OT Security Professional Training
Four days from the controller to the reporting duty. Components and protocols, attack paths, IEC 62443 and NIS2, network architecture, attack detection and incident response. The exercises run in a virtual waterworks that carries through all four days.
At a glance
The OT Security Professional is our entry-level training in the security of industrial plants. Four days, 32 teaching units, held in German. Day 1 covers how a plant is built, day 2 its protocols and the attacks on them, day 3 IEC 62443 and regulation, day 4 attack detection and incident response. Around 40 per cent of the time you work yourself, mostly in a virtual waterworks that runs as the example through all four days.
- Duration. Four days, 32 teaching units of 45 minutes.
- Format. In-house for one company, remote or on site. Or as an open date for individuals, remote.
- Language. German.
- Hands-on work. Around 40 per cent, four guided exercises and an emergency drill.
- Completion. Emergency drill and certificate of attendance.
- Prerequisites. Basic IT and network knowledge, basic knowledge of IT security. Automation engineering is not required.
We arrange dates on request, for in-house and for open courses alike.
Who this training is for
- People responsible for OT
- Automation engineers
- IT and cybersecurity specialists who work with OT environments or will do so
- Auditors
- Consultants
Basic IT and network knowledge is required, along with basic knowledge of IT security. Automation engineering is not.
Afterwards you can
- tell IT and OT security apart and place the interplay between safety and security
- place OT components, communication protocols and typical weaknesses within architectures
- place OT attacks, threat actors and supply chain risks with their effects, and apply MITRE ATT&CK for ICS
- assign IEC 62443, ISO 27019, NIST SP 800-82, CIS Controls and the BSI recommendations as well as NIS2, the German KRITIS rules and the Cyber Resilience Act
- describe how an OT IDS works and structure the response to OT incidents
- place the building blocks of OT security management in your organisation, from the management system through assessments and awareness to incident response
The Professional conveys the understanding needed to design, assess and steer OT security. Anyone who wants to run attacks on industrial protocols themselves, write detection rules and work forensically belongs in the three-day on-site OT Security Expert, which builds on the Professional.
The plant is no longer a world of its own
Industrial plants stood on their own for decades. Remote maintenance by the manufacturer, production data in the ERP, radio links to outlying sites, a service laptop in the control cabinet. Today the plant hangs on IT, usually in several places at once.
Stuxnet, the blackouts in Ukraine, Triton, Colonial Pipeline and FrostyGoop show the same development. At the beginning there were states with years of preparation. By now ransomware that never aimed at production at all is enough to stop it. In 2024 FrostyGoop needed nothing but Modbus TCP to switch off the district heating in Lviv in the middle of winter.
Even so, a plant cannot be treated like a server room. Availability comes before confidentiality. A patch waits for a maintenance window, a restart costs production.
Teaching format and lab environment
Around 55 per cent of the time is lecture with discussion, around 40 per cent hands-on work. The rest goes into reflection and the quiz that closes each day. The quiz serves your own sense of progress and is not graded.
The same plant runs through all four days. Components, protocols, attacks, protective measures and incident response are discussed on this one example, so the picture assembles itself over the four days.
The OT lab maps three levels of the Purdue model. The field level holds sensors, tanks, pumps, drives and valves. The control level communicates over Modbus TCP and OPC UA. The supervisory level holds an OPC UA client and the operator interface. The emergency drill on the fourth day runs on the simulator of the model town YekCity.
What that means shows on day 2. You change a process value over Modbus. The write command needs no login. The display in the control room stays plausible.
Day 1: OT security fundamentals
Aim of the day. Tell IT and OT security apart, place OT components in the Purdue model and assign the roles in OT security projects.
- OT and IT security. Protection goals, life cycles, operating philosophy and the limits of classic IT security in OT
- Safety and security. How the two relate and where they get in each other's way
- Roles. Operator, integrator, manufacturer, service provider and information security officer. Plus the points where responsibility gets lost between them
- How industrial production plants are built. From the process to the supervisory level
- Components. PLC, RTU, HMI, SCADA, DCS, historian, engineering workstation, safety instrumented systems, building automation, access control, IEDs and IIoT, with examples from Siemens, Rockwell, Schneider, Phoenix Contact and WAGO
- The Purdue model to ISA-95. The levels and the transitions between IT and OT
- Exercise. Exploring the virtual waterworks
Day 2: Modbus, S7, OPC UA and the attacks on them
Aim of the day. Name industrial protocols and their weaknesses, place threat actors and attack paths, and analyse real incidents with MITRE ATT&CK for ICS.
