OT-ICS-Security-Notes

🏭 OT/ICS Security Notes

👤 About This Repository

This repository is a practitioner-level knowledge base for OT/ICS cybersecurity, compiled by Adarsh Singh — a DevSecOps Engineer with hands-on Information Security internship experience inside a chemical manufacturing plant (Aarti Industries Ltd.), working directly with:

• Siemens S7-300/400 PLCs and TIA Portal
• Wonderware SCADA (InTouch/System Platform)
• Modbus TCP/RTU and OPC Classic/UA protocol traffic
• Purdue Model-segmented plant network architecture
• IT/OT convergence challenges in a live production environment

⚠️ All content is derived from learning, research, and sanitized observations. No proprietary or classified information is included.

📁 Repository Structure

OT-ICS-Security-Notes/
├── 01-Fundamentals/              # IT vs OT, key concepts, terminology
├── 02-Protocols/                 # Modbus, OPC, DNP3, PROFINET, EtherNet/IP
├── 03-Architecture/              # Purdue Model, DMZ design, network segmentation
├── 04-Threats-and-Attacks/       # Threat landscape, malware, attack vectors
├── 05-Security-Controls/         # Compensating controls, hardening, patching
├── 06-Standards-and-Frameworks/  # IEC 62443, NERC CIP, NIST SP 800-82
├── 07-Tools-and-Techniques/      # Passive monitoring, asset discovery, Wireshark
├── 08-Incident-Response/         # ICS-specific IR playbooks
├── 09-Case-Studies/              # Stuxnet, TRITON, Ukraine Power Grid, Colonial
├── 10-Certification-Prep/        # GICSP, CSSA, CompTIA CySA+ OT track
└── assets/                       # Diagrams, cheat sheets

🗺️ Quick Navigation

🎯 Who This Is For

• 🎓 Students preparing for GICSP, GRID, or CompTIA CySA+
• 🔵 Blue teamers moving into OT SOC / ICS monitoring roles
• 🏭 IT security professionals transitioning to OT environments
• 📋 Interview candidates for Claroty, Dragos, Siemens, Honeywell, Schneider Electric roles
• 🔍 Security researchers building OT threat intelligence

⭐ Key Differentiators

• Real-world context from a live chemical plant (not just theory)
• Protocol analysis with actual Modbus/OPC traffic patterns
• MITRE ATT&CK for ICS mapped to each threat
• Interview-ready Q&A sections in every module
• Continuously updated with CVEs and threat intel

🔗 Connect

📜 Disclaimer

This repository is for educational purposes only. All information is sourced from public research, vendor documentation, and sanitized learning experiences. No proprietary, confidential, or classified data is included.