Listen to this Post
Introduction:
As cyber-physical attacks on critical infrastructure escalate, the industrial cybersecurity community is rallying around a pivotal event: BSidesICS/OT 2026. This community-driven conference, held in Miami on February 23, 2026, represents a foundational gathering for professionals dedicated to defending Operational Technology (OT) and Industrial Control Systems (ICS). Unlike commercial trade shows, it offers unfiltered knowledge sharing, hands-on skill development, and direct access to the practitioners on the front lines of securing power plants, manufacturing facilities, and refineries.
Learning Objectives:
- Understand the unique threat landscape and security challenges of OT/ICS environments compared to traditional IT.
- Identify key hands-on skills and tools for ICS visibility, detection, and penetration testing.
- Build a professional development roadmap by connecting foundational community events like BSidesICS with advanced training and conferences.
You Should Know:
- OT Security Isn’t Just IT Security in a Hard Hat
The core challenge in industrial cybersecurity is that OT environments—which manage physical processes—cannot be secured with traditional IT approaches alone. Their priorities are safety and continuous uptime, which often conflicts with standard IT security practices like frequent patching or system reboots.
Step‑by‑step guide to understanding your OT network footprint:
A fundamental first step is passive asset discovery to avoid disrupting critical operations.
1. Tool Selection: Use a passive monitoring tool like `zeek` (formerly Bro) or a dedicated OT network visibility platform.
2. Strategic Deployment: Connect a monitoring port (SPAN port) from an OT network switch to your sensor. Crucial: Perform this during a planned maintenance window and with operations team approval.
3. Traffic Analysis: Let the sensor collect traffic for a significant period (e.g., one full operational cycle).
4. Protocol Decoding: Use the tool to identify OT-specific protocols (e.g., Modbus TCP, DNP3, IEC 60870-5-104). For example, with zeek, you can use the ICS protocol parsing scripts:
Ensure Zeek's ICS policy scripts are in use @load policy/protocols/modbus @load policy/protocols/dnp3
5. Baseline Creation: Document all discovered assets, their communication patterns, and protocol usage to establish a security baseline.
2. The Dual Conference Strategy: BSidesICS and S4x26
Maximizing your learning often involves strategic event planning. BSidesICS/OT is intentionally scheduled for February 23, 2026, the day before the major S4x26 conference begins in Miami South Beach. S4 is described as the “RSA/BlackHat of the ICS/OT world” for advanced professionals and early adopters. Attending BSidesICS first provides the foundational community context, beginner-friendly sessions, and networking that will greatly enhance your understanding and experience at the larger, more advanced S4 event.
Step‑by‑step guide to planning your conference week:
- Register for BSidesICS/OT: Secure your ticket via the official website, as the event is on pace to sell out.
- Evaluate S4x26 Attendance: Review the S4x26 agenda. If your role involves strategy, advanced research, or leadership, attending S4 is a valuable investment.
- Leverage BSides for Prep: Use BSidesICS sessions to build foundational knowledge. Participate in the ICS Village CTF to gain practical skills that will help you better understand the advanced demonstrations at S4.
- Network Sequentially: Build initial contacts at the more intimate BSidesICS event. These connections can provide guidance and make navigating the larger S4 crowd easier.
-
From Theory to Practice: The ICS Village CTF
The “Capture The Flag” (CTF) competition at events like BSidesICS is a risk-free environment to apply offensive and defensive techniques on real or simulated industrial equipment. It bridges the gap between theoretical knowledge and practical skill.
Step‑by‑step guide to basic ICS protocol interrogation (for CTF/authorized labs):
Prerequisite: This must only be performed on your own lab equipment or within a sanctioned CTF environment.
