Listen to this Post
Introduction:
Operational Technology (OT) and Industrial Control Systems (ICS) form the backbone of critical infrastructure—power grids, water treatment plants, and manufacturing lines—yet they remain dangerously exposed to cyber threats. Unlike traditional IT security, OT environments prioritize safety and availability over confidentiality, making standard security tools and practices ineffective. This article extracts and expands upon a free, newly released TryHackMe training room that introduces OT/ICS cybersecurity through a simulated Human Machine Interface (HMI) and covers programmable logic controllers (PLCs), SCADA, and the critical differences between IT and OT security.
Learning Objectives:
- Understand the core components of OT/ICS: PLCs, HMI, SCADA, and their operational roles.
- Differentiate IT cybersecurity from OT cybersecurity, including risk priorities and attack surfaces.
- Gain hands-on experience with a simulated HMI and learn basic Modbus protocol analysis using free tools.
You Should Know:
1. Understanding OT/ICS Architecture & the PLC’s Role
Operational Technology refers to hardware and software that detects or causes changes in physical processes through direct monitoring and control. A Programmable Logic Controller (PLC) is the industrial computer that reads inputs from sensors, executes a control program (ladder logic), and drives actuators. SCADA (Supervisory Control and Data Acquisition) provides centralized monitoring and control across geographically distributed assets.
Step-by-step guide to simulate a simple PLC logic (using OpenPLC and Linux):
This guide uses OpenPLC, a free, open-source PLC simulator.
1. Install OpenPLC on Ubuntu/Debian:
sudo apt update && sudo apt install git automake autoconf libtool make gcc g++ libpcap-dev libssl-dev libmodbus-dev git clone https://github.com/thiagoralves/OpenPLC_v3.git cd OpenPLC_v3 ./install.sh
2. Start the runtime:
sudo ./start_openplc.sh
3. Access the web interface at http://<your-ip>:8080. Upload a sample ladder logic program (e.g., a simple motor start/stop).
4. Monitor Modbus registers using `mbpoll` (install via sudo apt install mbpoll):
mbpoll -a 1 -0 -r 100 -c 1 <PLC-IP>
This reads coil 100 from a Modbus TCP device (default port 502).
Windows alternative: Use the free modRSsim2 simulator for Windows and test Modbus commands via `Test-Connection` or PowerShel’s System.Net.Sockets.TcpClient.
- Hands-On with the Simulated HMI: First Contact with OT Security Controls
The TryHackMe room includes a simulated HMI—a graphical interface operators use to monitor and send commands to PLCs. Attackers often target HMIs to issue malicious setpoints (e.g., changing pressure limits, opening valves). By interacting with a safe simulation, learners understand how input validation and role-based access control are critical.
Step-by-step to emulate an HMI attack & detection using simple Python and Modbus:
Prerequisite: A running Modbus server (OpenPLC or any simulator).
- Discover Modbus devices on your network using Nmap:
sudo nmap -sS -p 502 --script modbus-discover 192.168.1.0/24
2. Read holding registers (sensor values) with Python:
from pyModbusTCP.client import ModbusClient client = ModbusClient(host="192.168.1.10", port=502, auto_open=True) regs = client.read_holding_registers(0, 10) print(regs)
3. Write a malicious coil value (e.g., start pump):
client.write_single_coil(0, True) Force coil 0 to ON
4. Detect unauthorized writes using Wireshark: filter for `modbus` and look for function code 05 (write single coil) or 15 (write multiple coils). Export malicious traffic.
Real-world mitigation: Implement Modbus firewalling, network segmentation, and anomaly detection for unexpected write commands.
- IT vs. OT Cybersecurity: Why Standard Antivirus Fails
In IT, confidentiality (protecting data) is top priority; in OT, safety and availability come first. Patching an OT system often requires planned downtime, and many legacy PLCs cannot run endpoint protection. Threat models differ: IT fears data theft; OT fears manipulated control logic causing physical damage.
Step-by-step risk assessment for an OT environment (using the CIA triad reversed):
- Identify critical assets – List all PLCs, RTUs, HMIs, engineering workstations.
- Map network flows – Run `traceroute` or `nmap -sT -p 1-65535
` from a limited jump box.
Note: Never scan production OT without explicit permission.
