OT / ICS Security

ACTION REQUIRED (Execute Immediately After Reading)

1. NOW

   : Read

   ../field-journal/precedent-pentest.md

   — Misoperations in industrial control environments can cause physical harm

2. NOW

   : Written authorization must clearly specify: site, network segment, whether active scanning/writing to registers is permitted

3. NOW

   : case-init; default to passive-first; writing operations to PLCs are prohibited before

   ready_for_act

4. NEXT

   : tool-index; most industrial control tools require manual setup and isolation from the test network

5. ACT

   : Asset and zone identification → Exposure surface → Read-only verification

Applicable Scenarios

• Authorized industrial control/SCADA/DCS security assessments
• Purdue model zoning and cross-zone channels
• Exposure of protocols such as Modbus/DNP3/S7/EtherNet/IP
• Engineer workstations, HMIs, historical databases, jump hosts
• IT/OT convergence boundaries (firewall rules, one-way gateways)

Non-Negotiable Security Rules (MUST)

MUST NOT perform the following without explicit permission:
- Write coils/registers to PLCs
- High-rate scanning of the entire production OT network
- Interrupt paths related to Safety Instrumented Systems (SIS)
Prioritize: read-only identification, traffic mirroring, offline firmware/configuration analysis

Workflow

Phase 1 — Zoning and Assets

□ Sketch of Purdue L0–L5: Field devices → Control → Supervision → Site DMZ → Enterprise
□ Asset inventory: PLC/RTU/HMI/Engineer workstations/Historical databases/Jump hosts
□ Protocol and port baseline (authorized network segments only)

Phase 2 — Passive and Read-only

□ SPAN/mirrored PCAP → protocol-reverse / Wireshark industrial control dissectors
□ Offline audit of configuration and engineering files (e.g., exports from TIA/RSLogix)
□ Record default passwords and plaintext protocols (e.g., unauthenticated Modbus) as Findings; do not write or modify values

Phase 3 — Restricted Active (Authorized Only)

□ Low-speed identification, maintenance window only
□ Prioritize read-only function codes
□ Document evidence for each step; stop immediately and report any anomalies

Phase 4 — Firmware/Patch Surface

□ Controller firmware version → CVE mapping (do not blindly flash firmware)
□ Conduct offline image analysis in conjunction with firmware-pentest

Toolchain

References

• references/ot-safe-assessment.md

• ../firmware-pentest/

  ../protocol-reverse/

  ../network

  via pentest-tools

Routing Context

firmware-pentest

protocol-reverse

windows-ad

attack-chain

Task Completion Self-Check

• Is passive/read-only mode enabled by default and authorization boundaries documented?
• Are write operations to control loops avoided (unless explicitly permitted)?
• Do Findings include descriptions of physical/process impacts?
• Have the checklist and journal been completed?