Guides

OT / ICS Cybersecurity Monitoring Lab (Safe Education)

By Ravindra Bagale, Cyber Security trainer · LinkedIn · Published: 29 September 2026 · Last updated: 30 September 2026

OT / ICS cybersecurity monitoring means watching industrial and plant-adjacent systems for unsafe change and odd network behaviour — with safety first. This educational lab guide covers segmentation awareness, allow-listed flows, jump hosts, logging and alerts on simulated / owned lab gear only. It does not teach sabotage, process manipulation, unsafe PLC writes, or attacks against real water, power, factory or hospital equipment.

IT zone | DMZ/jump (MFA, logged) | OT lab zone
Monitor allow-listed flows; never experiment on real plant
Safety > clever demos

What do I need before this guide?

• Segmentation ideas: Firewall beginner, Zero Trust.
• Monitoring: SIEM.
• Course OT chapter awareness (linked below).
• Hypervisor for an isolated simulated lab — host-only networking.

What does OT monitoring look like for learners?

Concepts without dangerous detail

1. IT vs OT — email laptops vs controllers that move physical processes.
2. Zones and conduits — traffic should follow designed paths; surprise peer-to-peer is a smell.
3. Engineering workstations — high value; patch carefully; no casual internet browsing on them.
4. Protocols — Modbus / DNP3 / MQTT appear in courses at awareness level; monitoring cares about who talks to whom, not exploit framing.
5. Change detection — unexpected logic downloads or new firmware in a sim deserve tickets.
6. Remote access — VPN + MFA + jump host; no naked HMI on the public internet.

Educational / legal warning: Scanning or manipulating real industrial controllers, water systems, building BMS you do not own, or “Shodan practice” against live infrastructure is out of scope and unacceptable here. No denial-of-service against plant networks. No instructions to alter setpoints safely or unsafely.

Real incident: Oldsmar water treatment (2021) — remote access lesson

Public reporting on the Oldsmar, Florida water treatment remote-access incident (2021) described an unauthorised attempt to change chemical dosing via remote software, noticed by an operator. Regardless of final attribution details, defender takeaways were crystal clear: expose less remote access, require strong authentication, monitor operator sessions, and keep humans in the loop for dangerous setpoints.

Takeaways (vertical):

1. What happened — remote path into a control UI with potential chemical impact.
2. What went wrong (theme) — remote access and monitoring posture insufficient for safety-critical change.
3. Care-take — MFA and allow-listed admin paths; remove shared remote tools where possible.
4. Care-take — operator visibility and alerting on setpoint / session anomalies.
5. Care-take — network segmentation so office IT malware struggles to reach controllers.
6. Bonus parallel — Colonial Pipeline (2021) showed IT disruption can halt OT-dependent operations even without “PLC hacking” drama — backups, IR and dependency maps matter.

Safe lab architecture (simulation)

1. Host-only network: IT-sim VM, jump VM, OT-sim VM (fake HMI / Mosquitto / course appliances).
2. Firewall rules between them documented in a spreadsheet.
3. MFA on jump (even lab IdP or simple second factor practice).
4. SIEM or log collector receives firewall denies + auth logs.
5. Snapshot everything before experiments.
6. Fictional Raja Rani Traders cold-storage PLC sim in Pune lab — temperature HMI is a web UI mock, not a real compressor controller.

Red Team vs Blue Team (awareness only)

Red Team — what attackers try

• Phish OT engineers’ IT credentials, then pivot (high-level).
• Find exposed remote desktop / vendor connections.
• Ransomware on Windows engineering hosts (availability hit).

Blue Team — defend, detect, respond

• Inventory + segmentation diagrams owned by engineering + IT security together.
• Alert: new host talking Modbus/MQTT-style ports in the lab range.
• Alert: jump host login outside shift hours (tune for real ops).
• Patch jump and engineering hosts; USB / bring-your-own media policy.
• Safety authority can halt cyber tests immediately — write that power down.

How do I run a monitoring lab step by step?

Step 1 — Paper before packets

1. Draw IT / DMZ / OT boxes.
2. List allowed flows (jump → HMI sim on port X only).
3. Write a “stop test if…” safety line (even in sim: “if host CPU/network saturates unexpectedly, pause”).

Step 2 — Build isolated VMs

1. No bridged NIC onto home IoT or office LAN.
2. Install a log forwarder on jump + OT-sim.
3. Generate a benign denied connection inside the lab and prove an alert.

Step 3 — Detection starter pack

1. New MAC / IP in OT VLAN (lab DHCP logs).
2. Auth failure bursts on jump.
3. Unexpected outbound internet attempt from OT-sim (should be none).
4. Config-change ticket missing for an engineering login (process control).

Step 4 — Tabletop (no plant harm)

1. Scenario: ransomware on engineering workstation sim.
2. Decisions: isolate jump? keep plant running on local panels? who calls whom?
3. Document IST timeline of the exercise.

Step 5 — What you will not do

1. No internet-wide ICS banner grabs for a portfolio.
2. No “safe” setpoint change tutorials for real controllers.
3. No sharing lab VPNs with strangers.

Availability is a safety control

1. Patch windows need operations agreement — surprise reboot of a controller sim is a bad habit to carry to work.
2. Monitoring sensors should fail closed toward alerting humans, not toward silent blind spots.
3. Document how the plant runs in “cyber degraded mode” (local panels) before an exercise.

Care-take — organisation habits

1. Joint IT/OT change board for anything touching conduits.
2. Vendor remote access time-boxed and logged.
3. Immutable network diagrams next to runbooks.
4. Backup of engineering configs offline.
5. Incident roles: cyber lead ≠ safety lead; both required on call list.
6. Purple tests only on sims or scheduled windows with operations sign-off.
7. Map IT dependencies (billing VPN, domain DNS) that can halt OT shipping even without touching PLCs — Colonial Pipeline-style business halt lessons.
8. Keep emergency contacts for cyber, operations and safety on one laminated card in the control room (and a digital copy).

How do I fix common OT cyber lab mistakes?

Ghabru naka 😅 — these are the usual ones: