Purple Teaming ICS Networks

In this talk from the DEF CON 27 ICS Village, Austin Scott explores the principles, methodology, and operational value of executing purple team engagements within Industrial Control System (ICS) and SCADA environments. He introduces the spectrum of testing approaches at 03:00, contrasting black box and gray box assessments with collaborative white box purple teaming, where offensive operators and defensive defenders work together in real time. At 06:00, he explains the crucial role of the blue team in supplying network topologies, baseline packet captures, and system telemetry to maximize testing efficiency.

Austin addresses the unique constraints of OT environments at 09:00, emphasizing that operational safety, plant availability, and the physical stability of programmable logic controllers (PLCs) must take precedence over aggressive penetration testing techniques. At 12:00, he analyzes proprietary industrial protocols and segmented Purdue Model topologies, followed by a case study at 15:00 examining a purple team assessment conducted on a major electrical power utility. He details the attack path from initial enterprise breach to plant control networks at 18:00.

The presentation emphasizes real-time validation at 21:00, where red team attack emulations are synchronized directly with blue team detection engineering to identify visibility blind spots in SIEM rules and network sensors. At 24:00, Austin discusses auditing against corporate ICS security frameworks, and at 27:00, he demonstrates automated log ingestion pipelines using Python parsers and Elasticsearch to rapidly turn red team findings into resilient defensive detections. (AI summary — Gemini Flash)