- Protocols. Modbus TCP and RTU, S7 and S7+, OPC UA, Profinet and Industrial Ethernet
- Telecontrol. IEC 60870-5-104 and IEC 61850 in overview
- Fieldbuses. Modbus RTU, CAN bus and Profibus DP
- Weaknesses. In components, in protocols and in architectures
- Tools. Wireshark with ICS dissectors and an OPC UA client
- Threat actors. State groups, ransomware, hacktivists and insiders
- Attack paths. Supply chain risks, the Cyber Kill Chain and MITRE ATT&CK for ICS
- Case studies. Stuxnet, the blackouts in Ukraine, Triton, Industroyer, NotPetya, Colonial Pipeline, FrostyGoop and Pipedream
- Consequences of OT incidents. Physical, financial, regulatory and for reputation
- Exercise. Analysing network captures from the virtual waterworks
- Exercise. Manipulating a process value over Modbus and the effect on the operator interface
Day 3: IEC 62443, regulation and network architecture
Aim of the day. Assign standards and frameworks, name the regulatory requirements and reporting routes in the German market, and describe the basic principles of secure OT network architecture. That includes what the German KRITIS umbrella act demands of an operator.
- IEC 62443. Zones, conduits and security levels
- Further frameworks. ISO 27001 and ISO 27019, NIST CSF 2.0, NIST SP 800-82, CIS Controls and the ICS Security Compendium of the German BSI. Plus how they relate
- Typical policies. Patch management, backup, incident response and awareness
- Law. NIS2, the KRITIS umbrella act, the German IT Security Act, the Cyber Resilience Act and the sector-specific security standards B3S
- Reporting routes and deadlines. Who reports what to whom, and when
- Network segmentation. Along the Purdue levels, with an industrial DMZ and the communication between zones
- Further ways in. Wi-Fi, USB, mobile devices and modems, the routes that lead past the segmentation
- Remote access. VPN, jump hosts, bastion architectures, remote maintenance by manufacturers and zero trust in OT
- Exercise. Sketching a zone and conduit concept
Day 4: Protection, attack detection and incident response
Aim of the day. Name the building blocks of technical OT security, describe how an OT IDS and a SIEM work and how to choose them, structure the incident response and analyse a real attack in a simulated incident.
- Asset discovery. Passive and active methods, tool categories and the data quality of the inventory
- Hardening. Patch management, antivirus, whitelisting and EDR in OT
- Backup and recovery. Including the PLC program versions, plus authentication, permissions and physical security
- Attack detection. Network and host based IDS, passive capture over SPAN and TAP, anomaly and signature based detection, selection criteria and the line to the SIEM
- Use cases. Following MITRE ATT&CK for ICS, with threat intelligence as the basis
- Incident response. Phases and plans, the precedence of safety, containment without stopping production, the interplay of IT security, OT engineering and management, external support, crisis communication and documentation
- Playbooks and restart planning
- Reporting duties. Under NIS2 and for operators of critical infrastructure
- Assessments. Gap analysis, vulnerability analysis and OT penetration tests
- Emergency drill. Around 90 minutes, distributed roles, on the YekCity simulator, with debrief
Emergency drill and certificate
After the emergency drill on the fourth day you receive a certificate of attendance from Yekta IT. It states the scope of 32 teaching units, the contents and the emergency drill. It can be used as evidence of training under NIS2. Whether it suffices in a given case is for your supervisory authority to decide.
The OT Security Training is held in German and aimed at German and European regulation, that is NIS2, the KRITIS umbrella act, the B3S sector standards and the recommendations of the BSI.
Formats
Both routes are held in German. The remote training runs over an online session. The virtual waterworks is open to every participant.
In-house training
For a team from your own company, remote or at your site. We arrange the date by agreement. You choose the example plant, waterworks or substation, to match your sector.
Open date
For individual participants, remote. We arrange dates on request. Tell us your preferred period in the form below.
Trainer
Frequently asked questions
That depends on the format, on the number of participants and on whether we come to you. Leave your details below and you get the terms and a named contact.
We arrange dates on request, for in-house and for open courses alike. Tell us your preferred period in the form and we come back with concrete dates.
Eight to twelve people. Larger groups we split across two dates.
No. Basic IT and network knowledge is enough, plus basic knowledge of IT security. The training starts with the question of what makes a controller different from a server.
In-house we teach at your site, but the exercises run in the virtual waterworks. We do not touch your own plant. If you want that one examined, it is an OT penetration test.
The Professional conveys the understanding needed to design, assess and steer OT security. The Expert is three days of on-site work at the device, with attacks on industrial protocols and detection rules of your own. It builds on the Professional.
The certificate states scope, contents and the emergency drill and can be used as evidence of regular training. Whether it suffices in a given case is for your supervisory authority to decide.
The OT Security Training is held in German. For a delivery in English, talk to us.
Ask about dates and terms
Tell us the format and the number of participants. You get dates, terms and a named contact.
