Basic CIP Security Training

Online, Available in English

Prerequisites:

No OT/ICS security background required. General IT familiarity helpful.
 

Target Audience:

IT security professionals new to OT/ICS; SOC analysts and IT administrators supporting OT environments; compliance and risk managers; network engineers at CIP organizations.

Learning Outcomes:

• Describe the structure of CIP environments including ICS architecture layers and the Purdue Model
• Identify and explain common OT protocols (Modbus, DNP3, EtherNet/IP) and how they differ from IT protocols
• Use Wireshark to capture and analyze Modbus traffic, recognize anomalies, and identify simulated attack patterns
• Apply OSINT techniques using tools such as Shodan and Censys to identify exposed OT/ICS assets
• Conduct a basic risk assessment for an ICS environment using IEC 62443, NIST CSF, and NCA OTCC-1:2022
• Apply MITRE ATT&CK for ICS to map real-world attack case studies to tactics and techniques
• Configure pfSense firewall rules to segment OT/IT zones and control industrial protocol traffic
• Complete a multi-stage investigative CTF scenario covering email forensics, log analysis, OSINT, DNP3 protocol analysis, and SCADA grid restoration

Lab Summary:

All labs are delivered via Skillable hosted virtual machines (1–2 VMs per participant). No local installation required. Labs 1 and 2 use existing OPSWAT Academy lab assets. Labs 3, 4a, and 4b are new builds (Operation Blackout CTF).

• Lab 1 Wireshark Modbus Traffic Analysis: Capture and analyze Modbus TCP traffic; identify a simulated PLC attack in packet data
• Lab 2 Lab Shock — Network Discovery & Modbus Manipulation: Use Lab Shock toolset to discover ICS devices and manipulate PLC Modbus registers
• Lab 3 pfSense Firewall Rules for OT Zone Segmentation: Configure pfSense to create IT/OT zone separation; write allow/deny rules for Modbus and ICMP
• Lab 4 Operation Blackout CTF — Stage 1: The Phishing Trail: Email forensics, malware triage (strings, pestudio), SIEM log analysis, OSINT — trace attack from phishing email to SCADA access
• Lab 5 Operation Blackout CTF — Stage 2: The Blackout Explained: DNP3 PCAP analysis, SCADA grid restoration in correct sequence, OT network hardening tasks

Outline:

M1: Foundations of CIP & ICS/OT

• L1 – What is Critical Infrastructure?
• L2 – ICS Architecture & the Purdue Model
• L3 – IT vs. OT vs. ICS
• L4 – IT/OT Convergence Risks

M2: OT/ICS Protocols & Network Fundamentals

• L1 – Common OT Protocols
• L2 – Intro to Wireshark for OT
• L3 – Lab 1: Wireshark Modbus Analysis

M3: OSINT & Threat Landscape for CIP

• L1 – OSINT Tools for OT
• L2 – Real-World ICS Attacks

M4: Risk Management & Attack Surface Basics

• L1 – Identifying Your Attack Surface
• L2 – Risk Assessment Framework
• L3 – Standards Overview

M5: Network Monitoring & Anomaly Detection

• L1 – Network Visibility in OT Environments
• L2 – Lab 2: Lab Shock — Network Discovery & Modbus Manipulation
• L3 – Interpreting Results

M6: Defensible OT Architecture

• L1 – Network Segmentation & Zones/Conduits
• L2 – Firewall Basics for OT
• L3 – Lab 3: pfSense Firewall Rules for OT Zone Segmentation

M7: Incident Response Fundamentals for ICS

• L1 – MITRE ATT&CK for ICS
• L2 – OT Incident Response Process
• L3 – Tabletop Scenario

M8: Capstone — Operation

• Blackout CTF Lab
• Stage 1 – The Phishing Trail (Lab 4a)