Testing ICS/OT Protocols

ICS/OT protocols were designed for reliability in isolated networks, not security on connected ones. Most have no authentication, no encryption, and no integrity checking. The danger is not that they are hard to exploit — it is that exploitation can have physical consequences, which is why safety constraints govern everything you do here.

When to Use

• Assessing SCADA networks or ICS environments during an authorized engagement
• Testing Modbus, DNP3, OPC UA, BACnet, EtherNet/IP, S7comm, or MQTT devices in scope
• Performing an ICS-specific penetration test with OT safety requirements
• Reviewing OT network segmentation and Purdue model compliance
• Evaluating remote access pathways into control system networks
• Inventorying ICS assets and identifying unauthenticated protocol exposure

When NOT to Use

• Standard IT network scanning — use enumerating-network-services
• HMI web interfaces tested as regular web apps — use testing-web-applications
• Writing ICS-specific detection rules — use engineering-detections