OT Security Assessment: Testing a Plant Without Stopping It

No. It is an assessment course, and the difference matters on a plant. It teaches you to evaluate systems you are authorised to evaluate, for the people who own them. The first module is entirely about the permission, the window and the condition under which you stop. There is no exploit development here, and nothing is aimed at systems you do not own. The course covers what an attacker does, such as a Modbus man-in-the-middle, because you cannot assess a weakness you have not seen.

That course is the standards and programme side: ISA/IEC 62443 clause by clause, security levels, risk assessment and governance. It is forty-four hours. This one is the practical assessment: what you actually do in the four days you are on site, in the order that keeps the plant running. They complement each other and neither repeats the other. If you have done neither, ICS Security Foundations is the five-hour place to start.

No. Every exercise is written to work with a free Modbus simulator on a laptop and a Linux virtual machine. A spare PLC or a Raspberry Pi running a simulator makes the capture and enumeration work feel real. Several people find that worth the effort. Nothing in the course assumes you have one.

No. The course is deliberately not written for penetration testers moving into OT. It is written for automation engineers who already understand plants and are being asked to assess them. That is the more common situation on real plants, and the one that is worse served.

No. Every video lesson is from the SANS ICS Security channel's free ICS Concepts series, credited on each module. SANS is not affiliated with EDWartens. SANS run their own paid courses and GIAC issue their own certifications. This course is neither and does not count towards either. What EDWartens wrote is the study plan, the objectives, the practice tasks, the notes and the assessments.

A two-page assessment report on a system you chose. It has the scope, the method, findings ordered by consequence, and a section naming what you deliberately did not test. That report is the deliverable of the course. It is worth showing an employer more than the certificate is.

Yes. Every module, every practice task and the final assessment. You create an account so your progress is saved and the assessment can be marked. The only paid item is the certificate, and only if you decide you want it.

An EDWartens Certificate of Completion, issued when you have worked through every module and passed the final assessment, with a unique number anyone can verify on our site. It is not a vendor or industry credential and we will never describe it as one.

No. The lab is optional practice. You can skip it whenever you like, and it never blocks your progress, the final assessment or your certificate.

Yes. Every lab level for this course opens in your browser, free, with nothing to install.

The OT Security Assessment course has 12 modules. It opens with "Rules of Engagement: Assessing a Plant That Is Running", goes through "Field Rules and the Ground You Are Assessing: Architecture and Segmentation", "What the Attacker Does Next", "Seeing It Happen: Windows Logging and Integrity Baselines" and "The Report, and the Assessment You Can Repeat" and ends with "Final Assessment". The full list with minutes is under "What you learn" on this page.

After the OT Security Assessment course: Write rules of engagement with a window, a named owner and an abort condition, for a plant that cannot stop; Draw the zones yourself and test each conduit from the side it is meant to protect; Capture and read ICS traffic in Wireshark, tshark and Zeek before sending a single packet. These are the practical outcomes the course is written around, and the final assessment of 15 questions checks them.

For the OT Security Assessment course, software: Wireshark, a Linux virtual machine, a Modbus simulator or a lab PLC, and CHAPS. All free downloads. Nothing in this course requires a licence or a paid lab. Hardware: none required. A spare PLC or a Raspberry Pi running a Modbus simulator makes the enumeration and capture work more real, and every exercise is written to work without one. The course itself is free.

OT Security Assessment is rated intermediate. Intermediate. You should already know what a PLC, an HMI and a SCADA system are, and how they sit on a network. ICS Security Foundations covers that in five hours if you do not. No penetration testing background is assumed. It is written for automation, OT and IT engineers responsible for security, and takes about 14.5 hours at your own pace.

Skills from the OT Security Assessment course (for example: write rules of engagement with a window, a named owner and an abort condition, for a plant that cannot stop) are used in roles such as OT security analyst, security engineer, network engineer and compliance analyst, and in OT security engineer work. The course gives you practical evidence of the skill; it does not promise a job, and employers decide on experience and interview.