Skip to content
EDWartens UK

Free course · Cybersecurity

OT Security Assessment: Testing a Plant Without Stopping It

The assessment half of OT security, for engineers who have to do it on a plant that is running. Rules of engagement first, then passive capture, careful enumeration, what an attacker does with a protocol that has no authentication, the Windows machines nobody mentions, the logging that would have caught it, and a report written in the language of consequence.

See the modules

Free to learn. Verifiable certificate £19 when you pass the final exam (optional, VAT included).

Level
Intermediate
Modules
12
Video
15 hours
Price
Free

Outcome

What you will be able to do

Write rules of engagement for assessing a system that cannot be stopped; draw and test the zone boundaries that are supposed to exist; capture and read ICS traffic before sending any; enumerate a Modbus endpoint knowing the cost of every request; explain a man-in-the-middle and a forever-day vulnerability and choose compensating controls for a device that will never be patched; assess the engineering workstation and the service accounts on it; leave behind logging and an integrity baseline; decide whether deception is worth its operational cost; review PLC code against the Top 20 Secure PLC Coding Practices; and write a two-page report ordered by consequence that says what you did not test and why.

  • Write rules of engagement with a window, a named owner and an abort condition, for a plant that cannot stop
  • Draw the zones yourself and test each conduit from the side it is meant to protect
  • Capture and read ICS traffic in Wireshark, tshark and Zeek before sending a single packet
  • Enumerate a Modbus device knowing what every request will do, and say when it is not worth the risk
  • Explain a Modbus man-in-the-middle and choose compensating controls for a device nobody will ever patch
  • Map findings to ATT&CK for ICS honestly, and read a real incident as a chain of techniques
  • Assess an engineering workstation: local accounts, services, shares and who can reach it
  • Leave behind Windows logging and an integrity baseline on a host that must never be rebooted
  • Review PLC code against the Top 20 Secure PLC Coding Practices and raise a finding engineering will accept
  • Write the two-page report: scope, method, findings by consequence, and what you deliberately did not test

Software

Wireshark, a Linux virtual machine, a Modbus simulator or a lab PLC, and CHAPS. All free downloads. Nothing in this course requires a licence or a paid lab.

Hardware

None required. A spare PLC or a Raspberry Pi running a Modbus simulator makes the enumeration and capture work more real, and every exercise is written to work without one.

Syllabus

12 modules

Each module has video lessons, notes and a short quiz. The final exam closes the course.

  1. 1Rules of Engagement: Assessing a Plant That Is Running1 lesson
  2. 2Field Rules and the Ground You Are Assessing: Architecture and Segmentation3 lessonsLab
  3. 3Reading the Traffic Before You Send Any2 lessons
  4. 4Enumeration, Carefully2 lessons
  5. 5What the Attacker Does Next2 lessonsLab
  6. 6Naming What You Found: ATT&CK for ICS2 lessons
  7. 7The Windows Machines Nobody Mentions2 lessons
  8. 8Seeing It Happen: Windows Logging and Integrity Baselines2 lessons
  9. 9Deception and Hunting2 lessons
  10. 10Assessing the Logic Itself1 lesson
  11. 11The Report, and the Assessment You Can Repeat2 lessons
  12. 12Final Assessment1 lesson

How it works

How this course works

  1. Watch the video lessonsOne module at a time, at your own pace.
  2. Take the module quizA short quiz at the end of each module shows what stuck.
  3. Keep your notesWrite in My notes beside each module and ask the trainer if you are stuck.
  4. Practise in the labOptionalTry a task from the module in the EDWartens Lab, in your browser.
  5. Sit the final examPass it once you have been through the modules.
  6. Certificate, if you want oneOptionalPaid, and only after you pass. Anyone can check it online.

EDWartens Lab

Practise this in the EDWartens Lab

Map a plant network, find the odd device and set deny-by-default firewall rules in the Lab's OT security simulator.

Works alongside OT Security Assessment: Testing a Plant Without Stopping It. The Lab is ot security practice in your browser: no install, no hardware, free to use. Sign in as a learner and it opens with your account.

