OT Security Training: Professional and Expert
Two stages, one building on the other. The Professional runs remotely on a live lab plant and closes with an examination. The Expert stands in front of real controllers, on site.
Why OT security needs its own training
A plant controls a physical process. It stays largely in the same configuration across its life cycle. Restarts and patches depend on planned shutdowns, and how often those come is decided by the process. Some of its protocols date from the era of closed networks and still transmit without authentication, Modbus TCP or classic S7comm among them. OPC UA does provide for authentication and encryption. Whether they are switched on in a given case is a question to be checked. On top of that, the plant now hangs off remote maintenance, ERP and service laptops.
Our OT training starts exactly there. Both stages end at a plant communicating over IEC 60870-5-104, IEC 61850, Modbus TCP and OPC UA.
Which stage suits whom
Which stage fits depends less on a job title than on what is to be done afterwards.
OT Security Professional, four days remote, 32 teaching units. For everyone who has to place security requirements against a plant. It covers the components and protocols of a plant, the requirements of IEC 62443 and NIS2, and network architecture and incident response. Work runs on a live lab plant, with around 40 per cent of the time spent on exercises. It closes with an exam of forty questions and an incident drill with assigned roles.
OT Security Expert, three days on site, 24 teaching units. For everyone who has to produce and substantiate findings. Protocols byte by byte, attacks run under control, detection rules written on your own recordings and checked against them to see whether they fire. Around 80 per cent of the course is hands-on exercises. It closes with an exam of twenty-five questions, a final exercise and a technical incident report. The Professional is the prerequisite where there is no comparable practice.
Who takes which route. Managers and newcomers are served by the Professional. SOC and control room staff need both, an understanding of the process and the ability to write and test a rule. Security staff with an OT remit start at the Expert once the foundations are in place.
The full syllabus sits on each page, so that it is maintained in one place rather than two.
Professional and Expert next to each other
Anyone looking for training compares. The hard figures therefore sit side by side here rather than spread across two pages.
| Professional | Expert | |
|---|---|---|
| For whom | Anyone who has to place security requirements against a plant | Anyone who produces and substantiates findings themselves |
| Length | Four days | Three days |
| Teaching units | 32, of 45 minutes | 24, of 45 minutes |
| Format | Remote | On site |
| Hands-on share | Around 40 per cent | Around 80 per cent |
| Practised on | A live lab plant, incident drill on YekCity | Real controllers, each team on its own plant |
| Prerequisite | Foundations in IT, networking and IT security. No automation background | The Professional or comparable hands-on experience, Wireshark, the command line, Python at reading level |
| Group size | Remote, larger groups possible | Eight to twelve, in teams of two or three |
| Closes with | An exam of 40 questions and an incident drill with assigned roles | An exam of 25 questions, a final exercise and a technical incident report |
| Language | German | German |
| Bookable as | In-house or open training | In-house or open training |
Open dates are available on request, as is the price. Both depend on whether you book in house or take places on an open date, and on the number of people.
Practising rather than learning
Training conveys knowledge. Whether a team decides under time pressure shows up in an exercise, and that is a format of its own.
The tabletop exercise runs moderated at the table, with a scenario taken from your own topology. The red and blue team exercise on YekCity runs on real controllers, with a red team attacking and your blue team expected to detect and stop it.
For rail and vehicles
For security staff in the rail industry we have developed a course of its own that works on YekTrain: MVB and CANopen, forged telegrams, intrusion detection on the vehicle bus, and building a rail SOC.
For the vehicle environment the equivalent format runs on YekCar, with CAN, diagnostics over UDS and keyless entry systems. Crisis exercises for utilities and municipalities run on YekCity. All three rigs come out of our research and work with real technology.
Common questions about OT training
For the Professional we assume basics in IT, networking and IT security, but no automation background. For the Expert, the Professional or equivalent hands-on experience comes on top.
Train yes, attack no. The exercises run on the lab plant or on our rigs. In a production plant we work passively and in an agreed window.
For the Expert, eight to twelve, in teams of two or three, so that everyone gets to the controllers and the measuring equipment. Professional runs remotely and takes more.
They receive a certificate of attendance from Yekta IT, not a certificate from an accredited body. It states the scope, the contents and the exam result. For the Professional that is forty questions and the emergency exercise, for the Expert twenty-five questions, the final exercise and a technical incident report. In practice the certificate is used as evidence of regular training. Whether it suffices in a given case is for your regulator to decide.
The effort depends on four things. The stage, the number of people, whether you book in house or take places on an open date, and how far the content is tailored to your plant. After a short conversation you get an offer, together with the next dates and a named contact.
Certifications and memberships.
Talk to us.
A first conversation usually takes 30 minutes. We look at where you stand and tell you frankly whether we are the right partner.