Defensive cybersecurity for IT and OT, free and complete: security fundamentals, Security+ exam preparation, SOC work with Splunk, cloud security, and ISA/IEC 62443 for plants, PLCs and building systems, with notes, quizzes, projects and an optional verifiable certificate.
The assessment half of OT security, for engineers who have to do it on a plant that is running. Rules of engagement first, then passive capture, careful enumeration, what an attacker does with a protocol that has no authentication, the Windows machines nobody mentions, the logging that would have caught it, and a report written in the language of consequence.
Write rules of engagement with a window, a named owner and an abort condition, for a plant that cannot stop
Draw the zones yourself and test each conduit from the side it is meant to protect
Capture and read ICS traffic in Wireshark, tshark and Zeek before sending a single packet
The ground floor of industrial cyber security, taught through the systems themselves: what a DCS, PLC, SCADA, BACS and safety system actually do, the Purdue model, why OT is not IT, how industrial attacks unfold, defence in depth and a layered architecture, then the seven ISA/IEC 62443 foundational requirements one at a time, asset registers, segmentation, discovery, IDS and IPS, secure remote access, SIEM and endpoint protection.
Tell a DCS, PLC, SCADA, BACS and safety system apart
Place any device on a Purdue level and defend the choice
Explain why an IT security policy cannot be applied to a plant
Free OT security course for automation and IT staff: Purdue zones, ISA/IEC 62443 security levels, risk assessment. The certificate is optional and paid.
Explain OT versus IT security and the threat landscape
Map plants with the Purdue model into zones and conduits
Apply ISA/IEC 62443 parts, roles and security levels
Harden the PLCs you already program: Siemens access levels, know-how, copy and project protection, secure communication and users, Rockwell source protection, CIP Security and zones, and the Top 20 Secure PLC Coding Practices, from the people who wrote them.
Explain how controllers are attacked and which controls break each step
Set Siemens access levels and use the TIA Portal security wizard
Apply know-how, write, copy and project protection
Prepare for CompTIA Security+ SY0-701 with Professor Messer's complete free video course: every exam objective across the five domains, with EDWartens notes, worked calculations, practice questions and an optional security project. Exam preparation only: the EDWartens certificate is not the CompTIA Security+ certification, which is earned only by passing CompTIA's exam.
Classify security controls and explain CIA, AAA and zero trust
Explain PKI, encryption, hashing and digital signatures
Recognise threat actors, vectors, social engineering and attacks
Start in cybersecurity from zero: the eight security domains, the CIA triad, risk and the NIST frameworks, networks and firewalls, Linux and access control, malware, incident response, and how to communicate as an analyst, with honest advice on landing a first job. Built on Google's public Cybersecurity Certificate lessons.
Explain the eight security domains and where an analyst fits
Train for a Level 1 SOC analyst role: what the job is really like, the incident response process, the Windows event IDs you read every shift, Splunk search and SPL, hunting through Boss of the SOC v1, Wireshark traffic analysis, phishing email analysis, and MITRE ATT&CK with free threat intelligence.
Describe the SOC analyst's job, tools, verdicts and metrics
Follow the incident response process and contain without losing evidence
Secure what you run in AWS and Azure: the shared responsibility model, AWS IAM and Microsoft Entra ID with Conditional Access, zero trust, network security groups and private endpoints, encryption and key management, and posture management with Defender for Cloud and Sentinel.
Explain what cloud security covers and how it differs from on-premises
Apply the shared responsibility model to IaaS, PaaS and SaaS
Write least-privilege AWS IAM policies and predict how they are evaluated
Secure the building management systems you design, install or run: real building hacks, BMS network architecture and its weak points, hardening controllers and front ends, secure design with zones and conduits, BACnet Secure Connect, defence in depth for BACnet/IP, secure vendor remote access and zero trust.
Explain how buildings have been hacked and why a BMS can be a way into the business
Describe BMS architecture and find the weak points in BACnet, Modbus and MS/TP networks
Harden controllers, servers and accounts in the building's priorities
How hospitals are attacked and how they recover: WannaCry, AIIMS and Ascension, ransomware and double extortion, the HHS 405(d) practices, phishing aimed at clinical staff, connected medical devices and FDA Section 524B, patient data under data-protection law (India's DPDP Act, with HIPAA and GDPR compared), backups that survive ransomware, and incident response when patients are on the wards.
Explain why hospitals are targeted, using WannaCry, AIIMS and Ascension
Stop the frauds aimed at finance teams: business email compromise, vendor bank-change and invoice fraud, fictitious vendors, the Arup deepfake video call, accounts payable controls that work, scam messages, passwords and MFA, data breach response, and audits, third parties and agreements.
Explain business email compromise and recognise its forms
Verify vendor bank-detail changes independently
Detect invoice fraud and fictitious vendors with simple analytics
Protect a small business without a security team: the owner's role, phishing and payment fraud, passwords and MFA, devices and Wi-Fi, ransomware and backups, customer data under data-protection law, and what to do in the first hours of an incident. Built on public lessons from the FTC, CISA, the FBI and Professor Messer.
