ICS/SCADA › Module 10 › Lesson 3
Evidence Pack
Evidence pack literacy indexes all OT lab artifacts with LAB TRAINING labels for capstone submission on YOUR $OT_LAB — defensive OT literacy only; no real-plant attacks, unauthorized OT scans, or exploit cookbooks.
Visual · t38_evidence_pack
Evidence Pack literacy. $OT_LAB only. Original Cyberlium.
Opening
Evidence pack is your capstone index — LAB-labeled paths proving defensive literacy on YOUR OT lab only.
Evidence pack indexes setup, fundamentals, protocols, threats, segmentation diagram, monitoring, hardening, and incident packs with LAB TRAINING labels and NEVER boundaries restated. No live plant evidence, exploit scripts, or employer OT exports. Cyberlium Topic 38 practices on $OT_LAB — YOUR fictional OT templates, zone diagrams, and labeled checklists under $HOME/cyberlium-lab/t38-ot/ no real-plant attacks, unauthorized OT scans, or exploit cookbooks. Next: Capstone Lab.
1. What Evidence Pack covers (named)
Evidence index literacy: path, module, artifact type, LAB TRAINING label, date. Cross-check against capstone checklist from 10-1. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Write capstone-evidence-index.txt listing all module artifact paths. chmod 600 on index. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Command guide
Try these commands — What Evidence Pack covers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ICS — https://www.cisa.gov/topics/industrial-control-systems NIST SP 800-82 — https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export OT_LAB=${OT_LAB:-$HOME/cyberlium-lab/t38-ot}
python3 - <<'PY'
import os
lab = os.environ.get('OT_LAB', os.path.expanduser('~/cyberlium-lab/t38-ot'))
path = os.path.join(lab, 'notes', 'capstone-evidence-index.txt')
open(path, 'w').write('
'.join([
'CAPSTONE EVIDENCE INDEX — YOUR t38-ot lab fictional LAB-OT-001 only',
'Ethics: roe.txt, no-plant-attacks.txt',
'M2: ICS fundamentals notes',
'M4: modbus-named.txt (defensive only) + protocol-risks.csv',
'M5: stuxnet-named.txt (history+defense) + defense-lessons.md',
'M6: zone-map-stub.txt + firewall-rules-stub.csv',
'M7: asset-inventory.csv + anomaly-use-cases.csv',
'M8: patch-governance.csv + hardening-checklist.md',
'M9: ot-ir-phases.md + lessons-learned.csv',
'Label: LAB TRAINING — NOT FOR LIVE PLANT OPERATIONS',
'Refusals: no Modbus exploit cookbooks / no Stuxnet replication / no unauthorized OT scans',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'LAB TRAINING|Refusals|stuxnet' "$OT_LAB/notes/capstone-evidence-index.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: CISA ICS (https://www.cisa.gov/topics/industrial-control-systems); NIST SP 800-82 (https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why Evidence Pack matters for defenders
LAB labels prevent misrepresenting training work as employer audit evidence. Integrity beats volume. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Students build evidence index on lab notes. Mentors verify files exist at listed paths. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
3. $OT_LAB boundary
Forbidden: indexing employer live OT exports or exploit repos. Allowed: evidence index of OT lab artifacts only. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Ship: evidence pack index. Next: Capstone Lab.
4. What you ship: evidence pack card for $OT_LAB
Evidence pack literacy indexes all OT lab artifacts with LAB TRAINING labels for capstone submission. $OT_LAB named. NEVER real-plant attack steps. chmod 600.
5. What you record before the next lesson
Date (UTC). Evidence Pack card. $OT_LAB named. File t38-m10-l03-evidence-pack.txt chmod 600.
6. Wrong vs right: plant attacks vs YOUR OT lab sims
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include Modbus attack repo link in evidence index.
Right
Write evidence pack card for YOUR $OT_LAB. Next: Capstone Lab.
Mission: document Evidence Pack on YOUR OT lab
1) Name literacy rows on $OT_LAB. 2) Write NEVER list (no real-plant attacks, unauthorized OT scans, or exploit cookbooks). 3) chmod 600. Never scan or exploit real industrial networks.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: literacy on $OT_LAB — not attack recipes against live plants.
Knowledge Check
APPLY: Evidence Pack on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Topic 38 includes ICS attack cookbooks against real plants.
True or False
Knowledge Check
APPLY: Evidence Pack literacy on Cyberlium uses:
Multiple choice