Assess OT/ICS security in industrial control networks

This skill assesses industrial control (OT/ICS/SCADA/DCS) networks under authorization. It maps zoning against the Purdue model (levels 0 through 5) and cross-zone channels, inventories assets such as PLCs, RTUs, HMIs, engineering stations, historians, and jump hosts, documents exposure of protocols like Modbus, DNP3, S7, and EtherNet/IP, and reviews IT/OT convergence boundaries such as firewall rules and unidirectional gateways.

Use it for a passive assessment of industrial networks within an approved scope, or to document PLC/SCADA exposure and zoning violations. Without explicit permission, it must never write coils or registers to a PLC, run a high-rate scan across a production OT network, or touch anything tied to a Safety Instrumented System. The default posture is read-only identification, traffic mirroring, and offline firmware or configuration analysis; any limited active step is low-rate, prefers read-only function codes, is staged inside a maintenance window, and stops immediately if anything anomalous appears. Every step is expected to record its own evidence and note the authorized boundary it stayed within, since an OT finding is judged partly on whether it avoided writing to a control loop at all.

Input is mirrored or SPAN traffic captured as PCAP, offline engineering-file exports (such as TIA or RSLogix project files), and, for the limited active phase, explicitly authorized network segments. Output is a Purdue-zone asset inventory with a protocol and port baseline, passive findings such as default passwords or plaintext protocols like unauthenticated Modbus (recorded, never written to any device), controller firmware versions mapped to known CVEs without blind-flashing, and findings that note physical or process impact where relevant.

Wireshark with industrial protocol dissectors parses mirrored traffic; Nmap NSE performs limited, rate- and time-window-constrained identification; commercial platforms such as Claroty or Nozomi support asset discovery; PLC vendor engineering software audits configuration offline; binwalk or Ghidra analyze firmware images offline, handing deeper work to the firmware-pentest skill.

OT/ICS security assessors working within an approved, safety-conscious scope who need a zoning-first, passive-by-default methodology rather than a general IT vulnerability-scanning approach that risks destabilizing a live control process or its underlying physical equipment.