1. Discover a Target: Using your passive discovery data, identify an asset speaking Modbus TCP (port 502).
2. Connect with a Scripting Tool: Use Python’s `pymodbus` library to query discrete inputs (read coils), which often represent sensor states.
from pymodbus.client import ModbusTcpClient
client = ModbusTcpClient('192.168.1.10', port=502) Target IP
client.connect()
Read 10 coil values (discrete outputs) starting at address 0
response = client.read_coils(0, 10)
if not response.isError():
print(f"Coil states: {response.bits}")
else:
print("Modbus read error")
client.close()
3. Map the Memory: Attempt to read holding registers (addresses 4xxxx) to find stored values like setpoints or timer counts.
Read 20 holding registers starting at address 40000 response = client.read_holding_registers(0, 20) Note: Library often uses 0-based offset
4. Analyze for Flaws: Look for default configurations, such as writable registers without authentication, which are common CTF vulnerabilities.
- Building a Career: More Than Just Technical Talks
BSidesICS emphasizes holistic professional growth, offering resume workshops and interview skill help. This reflects the industry’s need for communicators who can bridge the IT-OT culture gap.
Step‑by‑step guide to building an OT security lab for your resume:
1. Virtualization Foundation: Use VMware Workstation or VirtualBox to create an isolated virtual network.
2. Acquire Software: Download free PLC simulator software like `OpenPLC` or `Codesys Runtime` to emulate a programmable logic controller.
3. Build a Scenario: Create a simple virtual network with a Windows engineering workstation, an `OpenPLC` instance, and a Kali Linux attacker VM.
4. Practice Key Tasks:
From the engineering workstation, program a simple ladder logic routine on the OpenPLC.
From the Kali VM, use `nmap` to scan for open ports (nmap -sV 192.168.1.0/24).
Attempt to interact with the PLC using the Python scripts from Section 3.
5. Document the Process: This lab becomes a powerful talking point in interviews, demonstrating proactive learning and practical understanding.
- The Training Continuum: From BSides to Advanced Certification
Community conferences like BSidesICS are the entry point to a full ecosystem of industrial security education. For deep, structured learning, organizations like SANS Institute offer multi-day, hands-on courses such as ICS410: ICS/SCADA Security Essentials and ICS515: ICS Visibility, Detection, and Response.
Step‑by‑step guide to using Wireshark for OT protocol analysis (a foundational skill taught in ICS410):
1. Capture Traffic: In your lab, start a packet capture on the network interface connected to your OT test network.
2. Apply a Display Filter: Isolate OT protocols. For example, filter for Modbus TCP: tcp.port == 502.
3. Follow the TCP Stream: Right-click a packet and select Follow > TCP Stream to see the raw conversation between a Human-Machine Interface (HMI) and a PLC.
4. Decode the Function Codes: In the Modbus protocol, the function code defines the action (e.g., `03` = Read Holding Registers, `06` = Write Single Register). Identify these in the packet details pane.
5. Assess for Anomalies: Look for unexpected function codes, like a `Write Single Register` (06) command to a critical setpoint register from an unfamiliar IP address, which could indicate manipulation.
What Undercode Say:
- Community is the Core Defense: The most sophisticated technology fails without a trained, connected, and vigilant community. BSidesICS focuses on building this human network, which is as critical as any security tool.
- Accessibility Drives Resilience: By keeping costs low, providing free training, and welcoming newcomers, the event strengthens the entire industry’s talent pipeline, creating a more diverse and resilient defense front.
Prediction:
The strategic alignment of BSidesICS with the S4 conference will formalize a new “on-ramp” model for industrial cybersecurity. We predict that by 2027, most major OT security events will be preceded by a community-focused, beginner-friendly satellite event. This model will significantly accelerate practical knowledge transfer and help close the critical skills gap. Furthermore, the intense focus on hands-on, physical security (like lockpicking villages) and CTFs will blur the lines between cyber and physical defense training, leading to the rise of the “cyber-physical security engineer” as a standard role within critical infrastructure organizations by the end of the decade.
▶️ Related Video (72% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mikeholcomb The – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
