OT/ICS & Critical Infrastructure Security — KashSec Academy

A different world from IT: SCADA, industrial protocols, the Purdue Model, real-world ICS attacks (Stuxnet, Ukraine grid), and practical controls that respect physical safety constraints. 14 free lessons, advanced level, starting with "What is OT/ICS Security?"

Level: Advanced · 14 lessons · Free, no account needed.

Lessons in this path

  1. What is OT/ICS Security? — Why OT security reverses IT's usual priorities, and the vocabulary you'll need.
  2. SCADA & ICS Architecture Fundamentals — The sense-decide-act control loop, SCADA vs. DCS, HMI, and the historian.
  3. Industrial Protocols: Modbus, DNP3, and Why Their Design Causes Security Problems — Protocols with no built-in authentication, and why 'just add TLS' doesn't work.
  4. The Purdue Model: Segmenting IT from OT — The standard reference architecture, and why the DMZ is the whole point.
  5. Real-World ICS Attacks: What They Actually Teach Us — Stuxnet, the Ukraine grid attacks, Oldsmar, and Triton — mapped back to the lessons that predicted them.
  6. Practical OT Security Controls — Segmentation, passive monitoring, jump hosts, and compensating controls for unpatchable legacy gear.
  7. OT Asset Inventory & Visibility — Passive discovery for the equipment you don't even know you have.
  8. ICS Vulnerability Management — Exposure-based prioritization when active scanning itself is the risk.
  9. Safety Instrumented Systems — The independent last line of defense against physical harm — and the exact target of Triton/Trisis.
  10. ICS Incident Response — Why 'isolate immediately' can be more dangerous than the incident itself.
  11. ICS Supply Chain Risk — Compromised firmware, infected removable media, and third-party integrator access.
  12. IIoT & Cloud Convergence — How a single cellular sensor can quietly bypass the entire Purdue Model.
  13. OT/ICS Careers & Certifications — GICSP, realistic entry paths, and how to build demonstrable experience without plant access.
  14. Capstone: Secure a Realistic Industrial Network — A full assessment exercise applying everything in this path to one fictional facility.