<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-ics-security-training
description: >-
  Design and deliver role-based cybersecurity training programs for ICS/SCADA
  personnel including operators, engineers, and management using OT-specific
  scenarios, tabletop exercises, and hands-on lab environments.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - training
  - ics
  - scada
  - awareness
  - tabletop-exercise
  - ot-security
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0866", "T0862"]
  nist-csf: ["PR.AT-1", "PR.AT-2"]
  iec-62443: ["SR 1.1", "SR 2.1"]
  uuid: a1b2c3d4-1001-4000-a001-000000000009
---

# Implementing ICS Security Training

## Overview

ICS security training must address OT-specific threats, protocols, and operational
constraints. Operators need to recognize social engineering targeting control rooms,
engineers need secure PLC coding practices, and management needs to understand
OT cyber incident business impact. Tabletop exercises simulate real ICS scenarios.

Mode: `[MODE: ARCHITECT]` for program design; `[MODE: BLUE]` for exercises.

## Prerequisites

| Requirement | Details |
|---|---|
| ICS asset inventory and network architecture documentation | Required |
| Role matrix for OT personnel (operator, engineer, admin, management) | Required |
| Training lab environment with representative ICS hardware/software | Required |
| Incident response plan for OT environment | Required |
| Previous incident or audit findings for scenario development | Required |
| Learning management system (LMS) for tracking completion | Required |

## Key Concepts

### Role-Based Training Matrix

```yaml
roles:
  ics_operator: {frequency: quarterly, modules: [Social engineering, Abnormal HMI, Incident reporting, USB policy]}
  ics_engineer: {frequency: quarterly, modules: [Secure PLC coding, Change mgmt, OT network security]}
  management: {frequency: semi-annually, modules: [Threat landscape, Business impact, Regulatory compliance]}
```

### Tabletop Exercise Scenarios

```yaml
ransomware_scenario:
  - {time: "T+0", inject: "SOC alerts on SMB traffic to OT DMZ"}
  - {time: "T+15min", inject: "HMI screens frozen with ransom note"}
  - {time: "T+30min", inject: "Historian unreachable"}
  - {time: "T+1hr", inject: "Second HMI compromised"}

insider_scenario:
  - {time: "T+0", inject: "PLC checksum mismatch on SIS controller"}
  - {time: "T+15min", inject: "No change ticket — last mod from EWS-02 at 2AM"}
  - {time: "T+30min", inject: "Modified logic disables pressure trip"}
```

### Hands-On Lab

```bash
docker-compose -f grfics-lab.yml up -d  # Deploy ICS lab

# Exercise: Identify unauthorized Modbus writes
tshark -r exercise.pcap -Y "modbus.func_code >= 5" \
  -T fields -e ip.src -e modbus.func_code | sort | uniq -c

# Exercise: Detect PLC change via checksum
python3 -c "
import hashlib
baseline='abc123...'
current=hashlib.sha256(open('plc.bin','rb').read()).hexdigest()
print('MATCH' if current==baseline else 'MISMATCH')"
```

## Workflow

### Step 1: Scope and Discovery

```bash
python3 implementing_ics_security_training_scope.py --inventory ics_assets.json --output scope.yaml
```

### Step 2: Execute Assessment

```bash
python3 implementing_ics_security_training_execute.py --scope scope.yaml --output results/
```

### Step 3: Analyze and Report

```bash
python3 implementing_ics_security_training_report.py --results results/ --output report.json
```

## Verification

- [ ] Role-based matrix defined
- [ ] OT-specific modules developed
- [ ] Tabletop scenarios created
- [ ] Hands-on lab available
- [ ] Completion tracked
- [ ] After-action reports documented
- [ ] Annual program review
- [ ] Management participates

## Detection Opportunities

- Phishing click rates → awareness gaps
- Simulated incident detection time → readiness
- Completion below threshold → compliance risk
- Repeat findings → unresolved weaknesses

```yaml
title: Ics Security Training Detection
id: 57f7dd53-7a60-4acd-8a83-d8c9cb2925bd
status: experimental
description: Detects suspicious activity related to implementing ics security training techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*ics*"
  condition: selection
level: medium
tags:
  - attack.t0866
  - attack.t0862
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- NIST SP 800-82 Rev 3 — Section 6.1
- IEC 62443-2-1: Training and Awareness
- SANS ICS Security Training
- NERC CIP-004: Personnel and Training
