aner/roam
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

backup: 2026-10-11 00:08

Browse Source
This commit is contained in:
Aner Zakobar
2026-10-11 00:08:44 +03:00
parent 12328a02fc
commit 828f59d961
14 changed files with 279 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ot-ics-security-rampcurriculum.org
+4 -2
View File
@@ -26,6 +26,8 @@ Hybrid approach, not one-size-fits-all:
Covered so far (full definitions in [[ot-ics-security-ramp/glossary]]): IT-vs-OT / AIC triad; Purdue Model levels 0-5 + Level 3.5 DMZ; ICS protocols (Modbus, DNP3, IEC 61850/GOOSE, IEC 104, OPC-UA); canonical attack case studies (Stuxnet, Ukraine grid/Industroyer, TRITON/SIS, Metcalf sniper attack); OT vendor landscape (Dragos/Claroty/Nozomi "big three" plus Tenable.ot, MS Defender for IoT, Forescout, Armis, vendor-native); 2026 threat landscape from the Dragos Year in Review (KAMACITE/SYLVANITE/BAUXITE, MSP/GIS as supply-chain targets — see [[ot-ics-security-ramp/reading-list]]); NERC CIP compliance (NERC/FERC/BES scope, electric-only vs water/gas, CIP-002/005/007/008/010/013/014); OT/ICS hands-on lab tools (pymodbus, opendnp3, OpenPLC, GRFICS, Conpot, T-Pot, MiniCPS, ScadaBR).
Not yet covered: IR/forensics (queued), general frameworks/compliance beyond NERC CIP (NIST CSF, ISO 27001, SOC 2, CIS Controls, STIX/TAXII), remaining defensive-stack acronyms (EDR/XDR/SIEM/SOAR/NDR/NGFW/IDS/IPS/DLP/ZTNA), cloud security beyond k8s (CSPM/CWPP/CIEM).
** Protocol Deep-Dive Session (2026-10-06)
Completed the priority-redirect protocol session: SNMP (new — manager/agent, MIB/OID, GET/SET/TRAP, v1/v2c plaintext community strings vs. SNMPv3); Modbus (deeper — function codes, four data tables, Modbus Security/TLS retrofit, FrostyGoop case study); DNP3 (deeper — object-based types, unsolicited reporting, DNP3-SA HMAC challenge-response mechanics, Aggressive Mode replay flaw per Cremers et al.); GOOSE (deeper — pub-sub over raw Ethernet L2/multicast MAC, stNum/sqNum and how Industroyer forged them, SCD engineering files, IEC 62351-6, PRP/HSR, process-bus/station-bus segmentation risk); IEC 104 (deeper — ASDU/Information Object typing, port 2404, regional dominance vs. DNP3, IEC 62351-3/5); OPC-UA (deeper — object-oriented address space, X.509/Security Policies, horizontal cross-vendor-interop origin vs. vertical IT/cloud bridging vs. emerging field-level/TSN use). New terms (compensating controls, brownfield/greenfield, MES, etc.) and all new reading resources logged to [[ot-ics-security-ramp/glossary]] and [[ot-ics-security-ramp/reading-list]] as covered, per standing convention. Produced [[ot-ics-security-ramp/protocol-comparison]] as a standalone side-by-side reference across transport, data model, security posture, Purdue level, and known attacks.
** Status
OT/ICS deep-dive in progress. Queued after protocols: IR/forensics, frameworks/compliance, defensive-stack acronyms, cloud security.
Priority redirect (2026-10-06): Aner wants ICS/OT protocols in depth next — SNMP, Modbus, plus deeper coverage of already-introduced protocols (DNP3, IEC 61850/GOOSE, IEC 104, OPC-UA) — ahead of IR/forensics.
Protocol deep-dive session complete (2026-10-06). Next up per original queue: IR/forensics, then frameworks/compliance (NIST CSF, ISO 27001, SOC 2, CIS Controls, STIX/TAXII), remaining defensive-stack acronyms, cloud security beyond k8s.