ICS/SCADA › Module 1 › Lesson 2
Lab Sims Only
Lab sims only means diagrams, checklists, and fictional LAB-OT-001 templates on YOUR $OT_LAB — defensive OT literacy only; no real-plant attacks, unauthorized OT scans, or exploit cookbooks.
Visual · t38_lab_sims_only
Lab Sims Only literacy. $OT_LAB only. Original Cyberlium.
Opening
Your OT lab stays simulation-only — fictional plant templates YOU author, never wired to employer SCADA VLANs.
Cyberlium Fictional Water Co and LAB-OT-001 zone maps live on OT lab only. Diagrams, asset CSV stubs, and CISA literacy notes use explicit TRAINING labels — not live historian exports. Cyberlium Topic 38 practices on $OT_LAB — YOUR fictional OT templates, zone diagrams, and labeled checklists under $HOME/cyberlium-lab/t38-ot/ no real-plant attacks, unauthorized OT scans, or exploit cookbooks. Next: No Plant Attacks.
1. What Lab Sims Only covers (named)
Allowed: self-authored zone maps, asset inventory stubs, CISA doc notes, labeled checklists. Courseware packs use example.local asset names. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Lab inventory row lists plant name, zone count, fictional PLC/HMI labels. Never paste employer OT IP lists or live tag exports. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Command guide
Try these commands — What Lab Sims Only covers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ICS — https://www.cisa.gov/topics/industrial-control-systems NIST SP 800-82 — https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t38-ot/notes" "$HOME/cyberlium-lab/t38-ot/LAB-OT-001" "$HOME/cyberlium-lab/t38-ot/LAB-OT-001/zones" "$HOME/cyberlium-lab/t38-ot/LAB-OT-001/assets" "$HOME/cyberlium-lab/t38-ot/LAB-OT-001/protocols" "$HOME/cyberlium-lab/t38-ot/LAB-OT-001/threats" "$HOME/cyberlium-lab/t38-ot/LAB-OT-001/monitoring" "$HOME/cyberlium-lab/t38-ot/LAB-OT-001/hardening" "$HOME/cyberlium-lab/t38-ot/LAB-OT-001/incident" cat > "$HOME/cyberlium-lab/t38-ot/lab.env" <<'EOF' export OT_LAB=$HOME/cyberlium-lab/t38-ot export OT_PLANT=$HOME/cyberlium-lab/t38-ot/LAB-OT-001 export OT_ZONES=$HOME/cyberlium-lab/t38-ot/LAB-OT-001/zones export OT_ASSETS=$HOME/cyberlium-lab/t38-ot/LAB-OT-001/assets export OT_PROTOCOLS=$HOME/cyberlium-lab/t38-ot/LAB-OT-001/protocols export OT_THREATS=$HOME/cyberlium-lab/t38-ot/LAB-OT-001/threats export OT_MONITOR=$HOME/cyberlium-lab/t38-ot/LAB-OT-001/monitoring export OT_HARDEN=$HOME/cyberlium-lab/t38-ot/LAB-OT-001/hardening export OT_INCIDENT=$HOME/cyberlium-lab/t38-ot/LAB-OT-001/incident EOF
Command — copy this
chmod 600 "$HOME/cyberlium-lab/t38-ot/lab.env" grep -E 'OT_' "$HOME/cyberlium-lab/t38-ot/lab.env"
Primary tools to practice this lesson: grep, mkdir. Reference sites: CISA ICS (https://www.cisa.gov/topics/industrial-control-systems); NIST SP 800-82 (https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why Lab Sims Only matters for defenders
Scope keeps OT practice ethical and safe. Employer OT diagrams and vendor credentials copied into lab are out of scope. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
If the plant is not fictional and labeled lab-only, fix scope first. Operations approval precedes any real OT touch. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
3. $OT_LAB boundary
Forbidden: importing employer topology for realism. Allowed: lab inventory row with TRAINING source label. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Ship: lab inventory row. Next: No Plant Attacks.
4. What you ship: lab sims only card for $OT_LAB
Lab sims only means diagrams, checklists, and fictional LAB-OT-001 templates. $OT_LAB named. NEVER real-plant attack steps. chmod 600.
5. What you record before the next lesson
Date (UTC). Lab Sims Only card. $OT_LAB named. File t38-m01-l02-lab-sims-only.txt chmod 600.
6. Wrong vs right: plant attacks vs YOUR OT lab sims
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Connect lab VM to employer PLC subnet for realism.
Right
Write lab sims only card for YOUR $OT_LAB. Next: No Plant Attacks.
Mission: document Lab Sims Only on YOUR OT lab
1) Name literacy rows on $OT_LAB. 2) Write NEVER list (no real-plant attacks, unauthorized OT scans, or exploit cookbooks). 3) chmod 600. Never scan or exploit real industrial networks.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: literacy on $OT_LAB — not attack recipes against live plants.
Knowledge Check
APPLY: Lab Sims Only on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Topic 38 includes ICS attack cookbooks against real plants.
True or False
Knowledge Check
APPLY: Lab Sims Only literacy on Cyberlium uses:
Multiple choice