ICS Security Assessments 101 or How da Fox I Test Dis?

The talk is an introduction to security assessments of industrial control systems, aimed at consultants who may be asked to test operational technology environments. The speaker explains why ICS devices such as PLCs, RTUs and SCADA software tend to be weaker than IT systems, pointing to legacy design, missing authentication and poor separation between IT and OT networks. Rather than offering a full methodology, the talk maps practical examples onto the steps of a published approach.

The middle sections cover the assessment stages: setting security priorities, learning how the process runs through interviews and walkthroughs, and checking gaps against the NIST Cybersecurity Framework and a cybersecurity evaluation tool. Passive work includes analysing Modbus traffic and reviewing devices through their web interfaces, where default credentials were found. Demos show recovered credentials from an older Siemens PLC and manipulated sensor data sent over the S7 protocol to a test device without disturbing the master controller.

The closing section describes a mining red team engagement where ventilation systems were excluded because online testing could endanger workers, while offline proximity and tracking devices were analysed instead. The takeaways are to understand the operating context, test passively and escalate carefully, and report findings that add real value, such as poor IT and OT communication, unclear ownership of fixes and missing OT coverage in security programs, rather than generic issues the industry already knows.