Ottawa ICS612 | January 2026

This section aligns students to the baseline fundamentals of industrial control systems, focusing on local process control components, such as Programmable Logic Controllers (PLCs) and Human Machine Interfaces (HMIs).

Topics covered

• Purdue model and ICS architecture
• Communication flow mapping
• Level 0-2 components
• Protocol analysis of operations data
• Embedded device security essentials

Labs

• PLC and HMI platform setup
• PLC programming and troubleshooting
• Service discovery on controllers
• OT protocol analysis with Wireshark
• PLC/HMI communication analysis

Overview

Learning Objective - Review of Lab Setup

• Students will become familiar with the Programmable Logic Controller (PLC), I/O, and software used in the lab.
• Goal: Students will learn and review ICS nomenclature and terminology and set up their lab station.

Learning Objective - Introduction to the PLC Platform Application Tools

• Use ICS software to download and operate an existing PLC project.
• Walk through the basic PLC programming terminology.
• Download a new firmware file and download and run an existing project file.
• Interact with the PLC and demonstrate an error in the program.
• Goal: Students will understand the tools required to have a functional PLC. They will begin to understand the operational relationships between ICS hardware and software.

Learning Objective - Introduction to Programming a PLC

• Carried over from the previous lab, troubleshoot and fix the programming error.
• Apply the fix and verify correctness.
• Observe lack of required authentication, or use of weak credentials in ICS.
• Goal: Students will understand what is required to modify the logic in a PLC. They will begin to learn some of the attack surface of the PLC.

Learning Objective - Service Discovery on PLC

• Using NMAP, discover the services available on the PLC.
• Where possible, interact with those identified services.
• Determine the purpose and use of each available service.
• Goal: Students will understand what services are available, the purposes they serve, and their criticality. They will expand their knowledge of the attack surface of the PLC.

Learning Objective - Introduction to the HMI Platform Application Tools

• Use the ICS software to download and operate an existing HMI project.
• Walk through the basic HMI programming terminology through an existing project.
• Interact with the HMI and correlate the HMI configuration (objects/tags) with the PLC program.
• Goal: Students will understand how a basic HMI operates. They will also learn the data relationships between PLC and HMI used in later labs.

Learning Objective - Understand HMI to PLC Communication

• Using Wireshark, capture and dissect the ICS communication between the HMI and PLC.
• Correlate the traffic with how the configuration of these devices transfer data over Ethernet.
• Build foundational knowledge needed to build a network-level attack against the system.
• Goal: Students will learn how data flows between PLC and HMI on the network. They will also begin to understand the weakness within ICS protocols.

Full Topic Details

• Process familiarization using the Purdue model
• Communication flow mapping referencing the Zones and conduit approach
• Components of Level 0-2
• Local I/O and local HMI communications
• Understand operational functions
• Understand inherent process weaknesses
• Protocol dissection of operational data
• Embedded device essentials
• Operator Interface (I/O) subsystems and communications
• Safety systems
• Process time

This section explores how multiple control systems interact in a larger industrial environment and the security implications. Students will understand peer-to-peer communications in ICS, Supervisory Control and Data Acquisition (SCADA) systems, and Open Platform Communications (OPC).

Topics covered

• Level 3 system components
• PLC peer-to-peer communications
• SCADA/OPC communications
• IT service dependencies in OT
• Defense techniques for Level 3

Labs

• Zone/Cell/Area network connections
• SCADA system configuration
• OPC security configuration
• Securing traditional IT services
• Defending against Level 3 attacks

Overview

Learning Objective - Introduction to Peer-to-Peer Communications

• Set up a Zone/Cell/Area to the larger Level 3 classroom "Production System" ICS network
• Connect to a central L3 router, monitor its system, and establish peer-to-peer system communications.
• Detect additional PLC attacks from the Level 3 system and configure defenses to thwart the attack.
• Goal: This lab will help students recognize the relationships between Zones/Cells/Areas. Just like in the real world, students will communicate with owners of adjacent systems to map out baseline communications within an ICS.

Learning Objective - Introduction to SCADA Systems

• Identify components of a SCADA system and the components of the classroom "Production System" setup.
• Walk through the common use cases and weaknesses and defenses of traditional IT network services, including Active Directory, DNS, DHCP, NTP, SMB, etc.
• Goal: Students will learn the components and communications of a SCADA system. They will also learn the overlap and use of traditional IT technologies within ICS.

Learning Objective - OPC Communications

• Configure, or validate, the connectivity between the OPC server and their local PLC.
• Create an OPC client connection from its local station to the OPC server at the front of the room.
• Observe an OPC exploit against the system and navigate and configure the local Operating System security configurations to mitigate exploit.
• Goal: Students will learn the common OS components, weaknesses of OPC communications, and possible defenses.