Open the free lab See the Lab
OT security: Defend a plant network.

Levels to try with this course

Optional. Skip it whenever you like: it never blocks your progress or your certificate.

Why practise in a lab

Technical work is judged on what you can do: wiring, commissioning, finding a fault. Doing a task yourself teaches more than watching it a second time, and a lab lets you try it safely before you meet real equipment. It does not replace working on real hardware.

  • Practise safely, so a mistake costs nothing.
  • The lab checks your work like a site test, so you know when it is right.
  • Free, in your browser, with nothing to install.

Certificate

An optional certificate when you pass

Learning is free. Pass the final exam and you can have a certificate for £19, including VAT, with a number employers can check online. It records that you completed a free online course; it is not a regulated qualification or a CPD certificate.

  • Your name, the course, its study time and your final exam score
  • A unique certificate number and a QR code to its verification page
  • Issued by Wartens Ltd; add it to your LinkedIn profile in one click
  • Pay now or after you pass: it is issued the moment you pass the final

How the certificate works

Sample certificate for OT Security Assessment: Testing a Plant Without Stopping It

Credits

Who made the lessons

The video lessons belong to their creators. EDWartens wrote the study plan, notes, quizzes and the final exam.

  • SANS ICS Security

    the entire ICS Concepts series that this course is built from: attacker methodology, field practice, network architecture, Modbus traffic analysis, enumeration and man-in-the-middle, Zeek, ATT&CK Navigator, Windows hardening and logging, integrity baselining, honeypots, the Top 20 Secure PLC Coding Practices, CHAPS and cyber informed engineering

Questions

About this course

Is this a hacking course?
No. It is an assessment course, and the difference matters on a plant. It teaches you to evaluate systems you are authorised to evaluate, for the people who own them, and the first module is entirely about the permission, the window and the condition under which you stop. There is no exploit development here and nothing is aimed at systems you do not own. Where the course covers what an attacker does, such as a Modbus man-in-the-middle, it does so because you cannot defend or assess a protocol whose weaknesses you have not seen.
How is it different from the OT and ICS Cybersecurity course?
That course is the standards and programme side: ISA/IEC 62443 clause by clause, security levels, risk assessment, governance. It is forty-four hours. This one is the practical assessment: what you actually do in the four days you are on site, in the order that keeps the plant running. They complement each other and neither repeats the other. If you have done neither, ICS Security Foundations is the five-hour place to start.
Do I need a lab, or a real PLC?
No. Every exercise is written to work with a free Modbus simulator on a laptop and a Linux virtual machine. A spare PLC or a Raspberry Pi running a simulator makes the capture and enumeration work feel real, and several people find that worth the effort, but nothing in the course assumes you have one.
Do I need penetration testing experience?
No, and the course is deliberately not written for penetration testers moving into OT. It is written for automation engineers who already understand plants and are being asked to assess them, which is the more common situation on real plants and the one that is worse served.
Is this a SANS course, or does it lead to a GIAC certification?
No. Every video lesson is from the SANS ICS Security channel's free ICS Concepts series, credited on each module, and SANS is not affiliated with EDWartens. SANS run their own paid courses and GIAC issue their own certifications; this course is neither and does not count towards either. What EDWartens wrote is the study plan, the objectives, the practice tasks, the notes and the assessments.
What will I have at the end?
A two-page assessment report on a system you chose, with scope, method, findings ordered by consequence, and a section naming what you deliberately did not test. That report is the deliverable of the course and is the thing worth showing an employer, more than the certificate is.
Is the course really free?
Yes. Every module, every practice task and the final assessment. You create an account so your progress is saved and the assessment can be marked. The only paid item is the certificate, and only if you decide you want it.
What certificate do I get?
An EDWartens Certificate of Completion, issued when you have worked through every module and passed the final assessment, with a unique number anyone can verify on our site. It is not a vendor or industry credential and we will never describe it as one.

The Professional Module is five live days of Siemens PLC, HMI and SCADA with an instructor, then a resume session and a CPD certificate.

See the Professional Module