ICS/SCADA › Module 6 › Lesson 4
Lab — Segmentation
Merge zones/conduits, firewall rules, and remote access hygiene sections on YOUR $OT_LAB — defensive OT literacy only; no real-plant attacks, unauthorized OT scans, or exploit cookbooks.
Visual · t38_segmentation_lab
Segmentation Lab literacy. $OT_LAB only. Original Cyberlium.
Opening
Segmentation pack merges zone diagram, firewall documentation, and remote access hygiene — paperwork before monitoring module.
Lessons 6-1–6-3 named zones, firewall documentation, and remote access hygiene. Merge into one OT lab segmentation artifact with diagram stub and checklist rows. Cyberlium Topic 38 practices on $OT_LAB — YOUR fictional OT templates, zone diagrams, and labeled checklists under $HOME/cyberlium-lab/t38-ot/ no real-plant attacks, unauthorized OT scans, or exploit cookbooks. Next: Quiz — Segmentation Defense.
1. What Segmentation Lab covers (named)
Create t38-m06-l04-segmentation-lab.txt merging M6 sections. Include ASCII zone diagram and two documented conduit rule rows. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Link remote access hygiene to vendor conduit in diagram. Fictional LAB-OT-001 only. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Command guide
Try these commands — What Segmentation Lab covers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ICS recommended practices — https://www.cisa.gov/resources-tools/resources/ics-recommended-practices IEC 62443 — https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export OT_LAB=${OT_LAB:-$HOME/cyberlium-lab/t38-ot}
cat > "$OT_LAB/notes/segmentation-lab-summary.md" <<'EOF'
# Segmentation Lab Summary
- zone-map-stub.txt + firewall-rules-stub.csv + remote-access-hygiene.md
## Refusals
- No live firewall edits; fictional LAB-OT-001 diagrams only
EOFCommand — copy this
grep -E 'Segmentation|Refusals|zone-map' "$OT_LAB/notes/segmentation-lab-summary.md" curl -sS https://www.cisa.gov/resources-tools/resources/ics-recommended-practices | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: CISA ICS recommended practices (https://www.cisa.gov/resources-tools/resources/ics-recommended-practices); IEC 62443 (https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why Segmentation Lab matters for defenders
Grep for live firewall exports, real VPN creds, bypass steps — redact. Defensive documentation only. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Cross-reference M4 protocol risks on conduit allowlists. Thread continuity. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
3. $OT_LAB boundary
chmod 600 — quiz next, then OT Visibility. Segmentation feeds monitoring in M7. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Ship: segmentation pack. Next: Quiz — Segmentation Defense.
4. What you ship: segmentation lab card for $OT_LAB
Merge zones/conduits, firewall rules, and remote access hygiene sections. $OT_LAB named. NEVER real-plant attack steps. chmod 600.
5. What you record before the next lesson
Date (UTC). Segmentation Lab card. $OT_LAB named. File t38-m06-l04-segmentation-lab.txt chmod 600.
6. Wrong vs right: plant attacks vs YOUR OT lab sims
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import employer OT firewall config without authorization.
Right
Write segmentation lab card for YOUR $OT_LAB. Next: Quiz — Segmentation Defense.
Mission: document Segmentation Lab on YOUR OT lab
1) Name literacy rows on $OT_LAB. 2) Write NEVER list (no real-plant attacks, unauthorized OT scans, or exploit cookbooks). 3) chmod 600. Never scan or exploit real industrial networks.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: literacy on $OT_LAB — not attack recipes against live plants.
Knowledge Check
APPLY: Segmentation Lab on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Topic 38 includes ICS attack cookbooks against real plants.
True or False
Knowledge Check
APPLY: Segmentation Lab literacy on Cyberlium uses:
Multiple choice