ICS/SCADA study plan

Compare signature-based, anomaly-based, and stateful protocol analysis detection methods, listing at least two strengths and two weaknesses for each in the ICS context.

Explain where an IDS or IPS is placed in a Purdue-model ICS network (Level 0–1 field devices, Level 2 supervisory, Level 3 operations, DMZ, Level 4/5 enterprise) and why passive taps are preferred over inline blocking for safety-critical control loops.

Differentiate host-based (HIDS) from network-based (NIDS) intrusion detection and identify which ICS assets (engineering workstations, HMIs, PLCs, RTUs) are best monitored by each.

Describe at least three ICS-specific IDS challenges: deterministic but proprietary protocols (Modbus/TCP, DNP3, IEC 61850), high-volume polling traffic, and the risk of false positives disrupting operations.

Map common ICS attack techniques (reconnaissance, command injection, unauthorized setpoint changes, replay) to the detection signatures or behavioral rules that would surface them.

Diagram the Purdue Enterprise Reference Architecture (PERA) and label the security controls expected at each level, including the IT/OT boundary and the industrial DMZ.

List the unique security constraints of ICS/SCADA (availability-first priority, legacy devices, long patch cycles, safety implications) and contrast them with IT security priorities.

Identify the phases of a targeted ICS attack (pre-compromise, compromise, management and control, impact) and give one example technique per phase.

Explain the purpose and risk of common ICS protocols (Modbus/TCP, DNP3, PROFINET, OPC UA) in terms of authentication, integrity, and exposure.

Describe at least three real-world ICS incident patterns (e.g., Stuxnet-style manipulation, Ukraine grid attacks, ransomware spillover) without relying on vendor-specific details.

Explain the TCP three-way handshake, sequence/acknowledgment numbers, and how a stateful firewall or IDS tracks session state.

Compare TCP and UDP behavior for ICS protocols, noting which common ICS protocols use each and the security implications of connectionless transport.

Describe IP addressing, subnetting, and routing concepts sufficient to segment an ICS network into zones and conduits.

Identify the OSI layers where common ICS attacks occur (e.g., ARP spoofing at Layer 2, Modbus function-code abuse at Layer 7) and the defensive control at each layer.

Interpret a packet capture of a Modbus/TCP or DNP3 session and extract source/destination, function code, and payload meaning.

Define a vulnerability management lifecycle for ICS: asset inventory, vulnerability identification, risk assessment, remediation/patch, and verification.

Explain why traditional IT scanning tools can disrupt ICS devices and describe compensating controls (passive scanning, scheduled windows, vendor-approved tools).

Prioritize vulnerabilities using ICS-specific factors: exploitability, exposure, safety impact, and compensating controls, rather than CVSS alone.

Describe how to obtain and apply vendor security advisories (e.g., ICS-CERT/CSAF) and the constraints of patching legacy PLCs and RTUs.

Draft a patch-testing and rollback plan for a simulated SCADA environment.

Summarize the purpose and key requirements of NIST SP 800-82 (Guide to ICS Security) and how it differs from NIST SP 800-53 for IT.

Explain the IEC 62443 series structure (general, policies, system, component) and the concept of Security Levels (SL 1–4) and zones/conduits.

Identify the role of NERC CIP standards for bulk electric systems and list at least three CIP requirements relevant to network defense.

Describe how ISO/IEC 27001 and 27019 apply to ICS environments and where they overlap with IEC 62443.

Map a given ICS security control (e.g., network segmentation) to the relevant clauses in NIST 800-82 and IEC 62443.

Design a segmented ICS network using zones and conduits, including an industrial DMZ, firewall rules, and one-way data diodes where appropriate.

Configure and justify access control for remote maintenance (jump hosts, MFA, session recording) and disable unnecessary services on ICS devices.

Apply the principle of least privilege to ICS accounts and describe how to manage shared or hard-coded credentials on legacy devices.

Explain how to securely baseline and harden an HMI, engineering workstation, and PLC using vendor guidance and CIS benchmarks where available.

Describe logging and monitoring requirements for ICS devices and how to forward logs to a SIEM without disrupting control traffic.

Explain the concept of the air gap and why true air gaps are rare in modern ICS due to remote support, wireless, and supply-chain connections.

Describe technologies that bridge the air gap securely: data diodes, cross-domain solutions, and application-layer gateways, including their limitations.

Identify risks introduced by removable media and describe a media control policy (scanning kiosks, allowlisting, chain of custody).

Evaluate the security trade-offs of remote access methods (VPN, VDI, direct modem) and recommend a defensible approach for a given scenario.

Describe how to monitor and audit cross-domain traffic for anomalies.

Integrate IDS/IPS placement and tuning into the segmented network design from Week 6, specifying sensor locations and rule sets.

Design an incident response playbook for an ICS IDS alert, covering triage, containment without disrupting operations, and coordination with operations and safety teams.

Review and consolidate all prior deliverables into a cohesive ICS network defense portfolio.

Complete a timed 60-question practice exam covering all eight domains and score at least 80%.

Identify the three weakest domains from the practice exam and write a targeted remediation plan for each.