Control, attack, defend: how to train an OT defender
The best OT security engineers learn the job twice, as control engineers and as defenders.
The best OT security engineers I know learned the job twice: once as control engineers and once as defenders. Most organizations cannot wait for that to happen by itself. They need training that turns an IT security analyst into someone who understands ladder logic, or a control technician into someone who recognizes an attack.
I wrote an ICS security course that has been taught in Singapore in a three-week version, and that was adapted in Japan to a two-week version taught to DNP, which then trained 84 cyber police officers from every prefecture. That experience gave me a clear view of what works. The structure that has held up best is a sequence of three phases.
Phase 1: control first
Trainees who do not understand the process cannot defend it. The first phase covers ICS architecture and components (PLCs, RTUs, DCS, SCADA, HMI, historians, safety systems) and the I/O and sensor networks underneath them. Trainees work hands-on with controllers from several major vendors and their engineering environments. They compare ladder logic across platforms, locate PLCs on a LAN with ARP and port scanning, and read and force memory registers with a Modbus tool. They capture and parse Modbus TCP and EtherNet/IP traffic in Wireshark, install and configure an OPC server, and build an HMI operator console.
If a trainee has never forced a register on a live controller in a lab, they will not appreciate how little stands between a compromised workstation and the process.
Phase 2: attack
The second phase teaches the common attacks an adversary would use against a victim's control network: protocol abuse, interception of unprotected communications and remote-access links, HMI and OPC manipulation, historian vulnerabilities, and attacks that start in the corporate IT network. A key learning objective is to watch the physical behavior of a control system under attack, not just the packets. A valve that opens at the wrong moment teaches more than a packet capture.
Phase 3: defend
The third phase covers industrial firewalls, IDS and SIEM in an OT context, physical protection of PLCs, HMIs and historians, security policies and standards such as IEC 62443 and NIST SP 800-82, and a structured incident response plan. The one-week format ends with a capstone: each trainee designs and builds a conceptual SCADA network on a training kit, with a security architecture they must then defend.
Labs, ranges and simulation
Physical lab kits are irreplaceable for the feel of a real controller, but they do not scale to a whole plant. A simulation and training platform, often called an OT cyber range, virtualizes the organization's own environment, with its network devices, PLCs, RTUs and SCADA HMIs. It adds three things. Teams can test attack scenarios and run risk assessments without touching production. They can test patches safely before applying them to the plant. And they get realistic material for incident-response drills. For operators that cannot afford a minute of downtime, that last point is often the business case.
Train the trainers
One more lesson matters more than the rest. In Singapore the course is still taught three weeks at a time. In Japan, the DNP instructors we trained went on to teach the police cyber units themselves. That is the outcome to aim for, because it is the only way the skills scale beyond the first class.
If you are planning OT security training for your own team, the ICS security course describes the programme in more detail, and a first call is free.
Next in this series: what AI changes in the curriculum, and why regulators now expect AI literacy too.