Skip to content

awesome-ics-ot-security-learning-resources.md

Latest commit

 

History

History
111 lines (98 loc) · 8.29 KB

awesome-ics-ot-security-learning-resources.md

File metadata and controls

111 lines (98 loc) · 8.29 KB
Raw

Awesome ICS / OT Security Learning Resources

ICS (Industrial Control Systems) and OT (Operational Technology) security covers SCADA, PLCs, HMIs, DCS, historians, safety systems, and the protocols that bind them (Modbus, DNP3, IEC 61850, OPC UA, Profinet, S7). These environments prioritise safety and availability over confidentiality, which inverts many IT security assumptions.

ToC

  1. Books
  2. Videos
  3. Free/Paid Courses
  4. Free/Paid Labs
  5. ICS / OT Tools
  6. Certifications
  7. Blogs/Articles

Books

  1. Industrial Network Security, 2nd Ed by Eric Knapp, Joel Langill (Syngress)
  2. Countdown to Zero Day by Kim Zetter - Stuxnet story; required reading.
  3. Hacking Exposed: Industrial Control Systems by Clint Bodungen, Bryan Singer et al.
  4. Pentesting Industrial Control Systems by Paul Smith (Packt)
  5. Practical Industrial Cybersecurity by Charles J. Brooks, Philip A. Craig Jr.
  6. NIST SP 800-82 Rev 3 - Guide to OT Security (free)
  7. ICS Cybersecurity Field Manual Vol 1-3 by Pascal Ackerman (free from Dragos)
  8. Cybersecurity for Industrial Automation by Pascal Ackerman (Packt)

Videos

  1. S4 Conference talks
  2. Dragos webinars and year-in-review
  3. SANS ICS Summit archives
  4. DEF CON ICS Village
  5. Claroty research talks
  6. Langner Communications (Ralph Langner - Stuxnet)
  7. Robert M. Lee talks on ICS adversaries

Free/Paid Courses

Free

  1. CISA ICS Training (free, ICS-CERT Virtual Learning Portal)
  2. Dragos Academy free content
  3. ENISA ICS training materials (free)
  4. TryHackMe - ICS / SCADA rooms
  5. OT Cybersecurity Essentials by Nozomi Networks (free webinars)

Paid

  1. SANS ICS410: ICS/SCADA Security Essentials (GICSP)
  2. SANS ICS515: ICS Active Defense and Incident Response (GRID)
  3. SANS ICS612: ICS Cybersecurity In-Depth
  4. SANS ICS456: Essentials for NERC Critical Infrastructure Protection
  5. ISA/IEC 62443 Cybersecurity training series
  6. Dragos Threat Intelligence & WorldView subscription training
  7. Claroty Academy training

Free/Paid Labs

  1. GRFICSv2 - Graphical Realism Framework for Industrial Control Simulation - Free, full plant simulation.
  2. OpenPLC project - Open-source PLC to build your own lab.
  3. ICSsim / Virtuaplant / PLCSim
  4. SANS ICS CyberCity (course labs, paid)
  5. Dragos Neighborhood Keeper community data
  6. Awesome ICS Honeypots (Conpot, GasPot, S7comm-trace)
  7. CISA Cyber Storm / tabletop exercises

ICS / OT Tools

Protocol / assessment

  1. Wireshark with ICS dissectors (Modbus, DNP3, IEC 61850, Profinet, S7)
  2. Scapy + ICS plugins
  3. Modbus-CLI / modbus-tk / pymodbus
  4. opendnp3 / dnp3-scanner
  5. iec104-python / libiec61850
  6. PLCScan / S7scan
  7. ISF - Industrial Security Framework
  8. Industroyer2 / CRASHOVERRIDE research samples (for lab use only)

Monitoring / passive detection (commercial)

  1. Dragos Platform
  2. Claroty CTD / xDome
  3. Nozomi Networks Guardian / Vantage
  4. Armis Centrix
  5. Tenable OT Security (formerly Indegy)
  6. Cisco Cyber Vision

Honeypots / deception

  1. Conpot (SCADA/ICS honeypot)
  2. GasPot
  3. T-Pot multi-honeypot distribution

Mapping / attack

  1. redpoint Nmap scripts for ICS
  2. Metasploit ICS modules
  3. ICS-specific exploits archive via exploit-db and ICS-CERT advisories

Certifications

  1. GICSP - Global Industrial Cyber Security Professional (SANS ICS410)
  2. GRID - GIAC Response and Industrial Defense (SANS ICS515)
  3. GCIP - GIAC Critical Infrastructure Protection (SANS ICS456)
  4. ISA/IEC 62443 Cybersecurity Certificate Program (Fundamentals / Risk / Design / Maintenance / Expert)
  5. EC-Council CSA-ICS (newer offering)
  6. ISACA CISA / CRISC (adjacent, for audit/risk)

Blogs/Articles

  1. Dragos blog and annual "Year in Review" report
  2. Claroty Team82 research
  3. Nozomi Labs research
  4. Robert M. Lee's SCADAhacker / Dragos writing
  5. CISA ICS advisories
  6. MITRE ATT&CK for ICS
  7. ICS Kill Chain (Michael Assante, Robert M. Lee)
  8. NIST SP 800-82 Rev 3 (OT Security, 2023)
  9. ISA99 / IEC 62443 series overview
  10. ENISA Good Practices for IoT and OT
  11. INL / DOE CyberStrike and CESER resources
  12. Awesome Industrial Control System Security GitHub
  13. SCADAhacker resource library
  14. Chernovite / Volt Typhoon / Sandworm / Xenotime - APT threat groups of interest (Dragos/Mandiant reporting)
  15. CRASHOVERRIDE / Industroyer, Triton/Trisis, Pipedream/Incontroller technical write-ups