ICS/SCADA › Module 1 › Lesson 3
No Plant Attacks
No plant attacks means defensive literacy — history and defense for named threats, never exploit recipes on YOUR $OT_LAB — defensive OT literacy only; no real-plant attacks, unauthorized OT scans, or exploit cookbooks.
Visual · t38_no_plant_attacks
No Plant Attacks literacy. $OT_LAB only. Original Cyberlium.
Opening
Named threats like Stuxnet belong in history-plus-defense lessons — Cyberlium refuses ICS attack cookbooks against real plants.
OT education covers protocol roles, zone maps, Stuxnet history and defensive lessons, and CISA recommended practices. Attacking real water, power, or manufacturing plants is illegal and dangerous. Cyberlium Topic 38 practices on $OT_LAB — YOUR fictional OT templates, zone diagrams, and labeled checklists under $HOME/cyberlium-lab/t38-ot/ no real-plant attacks, unauthorized OT scans, or exploit cookbooks. Next: Lab Setup.
1. What No Plant Attacks covers (named)
Educational: Modbus/DNP3/OPC UA roles, zone maps, monitoring checklists. Attack: unauthorized OT scanning, PLC manipulation, exploit scripts targeting real plants. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Write three escalation triggers on OT lab. Real OT incident, production PLC change, vendor remote session — escalate to OT engineers and counsel. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Command guide
Try these commands — What No Plant Attacks covers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ICS advisories — https://www.cisa.gov/topics/industrial-control-systems NIST SP 800-82 — https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export OT_LAB=${OT_LAB:-$HOME/cyberlium-lab/t38-ot}
cat > "$OT_LAB/notes/no-plant-attacks.txt" <<'EOF'
SCOPE: YOUR lab folder $HOME/cyberlium-lab/t38-ot/ — fictional LAB-OT-001 diagrams and checklists only
EDUCATIONAL: defensive OT literacy — NOT authorization to test live plants
NEVER: Modbus/PLC exploit cookbooks against real infrastructure
NEVER: unauthorized OT scanning; Stuxnet replication; live HMI/PLC manipulation
ALLOWED: zone maps; asset inventory CSV stubs; CISA doc literacy via curl
ALLOWED: threat history + defense lessons (Stuxnet named); segmentation checklists
LABEL: all artifacts LAB TRAINING — NOT FOR LIVE PLANT OPERATIONS
EOFCommand — copy this
grep -E 'SCOPE|NEVER|ALLOWED|LAB TRAINING' "$OT_LAB/notes/no-plant-attacks.txt"
python3 -c "print('Ethics: OT defensive literacy only — no plant attack cookbooks')"Primary tools to practice this lesson: grep, python3. Reference sites: CISA ICS advisories (https://www.cisa.gov/topics/industrial-control-systems); NIST SP 800-82 (https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why No Plant Attacks matters for defenders
Misrepresenting courseware as pentest authorization creates liability. Defenders escalate to operations and incident response. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Students document ethics cards on notes. Production OT follows MOC and qualified personnel. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
3. $OT_LAB boundary
Forbidden: Stuxnet walkthroughs teaching exploit delivery on live Siemens PLCs. Allowed: ethics card with defensive scope and NEVER list. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Ship: OT ethics card. Next: Lab Setup.
4. What you ship: no plant attacks card for $OT_LAB
No plant attacks means defensive literacy — history and defense for named threats, never exploit recipes. $OT_LAB named. NEVER real-plant attack steps. chmod 600.
5. What you record before the next lesson
Date (UTC). No Plant Attacks card. $OT_LAB named. File t38-m01-l03-no-plant-attacks.txt chmod 600.
6. Wrong vs right: plant attacks vs YOUR OT lab sims
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Share Modbus fuzzing script targeting real RTU IP ranges.
Right
Write no plant attacks card for YOUR $OT_LAB. Next: Lab Setup.
Mission: document No Plant Attacks on YOUR OT lab
1) Name literacy rows on $OT_LAB. 2) Write NEVER list (no real-plant attacks, unauthorized OT scans, or exploit cookbooks). 3) chmod 600. Never scan or exploit real industrial networks.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: literacy on $OT_LAB — not attack recipes against live plants.
Knowledge Check
APPLY: No Plant Attacks on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Topic 38 includes ICS attack cookbooks against real plants.
True or False
Knowledge Check
APPLY: No Plant Attacks literacy on Cyberlium uses:
Multiple choice