<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: ot-ics-security
description: >-
  Operational Technology and Industrial Control System security including SCADA/PLC/HMI
  assessment, Modbus/DNP3/OPC-UA protocol analysis, ICS network segmentation (Purdue Model),
  safety system attacks (SIS/ESD), firmware analysis, ICS-specific malware (TRITON/Industroyer/
  Stuxnet), OT asset discovery, and IEC 62443 compliance. Covers both offensive ICS
  penetration testing and defensive OT network monitoring.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - ics
  - scada
  - ot-security
  - plc
  - modbus
  - dnp3
  - opc-ua
  - purdue-model
  - iec-62443
  - triton
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0800", "T0801", "T0803", "T0831", "T0836", "T0855", "T0862"]
  nist-csf: ["ID.AM-1", "PR.AC-5", "DE.CM-1", "DE.CM-7"]
  frameworks: ["IEC 62443", "NIST SP 800-82", "Purdue Model", "MITRE ATT&CK for ICS"]
---

# OT/ICS Security

## When to Use

Activate when the operator asks about SCADA, PLC, HMI, DCS, ICS penetration testing,
OT network segmentation, industrial protocols (Modbus, DNP3, OPC-UA, EtherNet/IP),
safety instrumented systems, ICS malware analysis, or IEC 62443 compliance.

Mode: `[MODE: RED]` for ICS pen testing; `[MODE: BLUE]` for OT monitoring; `[MODE: ARCHITECT]` for Purdue Model design.

## Prerequisites

- Understanding of Purdue Model (Levels 0-5) and IT/OT convergence
- ICS protocol knowledge (Modbus TCP/RTU, DNP3, OPC-UA, EtherNet/IP)
- Isolated lab environment for active testing (NEVER test production ICS without explicit authorization)
- Familiarity with IEC 62443 security levels

## Quick Reference

| Action | Command / Tool | Context |
|--------|---------------|---------|
| Modbus read coils | `modbus-cli read 10.0.0.1 0 10 --slave 1` | Recon |
| Modbus write register | `modbus-cli write 10.0.0.1 40001 0xFF --slave 1` | ⚠️ Offensive |
| OPC-UA browse | `opcua-client opc.tcp://10.0.0.1:4840 --browse` | Recon |
| DNP3 scan | `nmap --script dnp3-info -p 20000 10.0.0.0/24` | Recon |
| ICS asset discovery | `nmap -sV -p 102,502,20000,44818,4840,47808 10.0.0.0/24` | Recon |
| PLC firmware dump | `plcscan.py -t 10.0.0.1` | Offensive |
| Wireshark ICS filter | `modbus \|\| dnp3 \|\| opcua \|\| s7comm \|\| enip` | Analysis |
| Snort ICS rule | `alert tcp any any -> $ICS_NET 502 (msg:"Modbus Write"; content:"\|06\|"; ...)` | Defensive |
| Zeek ICS monitor | `zeek -r capture.pcap modbus.zeek dnp3.zeek` | Defensive |

## Workflow

### 1. OT Asset Discovery

```bash
# Passive discovery (safe for production)
# Capture traffic on OT network mirror port
tcpdump -i eth0 -w ot_capture.pcap -c 100000
zeek -r ot_capture.pcap local modbus.zeek dnp3.zeek

# Parse Zeek logs for ICS devices
cat modbus.log | zeek-cut ts id.orig_h id.resp_h func unit_id | sort -u
cat dnp3.log | zeek-cut ts id.orig_h id.resp_h fc | sort -u

# Active scanning (LAB ONLY — can crash PLCs)
nmap -sV -p 102,502,20000,44818,4840,47808,1911,2222 10.0.0.0/24
# Port reference:
# 102   = S7comm (Siemens)
# 502   = Modbus TCP
# 20000 = DNP3
# 44818 = EtherNet/IP (CIP)
# 4840  = OPC-UA
# 47808 = BACnet
# 1911  = Niagara Fox
# 2222  = EtherNet/IP (explicit)
```

