ICS Technique

Goal: map the OT attack surface, assess reachable field devices and control systems, and identify exploitable weaknesses — while keeping safety of industrial processes and physical equipment as a hard constraint throughout.

When this technique applies

• Authorized OT/ICS penetration test or red team engagement.
• Compromise of IT network with visibility into an OT segment (IT/OT pivot).
• Assessment of exposed ICS protocols on a DMZ or internet-facing SCADA interface.
• Evaluation of HMI, engineering workstation, or historian security posture.
• Verification that safety instrumented systems (SIS) are isolated from corporate network.

Boundary with other skills

• IT network scanning and exploitation: use network-technique and vuln-exploit-technique for Windows/Linux hosts in OT (historians, EWS).
• Physical hardware access: UART, JTAG, flash dump on PLCs/RTUs → hardware-technique.
• RF and wireless sensor networks: 900 MHz, Zigbee, WirelessHART, ISA100 → wireless-technique.
• CTF ICS lab tasks: simulated challenges → ics-ctf.
• Malware and implant deployment: coordinate with post-exploit-technique; scope explicitly with client.