18-ot-ics-security

Name: 18-ot-ics-security
Author: Masriyan

190stars37forks

How to install 18-ot-ics-security?

masriyan/claude-code-cybersecurity-skill/18-ot-ics-security

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 18-ot-ics-security

Installs into the current project.

Summary

Operational Technology and industrial control system security — Purdue model segmentation, industrial protocol analysis (Modbus, DNP3, S7, EtherNet/IP), PLC/HMI exposure, IEC 62443 alignment, and MITRE ATT&CK for ICS, for authorized and safety-conscious assessments

Files · 1

View on GitHub

SKILL.md

1	# OT / ICS / SCADA Security
2
3	## Purpose
4
5	Enable Claude to assess Operational Technology (OT) and Industrial Control System (ICS) environments — PLCs, RTUs, HMIs, SCADA servers, historians, and field devices — with safety as the first constraint. Claude reasons about the Purdue/ISA-95 model, analyzes industrial protocols passively, maps adversary behavior to MITRE ATT&CK for ICS, and aligns recommendations to IEC 62443 and the NIST SP 800-82 guidance.
6
7	> SAFETY & AUTHORIZATION — READ FIRST: OT systems control physical processes; a crashed PLC can mean equipment damage, environmental release, or loss of life. Default to passive, non-intrusive methods. Never send active scans, writes, or protocol fuzzing to production OT without written authorization, asset-owner sign-off, and a tested rollback/safety plan — ideally on a test bench or during a maintenance window. Confirm scope and the "do-no-harm" boundary before proceeding.
8
9	---
10
11	## Activation Triggers
12
13	This skill activates when the user asks about:
14	- ICS / SCADA / OT / DCS security or industrial network assessment
15	- Modbus, DNP3, S7comm, EtherNet/IP, BACnet, OPC-UA, IEC 61850/104 protocols
16	- PLC, RTU, HMI, historian, or engineering-workstation security
17	- Purdue model / ISA-95 segmentation and IT/OT boundary review
18	- IEC 62443, NIST SP 800-82, or NERC CIP alignment
19	- MITRE ATT&CK for ICS technique mapping
20	- Internet-exposed ICS devices (Shodan/Censys dorks) or ICS asset inventory
21	- OT threat detection, anomaly monitoring, or ICS incident response
22
23	---
24
25	## Prerequisites
26
27	```bash
28	pip install requests pyyaml
29	# Protocol libraries (lab use): pip install pymodbus scapy
30	```
31
32	Optional enhanced capabilities:
33	- Wireshark / `tshark` with ICS dissectors (Modbus, DNP3, S7, ENIP, GOOSE)
34	- `nmap` ICS NSE scripts (use read-only scripts only, with care)
35	- GRASSMARLIN / passive asset-discovery tooling
36	- Shodan/Censys access for exposure checks (passive, external)
37
38	---
39
40	## Core Capabilities
41
42	### 1. Architecture & Purdue Model Review
43
44	When asked to review OT architecture, map assets to Purdue levels and assess the boundaries:
45
46	\| Level \| Zone \| Assets \| Key control \|
47	\|-------\|------\|--------\|-------------\|
48	\| 4–5 \| Enterprise / IT \| ERP, business network, internet \| Should never directly reach L0–L2 \|
49	\| 3.5 \| IDMZ \| Jump hosts, patch/AV relays, historian replica \| Brokered, inspected IT↔OT traffic only \|
50	\| 3 \| Operations \| SCADA servers, historians, engineering WS \| Hardened, monitored \|
51	\| 2 \| Supervisory \| HMIs, control servers \| \|
52	\| 1 \| Control \| PLCs, RTUs, IEDs \| \|
53	\| 0 \| Process \| Sensors, actuators, drives \| \|
54
55	Flag: missing IDMZ, flat IT/OT networks, dual-homed engineering workstations, remote vendor access bypassing the DMZ, and any direct path from L4/L5 to L0–L2.
56
57	### 2. Industrial Protocol Analysis (Passive-First)
58
59	Prefer reading a SPAN/TAP capture over active probing. From a PCAP, identify:
60	- Modbus/TCP (502) — function codes; flag writes (FC 5/6/15/16), unauthenticated reads, exposure beyond the cell.
61	- DNP3 (20000) — operate/direct-operate, lack of Secure Authentication (SAv5).
62	- S7comm / S7comm-plus (102) — PLC start/stop, program upload/download.
63	- EtherNet/IP + CIP (44818/2222) — forward-open, attribute writes.
64	- OPC-UA (4840) — security policy `None`, anonymous sessions.
65	- IEC 61850 GOOSE/MMS, IEC 60870-5-104 (2404), BACnet (47808) as present.
66
67	Note that most ICS protocols have no authentication or encryption by design — any reachable client can issue commands. Use `scripts/ics_protocol_analyzer.py` to summarize an exported PCAP and flag write/control operations and unexpected talkers.
68
69	### 3. Exposure & Asset Discovery
70
71	- Passive inventory from captures (MAC/OUI → vendor, protocol → device role).
72	- External exposure (read-only, external) via Shodan/Censys dorks — never expose live device details publicly:
73	- `port:502 product:Modbus`, `port:20000 source address`, `tag:ics`, `"Siemens, SIMATIC"`, `port:47808`, `"Schneider Electric"`.
74	- For any device that must be reachable, document why, the compensating controls, and whether it should be behind the IDMZ instead.
75	- Active scanning, if authorized: use only read-only `nmap` NSE (`modbus-discover`, `s7-info`, `bacnet-info`, `enip-info`) with low rate, never against safety-instrumented systems (SIS).
76
77	### 4. Threat Modeling — MITRE ATT&CK for ICS
78
79	Map plausible adversary paths using the ICS matrix tactics: Initial Access → Execution → Persistence → Evasion → Discovery → Lateral Movement → Collection → C

