Foundation
Discover the factory
Turn a small industrial traffic sample into an asset and communication inventory.
Asset inventory · ~25 MIN DISCUSSIONRead guide ↗
Industrial cybersecurity, in practice
Defend the
factory floor.
Build the judgment industrial defense demands. Explore OT security labs, test segmentation policies, investigate synthetic industrial traffic, and practice response decisions that account for production.
Created by Abdul Khadir MahamedOT Cybersecurity ArchitectSIMULATED ENVIRONMENTS · PRACTICAL DECISIONS · EXPLAINED RESULTS
● ISOLATED SIMULATIONPROCESS-AWARE DEFENSE
EXPLORE THE INDUSTRIAL STACKMODBUS TCPOPC UAEtherNet/IPMQTTZONES & CONDUITS
Your hands-on workspace
Practical labs. Operational context.
Start with the evidence. Make a decision. Understand the operational tradeoffs.
09GUIDED SCENARIOS
08BROWSER EXERCISES & SIMULATORS
0 / 9STUDIED IN THIS BROWSER
0 / 9 knowledge checks passed
Saved in this browser · learning progress, not certificationIntermediate
Segment without stopping the line
Make four access decisions and test whether your policy preserves required operations.
Zones & conduits · ~30 MIN DISCUSSIONRead guide ↗
Intermediate
Secure the vendor session
Define an approved maintenance route with scoped access and an explicit expiry.
Remote access · ~25 MIN DISCUSSIONRead guide ↗
Intermediate
Investigate an unexpected PLC write
Compare a write event with the maintenance record before escalating an incident.
Modbus TCP · ~35 MIN DISCUSSIONRead guide ↗
Advanced
Review an OPC UA trust change
Investigate a new application certificate and separate trust from authorization.
OPC UA · ~35 MIN DISCUSSIONRead guide ↗
Advanced
Contain the engineering workstation
Choose containment actions while accounting for engineering and process dependencies.
Incident response · ~40 MIN DISCUSSIONRead guide ↗
Intermediate
Prioritize a controller vulnerability
Turn an advisory into a remediation decision that considers exposure and downtime.
Risk assessment · ~25 MIN DISCUSSIONRead guide ↗
Intermediate
Restore the packaging cell
Build a restoration sequence with verified projects and operational acceptance gates.
Recovery planning · ~35 MIN DISCUSSIONRead guide ↗
Foundation
Protect the MQTT telemetry path
Review topic access and identity boundaries between an industrial gateway and broker.
MQTT · ~20 MIN DISCUSSIONRead guide ↗
Interactive architecture studio
Segment without
stopping the line.
A vendor needs to service a packaging cell. Keep the required process traffic running while restricting unnecessary access.
POLICY BRIEF
Allow the HMI to read the PLC over Modbus TCP. Allow the approved jump host to reach the engineering workstation over RDP. Block direct vendor access to the PLC and block PLC internet access.
Browser policy simulation · no network connectionsSet a decision for every flow, then validate your design.
Interactive detection lab
Find the write that does not belong.
Test a structured rule against a fixed synthetic event set. See exactly why an event matches.
DETECTION RULE / JSON
Supported fields: function_code (number), approved_maintenance (boolean), source (string). Every field must match. Empty rules and unknown fields are rejected.
Ready. Run the sample rule to inspect the results.
SYNTHETIC EVENTS / SAME SITE CLOCK
Function 3 = read holding registers. Function 16 = write multiple holding registers. Maintenance approval is supplied scenario context, not a protocol field.
Take the evidence with you
Inspect the packets. Check the context.
Download four synthetic Modbus request packets for offline Wireshark analysis, plus matching JSON and CSV event records. The capture is a teaching sample, not a full TCP session or a recording from a real plant.
Timestamps: 3 November 2026, UTC. Maintenance approval is external context in the event records and is not encoded in Modbus packets. Inspect offline; do not replay against production systems.
Connected case study / packaging line 01
From an alert to a defensible decision.
09:10 · UNEXPECTED WRITE→ ENGINEERING REVIEW→ CONTAINMENT DECISION
The line is running. A write came from an engineering workstation outside the approved maintenance window. Operations has not reported an abnormal process condition. Choose a response, explain your reasoning, and export your case notes.
Choose your initial response
Select an action to examine its tradeoffs. This is a scenario discussion, not an automated containment recommendation.
If imminent unsafe behavior is suspected, follow the site's emergency and safety procedures. The right operational action depends on facts this simplified case cannot model.
Your case workbook
Use synthetic case details only. Notes are saved in this browser and are included in your export.
Build your capability
Develop the evidence. Defend the decision.
01 / UNDERSTAND
See the environment
Start with asset discovery, industrial communications, and the evidence needed to understand normal operations.
02 / PROTECT
Engineer the boundaries
Work through zones, conduits, vendor access, identities, and the operational tradeoffs behind security decisions.
03 / RESPOND
Investigate and recover
Separate authorized maintenance from suspicious activity and plan containment and restoration around the process.
Continue your research
Read the source. Understand the context.
External references for deeper study. Exercises are independent educational content; these organizations do not endorse this project.
NIST SP 800-82
OT security guidance for understanding system characteristics and security considerations.
Read NIST guidance ↗MITRE ATT&CK for ICS
Explore adversary behaviors relevant to industrial control systems.
Explore the ICS matrix ↗CISA industrial security
Find industrial control systems resources and security advisories.
Explore CISA resources ↗Before you begin
Know your training environment.
What actually runs in this edition?
Nine guided exercises use synthetic evidence, tasks, and explanatory debriefs. The practitioner workbench adds five detailed workspaces: evidence investigation, ordered segmentation rules, detection evaluation, vendor-access policy, and risk/recovery decisions. The segmentation simulator evaluates four access decisions. The detection simulator filters a fixed synthetic event set using a small JSON rule. The response simulator explains the consequences of three containment choices. A downloadable packet capture contains four standalone synthetic Modbus requests for offline inspection. All exercise logic runs in your browser. The workbench compares decisions against a fixed case reference; those results do not establish real-world control effectiveness.
Does this connect to PLCs, plant networks, or SIEMs?
No. This edition has no live controller, network scanning, packet capture engine, or SIEM connection. It does not emulate controller timing, physical processes, or safety systems. Use the exercises to practice reasoning, then validate real changes through your organization's engineering and operational processes.
How is my progress stored?
Studied-lab progress, knowledge-check results, workbench rule drafts and findings, and any notes you enter are stored locally in this browser. These records do not sync across devices or accounts and may be lost if browser storage is cleared. “Studied” is a self-reported status, not a professional certification. You can reset studied statuses and knowledge-check results below; notes are separate. Clear individual lab notes by erasing the text, and clear case notes using the case workbook control.
Can I use this for a workshop or presentation?
Use the guided demo for a short walkthrough, then invite participants to explore scenarios. Download individual lab briefs or the workshop outline. Keep the distinction between browser simulations and live industrial testing clear.
AUTHOR & PROJECT CREATOR
Meet the author
Abdul Khadir Mahamed
OT Security Studio turns industrial security challenges into practical exercises in observation, design, investigation, and recovery.
Independent educational project. Content and simulations do not represent employer guidance or endorsement. Learning edition · November 2026.