- Apply the Purdue model – Segregate Level 0 (physical process), Level 1 (PLC), Level 2 (HMI/SCADA), Level 3 (operations), Levels 4-5 (enterprise IT).
- Check for default credentials – Many PLCs ship with
admin:admin. Use `hydra` against a test Modbus device:hydra -l admin -P /usr/share/wordlists/rockyou.txt modbus://192.168.1.10:502
- Document compensating controls – Unidirectional gateways, application whitelisting, and manual patch review.
4. Free Resources & Newsletter: Deepening OT/ICS Knowledge
The post author, Mike Holcomb, provides a free newsletter and video series for OT/ICS cybersecurity. The TryHackMe room is the first of many, with Room 2 launching soon. You can access:
– TryHackMe room: `https://lnkd.in/edv7YM8U` (If broken, navigate to TryHackMe and search “OT/ICS” or “Mike Holcomb”)
– Newsletter (7,500+ subscribers): `https://lnkd.in/ePTx-Rfw`
– Free video tutorials: `https://lnkd.in/eif9fkVg`
Step-by-step to configure a free home OT lab using virtualized software:
1. Download and install VirtualBox (Windows/Linux) or VMware.
2. Get a PLC simulator: OpenPLC (Linux VM) or FactoryIO (free trial with limited assets).
3. Install SCADA software: Use Ignition Maker Edition (free for non-production) or open-source ScadaBR.
4. Build a simple network – Ubuntu VM (OpenPLC), Windows VM (Ignition), and a Kali VM (attacker).
5. Practice attacks & defenses:
– From Kali: `nmap -p 502 –script modbus-enum.nse
– Capture traffic with Wireshark on the switch (use bridge networking in VirtualBox).
6. Write a detection rule for Snort on the OT gateway:
alert tcp $HOME_NET 502 -> $EXTERNAL_NET any (msg:"Modbus write from untrusted"; content:"|05|"; depth:1; sid:1000001;)
- Real-World Attack Scenarios and Mitigation (Based on Actual Incidents)
The 2017 TRITON attack targeted a safety instrumented system (SIS) by manipulating a Triconex PLC. The 2015 Ukraine power grid attack used BlackEnergy to open breakers via compromised HMIs. These highlight the need for secure engineering workstations and network monitoring.
Step-by-step to emulate a simple replay attack and defense using Modbus:
- Capture legitimate traffic from the HMI to PLC using tcpdump:
sudo tcpdump -i eth0 -w normal_operation.pcap port 502
- Replay the traffic (simulating an attacker) using
tcpreplay:sudo tcpreplay -i eth0 normal_operation.pcap
This could cause unintended physical actions.
- Defend using a Modbus gateway with sequence checking – Configure a Raspberry Pi as a proxy that rejects duplicate command frames.
- Deploy simple rule in `nftables` to limit write frequency:
nft add rule filter input ip protocol tcp tcp dport 502 meter write-limit { ip saddr limit rate 5/minute } accept nft add rule filter input ip protocol tcp tcp dport 502 drop(Limits each source to 5 Modbus writes per minute.)
What Undercode Say:
- Hands-on simulation is irreplaceable – The included HMI in TryHackMe’s room bridges the gap between abstract theory and real industrial control, especially for IT professionals new to OT.
- Free training democratizes critical infrastructure security – With attacks on water, power, and manufacturing rising, accessible rooms like this help build a larger workforce capable of defending OT. However, learners must complement this with physical safety awareness—real PLCs can kill.
- The IT/OT divide is narrowing – Expect to see more cross-discipline training that combines Nmap, Python, and Modbus analysis with safety principles. The future of cybersecurity is converged.
Prediction:
By late 2026, major cloud providers will offer OT-security-as-a-service platforms that integrate AI-based anomaly detection for Modbus/DNP3 traffic. TryHackMe and similar platforms will add live, time-limited OT attack simulations using real industrial emulators (like Siemens PLCSIM), forcing learners to respond to fake pump-overpressure events. The demand for “OT Security Analyst” roles will triple, and certifications like GICSP and IEC 62443 will become mandatory for entry-level positions. This free room is the first domino—expect corporations to sponsor similar content to reduce their talent gap in industrial cyber defense.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Https: – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