Full Topic Details

• Learn components of Level 3
• Learn peer-to-peer communications between PLCs
• Learn SCADA/OPC communications
• Learn the use and dependencies of traditional IT services (DNS, AD, DHCP, NTP, etc.)
• Vendor security models and industrial DMZs
• Learn attack vectors and defense techniques from Level 3

This section focuses on designing and implementing secure network architecture for industrial control systems. Students will understand and practice the deployment of common IT network technology in ICS.

Topics covered

• Connected process security
• Secure plant design principles
• Industrial network segmentation
• Trusted communications flows
• Remote access and historian security

Labs

• Network segmentation implementation
• Firewall configuration for ICS
• Data diode implementation
• Historian system hardening
• Jump host and 2FA implementation

Overview

Learning Objective - Network Architecture and Technology in ICS

• Learn the weaknesses and defense options (i.e., segmentation) for a flat ICS network.
• Identify service and communication requirements between Level 2 and 3 and build appropriate segmentation/defenses.
• Invoke an attack on the system and configure and compare the differences between stateful and stateless ACLs.
• Goal: Students will learn how common IT network technology is deployed in the environment, its common weaknesses, and defense strategies. Student will learn some basic (yet highly overlooked) firewall settings to build a defensive perimeter.

Learning Objective - ICS Firewalls

• Implement in-line firewall.
• Implement data diode.
• Management network (iLo, Remote Management, Lantronix).

Learning Objective - ICS Perimeter

• Learn methods to map ICS data flows and communication paths.
• Identify and architect networks that support ICS business requirements.
• Learn methods to restrict/reduce ICS network access to support minimal operations.
• Learn common use cases; Historian, Remote Access, and Telemetry.

Learning Objective - Historians

• Identify the business requirements for Historian systems.
• Observe Historian system compromise and modify the architecture and configuration to defend.
• Goal: Students will learn the components of a Historian system. They will learn how to securely architect, configure, and operate a Historian system into an ICS environment.

Learning Objective - Remote Access and Jump Host/2FA

• Identify the business requirements for remote access.
• Observe remote access compromise and modify system architecture, configure a jump host sever, and implement 2FA access to mitigate.
• Goal: Students will learn how to securely architect, configure, and operate a jump host providing access into an ICS environment.

Full Topic Details

• Understand connected process
• Analyze case studies in ICS environments and secure plant design
• Identify typical trusted communications flows (Time, File sharing, Remote Access, Historians, AD replication, Reverse Web Proxies, Patch servers)

This section addresses the ongoing management and monitoring of industrial control systems to maintain security. Students will understand and practice ICS system monitoring and logging, asset management, and asset validation.

Topics covered

• ICS environment logging strategies
• Monitoring and alerting best practices
• Serial network security monitoring
• System integrity verification
• Asset management for OT systems

Labs

• Log aggregation configuration
• Event monitoring tuning
• Asset management implementation
• System integrity verification
• Change management procedures

Overview

Learning Objective - ICS System Monitoring and Logging

• Establish logging and alerting of local process assets into the environment log aggregator.
• Goal: Students will ensure logged events are tuned for "events of interest" and implement industry-leading tools to view and detect abnormal behavior.

Learning Objective - ICS Asset Management

• Evaluate patching and change management strategies and solutions to ensure asset management and system integrity visibility.
• Goal: Students will learn how to manage a complex set of ICS assets and develop the capability to detect and respond to security events occurring at the control system level.

Learning Objective - ICS Asset Validation

• Evaluate approaches to ensure or restore the integrity of a system to a known good state.
• Goal: Students will evaluate the pre-work necessary for an organization to have the ability to return a compromised system to a reliable operating state.

Full Topic Details

• Logging and traffic collection in an ICS environment
• Monitoring and alerting in ICS networks
• Monitoring and alerting in a serial network
• System integrity verification

This final section tests students' skills through a NetWars-style comprehensive incident response scenario in the classroom ICS environment.

Topics covered

• OT environment attack patterns
• Protocol-level manipulation techniques
• Firmware security considerations
• Industrial wireless security
• Time synchronization security

Labs

• ICS NetWars-style challenge
• Four levels of questions
• Local process and share process
• Head end process environment
• Environment manipulation

Overview

Learning Objective - Hands on environment troubleshooting

Attack/Defend - ICS NetWars Style Challenge

• Level 1: questions on local process
• Level 2: questions on shared process
• Level 3: questions on the head end process environment
• Level 4: questions on environment manipulation

Full Topic Details

• Pivoting and positioning in an ICS target environment
• Operational traffic reverse engineering
• Protocol-level manipulation
• Firmware manipulation
• Industrial wireless discovery and attack
• Time synchronization manipulation
• Data table and scaling modifications

The capstone is a full day of challenging hands-on work applying the principles taught throughout the course. Your team will progress through multiple levels and missions designed to ensure the presence of detection and defensive capabilities.

Full Topic Details

• Applying Previously Covered Security Controls In-depth
• Applying and fine-tuning detection capabilities and using automation to reduce false/positive ratio
• Configuration management tools
• Infrastructure as code templates
• Tines playbook development
• AWS Configuration rules & ARM templates