OT / ICS security assessment (passive-first)

When it applies

The engagement touches an industrial environment — PLC/RTU controllers, SCADA/DCS, HMIs, engineering workstations, historians, jump hosts, or the IT/OT boundary (firewall rules, data diodes). A misstep here can cause physical harm, not just downtime. Load tradecraft-scope-roe and require the written authorization to spell out: the site and network segments, whether active scanning is allowed, and whether writing coils/registers is allowed — the default for both is NO. Work passive-first; nothing touches a PLC's state until the scope explicitly says so.

Why it works

Industrial protocols (Modbus, S7comm, DNP3, EtherNet/IP) predate hostile networks: they run in cleartext with no authentication (CWE-306), so anyone who can reach the port can read process state — and usually write it. That's exactly why the assessment itself is the risk: a high-rate scan or a stray write can trip a control loop or a safety instrumented system (SIS). Mirrored traffic and offline artifacts reveal the same exposure with zero packets injected.