OT/ICS as Safety, Not a CTF

Information technology (IT) is email, laptops, the cloud account you own. OT is the process. The same Ethernet family may carry both, which is why beginners assume a plant is “just more IoT.” It is not. A camera that reboots is an annoyance. A controller that reboots mid-batch can dump product, trip a turbine, or stop a ventilator’s upstream support gear. Named protocol families exist so you can read an architecture diagram: Modbus, DNP3, EtherNet/IP, OPC UA, BACnet in buildings. Those names are literacy. Function codes, write coils, and “fun Python scripts” aimed at a live controller are not this course. If a sentence would help someone halt a process they do not own, it does not belong in your notes.

Write the legal sentence before you write any plant noun: original Cyberlium teaching mapped to the CEH v13 IoT and OT hacking domain — not official EC-Council training, not a cert, not exam dumps. Public after-action reports that name a worm in a uranium plant or a pipeline shutdown are literacy like NVD pages — they teach that IT malware can reach OT when the networks were not segmented and that vendors ship patches on a calendar. They are not a lab in reproducing the worm, not a reason to scan a local factory from the parking lot, not a hall pass because “the HMI was on the internet.” A public HMI is still someone else’s safety system. Report it through a responsible channel if you are a researcher with a program. Do not poke it. Cyberlium homework is never that program.

sudo apt install nmap

brew install nmap

choco install nmap  # or download https://nmap.org/download.html

cat >> "$NOTES" << 'EOF'
ot_ics: physical process + a network jack
not_a_ctf: no boot-to-root homework on plants
EOF

Module 3 taught that a connect scan completes a handshake. On a laptop you own, that is a closed lab. On a 1990s controller still running because the line cannot stop, a burst of unexpected TCP, a malformed industrial request, or even a noisy discovery walk can fill a tiny CPU, block a scan-cycle, or hang an HMI. You will not get a cookbook of which packets do that. You need the ethics sentence: unexpected traffic at OT is a change to a safety system you are not authorized to make. “I used -T2” is not a defense. “I only pinged” is not a defense. “The plant Wi-Fi had no password” is not a defense. “I am studying CEH” is not a defense. If you do not have written rules of engagement from the owner of that process — the company, the hospital, the utility — you do not send packets at it. This course does not issue that RoE.

Hospitals sit in the same refuse list on purpose. Infusion pumps, imaging, nurse-call, building air — some of it is IoT-shaped, some of it is OT-shaped, all of it can harm a patient if you knock it over or freeze an interface. A student with a laptop in the lobby is not on the biomedical engineering change board. Do not scan the ward. Do not try default passwords on a pump. Do not join “medtech CTF” energy on a real floor. If your employer someday puts you on a scheduled OT assessment, that work lives under their lawyers, their window, their jump host, their vendor — not under a Cyberlium checkbox. Until then, the only honest lab is a notes file that says you will not.

Defenders draw a line so a phished laptop cannot talk directly to a controller. A common literacy picture is the Purdue reference model: lower levels close to the process (sensors, PLCs), middle levels for supervisory HMIs and historians, upper levels for enterprise IT. You do not need to memorize a vendor’s trademarked drawing. You need the idea: flatten those layers onto one VLAN and a ransomware event on a finance PC becomes a process event. Compensating controls have names: a demilitarized zone (DMZ) between IT and OT, a jump host (a single hardened box people use instead of browsing from a PLC), firewalls that allow only documented flows, no direct internet from controllers. Those names match Module 12’s firewall-as-policy lesson — still not a bypass puzzle, still not a plant you scan to “verify the firewall.”

Household scale is Lesson 3’s guest SSID. Industrial scale is this paragraph’s DMZ. Same verb: do not let the gadget network initiate into the network you actually care about, and do not let the enterprise network spray into the process. Remote vendor access, when it exists, is a ticketed, time-boxed, logged path — not a forever VPN from a technician’s home PC with default passwords. You will not design a red-team path around a jump host in this lesson. You will write: segmentation is how adults keep a malware Tuesday from becoming a valve Wednesday.

IT laptops patch on Tuesday night. OT patches when the line is already down, the vendor has qualified the firmware, the safety review signed, and a rollback image exists. That slowness is not stupidity. It is how you avoid bricking a controller that takes six weeks to replace. The defender verbs are: inventory the model and firmware YOU are allowed to see (your employer’s asset list, or a hypothetical plant you do not touch), subscribe to the vendor’s security advisories, schedule the window, test on a spare if one exists, then patch. The student verbs in this course are: write those sentences. Do not “help” a local factory by scanning it to build their inventory. Do not download a PLC exploit PoC because a CVE named a brand. Module 5 already refused exploit clones; this lesson refuses plant scans the same way.

If you never walk a plant floor, you still finish. Define OT vs IT in your own words. Write why a scan can be a physical event. Name segmentation and the change window. Write the refuse list. chmod 600. Inventing a classmate’s uncle’s factory IP as a row fails. Pasting Shodan hits for “port 502” fails. The useful discomfort is that this looks like a policy lesson, not a hacker lab. That is the point. Safety work is mostly permission, windows, and not touching the live process from a homework prompt.

On a computer you own, create cyberlium-lab if needed. Fill the template in your own words. Do not add an IP that is not a definition. Do not add a protocol payload. chmod 600. The block writes notes and a tiny checker — there is no scanner, no industrial client, no extra host.

cat >> "$NOTES" << 'EOF'
purdue_idea: IT and OT are layered, not one flat lab
homework: name the split — do not scan OT
EOF

A filled notes file with no process IPs is complete. A filled notes file that lists a water-tower address “for later” is an ethics fail even if Python printed PASS. Re-run the checker after you replace parentheticals. Do not gist industrial payloads. Do not add a sitting that “just Shodans port 502.” Lesson 4’s inventory is household gadgets YOU own — still not a plant. You now treat OT/ICS as safety work: segmentation, vendor windows, and a hard never-scan. This is original Cyberlium teaching mapped to the CEH v13 IoT and OT hacking domain — not official EC-Council training, not a cert, not exam dumps. Next — Network Isolation for Gadgets — guest Wi-Fi for cameras and why admin UIs do not belong on the internet.