ICSForge - Open Source OT ICS Security Coverage Validation Platform

The talk opens with the problem: OT defenders often assume their firewalls, segmentation and network monitoring sensors work against industrial attacks, but proving it usually means risky scanning or sending harmful commands to live controllers. The speaker, an OT security lead, presents ICSForge as a safer way to check these controls, and notes that most breach and adversary simulation tools target IT, while the OT options he found were commercial.

The middle of the talk walks through the architecture. A sender generates live or pre-built traffic from roughly 600 scenarios mapped to MITRE ATT&CK for ICS, covering ten industrial protocols such as Modbus, DNP3, S7comm, OPC UA, BACnet and GOOSE. A receiver acts as a harmless sinkhole. Operators can check whether a firewall passes the traffic and whether a monitoring sensor raises an alert. Marker modes range from explicit payload tags to stealth traffic that looks like normal device output, and multi-step campaigns can replay attack chains.

The speaker closes by describing the workflow: traffic that reaches the receiver or goes unalerted marks a gap to fix, and results can be turned into reports for SOC teams and management. He is candid about limits. Traffic is one-way with no device responses, there is no response content detection, and the tool does not replace a penetration test. It is GPL-3 licensed and can run on two lightweight devices such as Raspberry Pis.