### 2. Purdue Model Assessment

```
Level 5: Enterprise Network (IT)          ← Standard IT security
Level 4: Business Planning (IT/OT DMZ)    ← Firewall + data diode
Level 3: Site Operations (Historians, MES) ← OT network monitoring
Level 2: Area Supervisory (HMI, SCADA)    ← Controlled access
Level 1: Basic Control (PLC, RTU, DCS)    ← Air-gapped ideal
Level 0: Physical Process (sensors, actuators) ← Safety-critical

Assessment checklist:
├── Level 3.5 DMZ exists between IT and OT?
├── Data flows only downward (or via data diode)?
├── OT network segmented from corporate IT?
├── Historian access from IT goes through jump host?
├── Remote access via VPN with MFA to jump server?
├── No direct internet access from Levels 0-3?
├── USB ports disabled on HMI/Engineering workstations?
└── Antivirus/allowlisting on Windows-based HMI/SCADA?
```

### 3. Protocol-Specific Attacks

See `references/ics-protocols.md` for protocol deep dives.

**Modbus TCP (no authentication by design):**
```python
# Read holding registers
from pymodbus.client import ModbusTcpClient
client = ModbusTcpClient('10.0.0.1', port=502)
client.connect()
result = client.read_holding_registers(0, 10, slave=1)
print(result.registers)

# ⚠️ Write single register (DANGEROUS — can affect physical process)
# client.write_register(40001, 0, slave=1)  # Set output to 0
```

### 4. ICS Malware Analysis

Known ICS malware families and TTPs:
- **Stuxnet** (2010): USB propagation → Siemens Step 7 → PLC rootkit → centrifuge destruction
- **Industroyer/CrashOverride** (2016): IEC 104/61850/OPC-DA → breaker manipulation → power grid
- **TRITON/TRISIS** (2017): Targeted Schneider Triconex SIS → safety system manipulation
- **Pipedream/INCONTROLLER** (2022): Multi-vendor (Omron, Schneider) → OPC-UA/Modbus/CODESYS
- **FrostyGoop** (2024): Modbus TCP → heating system manipulation

### 5. IEC 62443 Compliance

See `references/iec-62443-mapping.md` for full control mapping.

```
Security Levels (SL):
SL 1: Protection against casual/unintentional violation
SL 2: Protection against intentional violation with simple means
SL 3: Protection against sophisticated attack with moderate resources
SL 4: Protection against state-sponsored attack with extended resources

Key requirements:
├── FR 1: Identification and Authentication Control
├── FR 2: Use Control (authorization, least privilege)
├── FR 3: System Integrity (malware protection, change detection)
├── FR 4: Data Confidentiality (encryption in transit/at rest)
├── FR 5: Restricted Data Flow (network segmentation)
├── FR 6: Timely Response to Events (monitoring, logging)
└── FR 7: Resource Availability (redundancy, DoS protection)
```

## Verification

- [ ] OT asset inventory complete (all PLCs, HMIs, historians identified)
- [ ] Purdue Model segmentation validated (no IT-to-Level-1 direct paths)
- [ ] ICS protocols tested for authentication/authorization
- [ ] Safety Instrumented Systems (SIS) isolated from control network
- [ ] IEC 62443 security level assessment completed
- [ ] Backup/restore procedures tested for PLCs and SCADA servers
- [ ] ICS-specific detection rules deployed (Zeek/Snort/Suricata)

## Detection Opportunities

- Zeek/Suricata ICS protocol parsers detect unauthorized Modbus writes, DNP3 commands
- Anomaly detection on process variable baselines (unexpected register value changes)
- Network monitoring for IT→OT traversal (new connections crossing DMZ)
- USB device insertion alerts on engineering workstations
- Firmware integrity monitoring for PLCs (checksum comparison)
