2024 - Getting Started in ICS - Not just for engineers

### Overview In this presentation, Tyler Jansen from 1898 & Co. discusses pathways for cyber security professionals to transition into Industrial Control Systems (ICS) and Operational Technology (OT) security. Jansen addresses the prevalent misconception that working in ICS/OT is exclusively reserved for engineers. Highlighting persistent threats against critical infrastructure and a growing workforce shortage, the talk explains how foundational IT and security skills directly transfer to OT environments, details key differences such as safety culture and legacy protocols, and provides concrete learning resources and opportunities for newcomers.

### Key Topics - **Terminology and Architectures**: Definitions of foundational OT concepts, including Industrial Control Systems (ICS), Operational Technology (OT), Building Automation Systems (BAS), Distributed Control Systems (DCS), Programmable Logic Controllers (PLCs), Supervisory Control and Data Acquisition (SCADA), Human Machine Interfaces (HMIs), Intelligent Electronic Devices (IEDs), Remote Terminal Units (RTUs), and physical actuators and sensors. - **Workforce Shortages and Threats**: High-profile incidents (Stuxnet, BlackEnergy targeting the Ukrainian grid, Triton in Saudi Arabia, and Colonial Pipeline) alongside nation-state activity illustrate the high risk to critical infrastructure. Studies cited from NIST, (ISC)², and Dean Parsons (SANS ICS) show workforce gaps and that only 52% of surveyed OT/ICS facilities have an ICS incident response plan. - **Perceived Barriers vs. Reality**: The presenter identifies three primary barriers for general IT security analysts: perceived skill mismatch, unfamiliarity with the domain, and lack of clear opportunities to monetize knowledge. Jansen argues that the core analytical and networking skills are functionally identical across IT and OT.

### Technical Details - **Skill Overlap**: Core competencies in general IT cyber security directly apply to ICS/OT, including routing/switching (VLANs, segmentation, port mirroring/SPAN), TCP/IP protocols, firewall management, general network architecture, operating system architectures (Windows and Unix systems prevalent at Level 3 of the Purdue model), security monitoring tools (IDS, IPS, EDR), and adversary threat methodologies. - **OT-Specific Priorities**: In OT environments, safety and availability take precedence over confidentiality. Unplanned downtime can result in massive financial loss, blackouts, recertification hurdles, or physical harm. Furthermore, physical compromise can cause equipment destruction, toxic gas leaks, and environmental disasters. - **Industrial Protocols**: Jansen details how common protocols (e.g., Modbus on TCP port 502, DNP3, BACnet, Siemens S7, GE SRTP) originated as serial communications developed in earlier decades without built-in security, authentication, or validation. For example, in Modbus, an attacker can manipulate commands such as multiple writes to repeat or rewrite register values without built-in bounds or verification. - **Governance and Frameworks**: Key regulatory and guidance frameworks include NIST SP 800-82 Rev 3, ISA/IEC 62443, CISA's CIRCIA reporting rules, and sector-specific oversight bodies (EPA for water, NERC for electric power, TSA for rail and pipeline).

### Takeaways - General security analysts already possess the baseline technical capabilities needed for ICS/OT and primarily need to learn industry-specific terminology, safety culture, and protocol behaviors. - Practical entry points for training include CISA’s virtual learning platform, Rob Lee’s blog, Zephyr project PCAP sample captures in Wireshark, PLC Cables trainer kits for ladder logic, and the Industrial Security Podcast. - Real-world exposure can often be started locally by engaging with building automation systems (BAS) in everyday offices or facilities, as well as participating in conferences (BSides, SANS Summits) and OT-focused CTFs.