ICS/SCADA › Module 1 › Lesson 4
Lab — Setup
Pack OT scope, fictional plant inventory, and ethics disclaimer on YOUR $OT_LAB — defensive OT literacy only; no real-plant attacks, unauthorized OT scans, or exploit cookbooks.
Visual · t38_lab_setup
Lab Setup literacy. $OT_LAB only. Original Cyberlium.
Opening
Lab setup before OT exercises — scope paperwork mentors expect before zone and protocol modules.
Lessons 1–3 defined why OT security matters, lab sims only, and no plant attacks. This lab ships combined scope, plant inventory, and ethics card under cyberlium-lab/t38-ot/. Cyberlium Topic 38 practices on $OT_LAB — YOUR fictional OT templates, zone diagrams, and labeled checklists under $HOME/cyberlium-lab/t38-ot/ no real-plant attacks, unauthorized OT scans, or exploit cookbooks. Next: Quiz — OT Mindset and Lab.
1. What Lab Setup covers (named)
Create t38-m01-l04-lab-setup.txt with date, operator, OT lab placeholder, ethics paragraph, plant inventory. Optional: one-line proof t38-ot folder exists — no real OT connections required. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Merge M1 literacy into one setup pack. Cross-reference M1 ethics in header. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Command guide
Try these commands — What Lab Setup covers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA recommended practices — https://www.cisa.gov/resources-tools/resources/ics-recommended-practices NIST SP 800-82 — https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export OT_LAB=${OT_LAB:-$HOME/cyberlium-lab/t38-ot}
cat > "$OT_LAB/roe.txt" <<'EOF'
OT_LAB=$HOME/cyberlium-lab/t38-ot
plant: fictional LAB-OT-001 — water treatment literacy stub (not a real facility)
targets: YOUR zones/ assets/ protocols/ threats/ monitoring/ hardening/ incident/ folders
never: Modbus exploit cookbooks; PLC attacks on live plants; unauthorized OT scans
never: Stuxnet replication; present LAB TRAINING artifacts as live plant pentest results
allowed: zone/conduit ASCII diagrams; asset CSV stubs; CISA curl literacy pages
allowed: checklists; threat history+defense notes; incident tabletop fiction
output: markdown/CSV stubs in lab folder — educational defensive literacy only
EOFCommand — copy this
chmod 600 "$OT_LAB/roe.txt" grep -E 'OT_LAB|never|allowed|LAB-OT-001|LAB TRAINING' "$OT_LAB/roe.txt" cat > "$OT_PLANT/plant-profile.md" <<'EOF' # LAB-OT-001 — Fictional Plant Profile (literacy only) - **Type:** water treatment literacy stub - **Scope:** SCADA + PLC + HMI fictional stack - **Zones:** enterprise / DMZ / OT / safety (diagram stubs) - **Disclaimer:** NOT a real facility — templates for YOUR lab only EOF
Command — copy this
grep -E 'Fictional|Disclaimer|LAB-OT-001' "$OT_PLANT/plant-profile.md" curl -sS https://www.cisa.gov/resources-tools/resources/ics-recommended-practices | head -5
═══ WINDOWS ═══
Run on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t38-ot/roe.txt | Select-String never Get-ChildItem $HOME/cyberlium-lab/t38-ot/LAB-OT-001
Primary tools to practice this lesson: grep, curl. Reference sites: CISA recommended practices (https://www.cisa.gov/resources-tools/resources/ics-recommended-practices); NIST SP 800-82 (https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why Lab Setup matters for defenders
Grep for Modbus exploit, real plant IPs, live HMI credentials — redact. Rewrite forum habits to OT lab fictional placeholders. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Classmates build their own setup packs. Not yours. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
3. $OT_LAB boundary
chmod 600 on the pack — quiz next, then ICS Overview. OT mentors archive setup before first zone map. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Ship: lab setup pack. Next: Quiz — OT Mindset and Lab.
4. What you ship: lab setup card for $OT_LAB
Pack OT scope, fictional plant inventory, and ethics disclaimer. $OT_LAB named. NEVER real-plant attack steps. chmod 600.
5. What you record before the next lesson
Date (UTC). Lab Setup card. $OT_LAB named. File t38-m01-l04-lab-setup.txt chmod 600.
6. Wrong vs right: plant attacks vs YOUR OT lab sims
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip the file and import employer OT diagram PDF.
Right
Write lab setup card for YOUR $OT_LAB. Next: Quiz — OT Mindset and Lab.
Mission: document Lab Setup on YOUR OT lab
1) Name literacy rows on $OT_LAB. 2) Write NEVER list (no real-plant attacks, unauthorized OT scans, or exploit cookbooks). 3) chmod 600. Never scan or exploit real industrial networks.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: literacy on $OT_LAB — not attack recipes against live plants.
Knowledge Check
APPLY: Lab Setup on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Topic 38 includes ICS attack cookbooks against real plants.
True or False
Knowledge Check
APPLY: Lab Setup literacy on Cyberlium uses:
Multiple choice