeasure

M4: Advanced Threat Detection & IDS for OT Deploying detection capabilities without disrupting operations

• L1 – OT-Aware IDS Concepts Anomaly vs. signature detection; Snort rules for ICS protocols
• L2 – Building Detection Use Cases Baselined behavior vs. deviation; writing rules to detect Modbus anomalies

M5: Advanced Secure OT Architecture Defense-in-depth design; advanced firewall rules, zone enforcement, and IDS integration

• L1 – Defense-in-Depth for ICS Zones and conduits (IEC 62443), DMZ design, data diodes, unidirectional gateways
• L2 – Lab 3: Advanced pfSense — Multi-Zone ICS + Snort IDS Build IT/OT DMZ with pfSense; configure Snort rules to detect Modbus function code anomalies
• L3 – Air Gaps & Compensating Controls When and why; practical alternatives for always-connected environments

M6: Incident Response & Forensics in OT Environments Responding to an OT incident while maintaining operational continuity

• L1 – OT IR Lifecycle Preparation, detection, containment, eradication, recovery — OT-adapted
• L2 – Digital Forensics in ICS PLC ladder logic forensics, HMI log analysis, network forensics artifacts
• L3 – Tabletop: Major ICS Incident Simulate a multi-vector attack on energy sector ICS; coordinate response decisions under pressure

M7: Security Program Development for CIP Organizations Building a sustainable ICS security practice aligned to standards

• L1 – Aligning to IEC 62443 & NIST CSF Maturity levels, security levels, practical gap assessment
• L2 – Asset Inventory & Patch Management in OT Why OT patching is uniquely hard; risk-based patch prioritization
• L3 – Metrics & Reporting for OT Security What matters to leadership; building a security KPI dashboard for OT

M8: Capstone — Advanced CIP CTF Challenge Multi-stage scored scenario integrating all skills from both days

• Stage 1 – Network Reconnaissance & Exploitation Enumerate OT network, identify vulnerable services, exploit Modbus target using tools from Labs 1 and 2
• Stage 2 – Forensics & Remediation Analyze attack artifacts, trace the kill chain, remediate using pfSense rules configured in Lab 3. Scored challenge.