Explain why small businesses are attacked and rank the risks to your own
Lead security as an owner: responsibilities, budget and policies
Recognise phishing, scams and business email compromise, and stop fraudulent payments
Free preparation for the ISC2 Certified in Cybersecurity (CC) exam, mapped to the five domains of the outline effective 1 September 2026: security principles, security governance, identity and access management, networking and cloud security, and security operations and incident response, with original practice questions on every domain. Exam preparation only: the EDWartens certificate is not the CC, which is earned only by passing ISC2's exam.
Know the 2026 CC exam format, the five domains and their weights, and how to break down a scenario question
Apply the CIA triad, AAA, MFA, non-repudiation and privacy to real incidents
Score and calculate risk with SLE and ALE, and choose avoid, reduce, transfer or accept
Preparation for ISA's ISA/IEC 62443 Cybersecurity Fundamentals Specialist exam, mapped to the topics ISA lists for its IC32 course: the 62443 series and roles, zones and conduits, FR1 to FR7, security levels, risk assessment, secure products. Free to learn; not the ISA certificate.
Map your study to the fifteen topics ISA lists for its IC32 fundamentals course
Place every 62443 part in its group and match it to the asset owner, service provider or product supplier
Partition a plant into zones and conduits using the reference model and defence in depth
Passive network security monitoring for industrial plants with free tools: where to tap, reading Modbus, S7comm, EtherNet/IP, DNP3 and BACnet in Wireshark, Zeek with the CISA ICSNPP parsers, Suricata rules for OT, Malcolm and Security Onion, asset inventory from traffic, baselines, MITRE ATT&CK for ICS detections and alert triage with plant operations.
Place a passive sensor by Purdue level and size a SPAN port, or choose a TAP
Read Modbus/TCP, S7comm, EtherNet/IP, DNP3 and BACnet traffic in Wireshark and spot writes and program transfers
Run Zeek with CISA's ICSNPP parsers and answer operational questions from its logs
Level 2 SOC skills in a free, open source lab: build a Wazuh 4.14 server, enrol Windows and Linux agents with Sysmon, write and tune detection rules, map them to MITRE ATT&CK, hunt persistence, credential access and lateral movement, handle incidents with NIST SP 800-61 Rev. 3, and measure your detections against an Atomic Red Team simulation in an isolated lab.
Know what Level 2 SOC work adds to Level 1 triage, and build a safe, isolated hunting lab
Install Wazuh 4.14, enrol Windows and Linux agents and troubleshoot them
Configure and tune Sysmon for the events hunters rely on
Preparation for Microsoft's SC-200 Security Operations Analyst exam, mapped to the skills measured as of 21 October 2026: KQL from first query to hunting, Microsoft Defender XDR incidents and attack disruption, Defender for Endpoint, Office 365, Identity and Cloud Apps, Purview investigations, Microsoft Sentinel setup, data connectors, analytics rules, automation, Security Copilot and threat hunting.
Plan SC-200 study against the three skill areas and weights Microsoft publishes
Write KQL that filters by time, aggregates, joins tables and unpacks JSON for investigations
Work incidents in the Microsoft Defender portal and explain automatic attack disruption
Build an information security management system to ISO/IEC 27001:2022, step by step: context, interested parties and scope, leadership and policy, risk assessment and risk treatment, the Statement of Applicability, the 93 Annex A controls in four themes, documented information and evidence, supplier, cloud, incident and continuity controls, internal audit and management review, corrective action, the stage 1 and stage 2 certification audits, and how the ISMS maps to GDPR, NIS2, SOC 2 and NIST CSF 2.0.
Plan an ISO 27001:2022 implementation with a gap analysis and a phased roadmap
Write the context, interested parties and a credible ISMS scope, including the 2024 climate amendment
Set risk criteria, run a risk assessment and calculate risk levels against an acceptance threshold
The security course for people who have already built something with an LLM: the attack surface a model adds, all ten 2026 OWASP LLM risks one at a time, indirect injection and zero-click agent attacks, what leaks out through a chatbot, securing agents with identity and least privilege, the OWASP MCP and agentic guidance, red-teaming with MITRE ATLAS, and the NIST-based governance a plant or a GCC can actually enforce.
Draw an AI feature as its parts and mark where an outsider's text can enter
Name all ten 2026 OWASP LLM risks and sort a real incident into the right one
Trace an indirect injection from a poisoned document to an executed action
No. It is defence: architecture, standards, detection, risk and response.
Where should I start?
Cybersecurity Fundamentals if you are new to the field. Engineers who work with PLCs, SCADA or building systems can go straight to the OT courses, which are written for them.
Is OT cybersecurity a job for network engineers or automation engineers?
Both, and the shortage is on the automation side: people who know what a PLC does and can read IEC 62443.
We use essential cookies to run the site and keep you signed in. With your permission we also use analytics cookies to see how the site is used. See the cookie policy.
Free