People who liked this also viewed

6 picks

Type

18-ot-ics-security

190stars37forks

View on GitHub

How to install 18-ot-ics-security?

masriyan/claude-code-cybersecurity-skill/18-ot-ics-security

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 18-ot-ics-security

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# OT / ICS / SCADA Security
2
3	## Purpose
4
5	Enable Claude to assess Operational Technology (OT) and Industrial Control System (ICS) environments — PLCs, RTUs, HMIs, SCADA servers, historians, and field devices — with safety as the first constraint. Claude reasons about the Purdue/ISA-95 model, analyzes industrial protocols passively, maps adversary behavior to MITRE ATT&CK for ICS, and aligns recommendations to IEC 62443 and the NIST SP 800-82 guidance.
6
7	> SAFETY & AUTHORIZATION — READ FIRST: OT systems control physical processes; a crashed PLC can mean equipment damage, environmental release, or loss of life. Default to passive, non-intrusive methods. Never send active scans, writes, or protocol fuzzing to production OT without written authorization, asset-owner sign-off, and a tested rollback/safety plan — ideally on a test bench or during a maintenance window. Confirm scope and the "do-no-harm" boundary before proceeding.
8
9	---
10
11	## Activation Triggers
12
13	This skill activates when the user asks about:
14	- ICS / SCADA / OT / DCS security or industrial network assessment
15	- Modbus, DNP3, S7comm, EtherNet/IP, BACnet, OPC-UA, IEC 61850/104 protocols
16	- PLC, RTU, HMI, historian, or engineering-workstation security
17	- Purdue model / ISA-95 segmentation and IT/OT boundary review
18	- IEC 62443, NIST SP 800-82, or NERC CIP alignment
19	- MITRE ATT&CK for ICS technique mapping
20	- Internet-exposed ICS devices (Shodan/Censys dorks) or ICS asset inventory
21	- OT threat detection, anomaly monitoring, or ICS incident response
22
23	---
24
25	## Prerequisites
26
27	```bash
28	pip install requests pyyaml
29	# Protocol libraries (lab use): pip install pymodbus scapy
30	```
31
32	Optional enhanced capabilities:
33	- Wireshark / `tshark` with ICS dissectors (Modbus, DNP3, S7, ENIP, GOOSE)
34	- `nmap` ICS NSE scripts (use read-only scripts only, with care)
35	- GRASSMARLIN / passive asset-discovery tooling
36	- Shodan/Censys access for exposure checks (passive, external)
37
38	---
39
40	## Core Capabilities
41
42	### 1. Architecture & Purdue Model Review
43
44	When asked to review OT architecture, map assets to Purdue levels and assess the boundaries:
45
46	\| Level \| Zone \| Assets \| Key control \|
47	\|-------\|------\|--------\|-------------\|
48	\| 4–5 \| Enterprise / IT \| ERP, business network, internet \| Should never directly reach L0–L2 \|
49	\| 3.5 \| IDMZ \| Jump hosts, patch/AV relays, historian replica \| Brokered, inspected IT↔OT traffic only \|
50	\| 3 \| Operations \| SCADA servers, historians, engineering WS \| Hardened, monitored \|
51	\| 2 \| Supervisory \| HMIs, control servers \| \|
52	\| 1 \| Control \| PLCs, RTUs, IEDs \| \|
53	\| 0 \| Process \| Sensors, actuators, drives \| \|
54
55	Flag: missing IDMZ, flat IT/OT networks, dual-homed engineering workstations, remote vendor access bypassing the DMZ, and any direct path from L4/L5 to L0–L2.
56
57	### 2. Industrial Protocol Analysis (Passive-First)
58
59	Prefer reading a SPAN/TAP capture over active probing. From a PCAP, identify:
60	- Modbus/TCP (502) — function codes; flag writes (FC 5/6/15/16), unauthenticated reads, exposure beyond the cell.
61	- DNP3 (20000) — operate/direct-operate, lack of Secure Authentication (SAv5).
62	- S7comm / S7comm-plus (102) — PLC start/stop, program upload/download.
63	- EtherNet/IP + CIP (44818/2222) — forward-open, attribute writes.
64	- OPC-UA (4840) — security policy `None`, anonymous sessions.
65	- IEC 61850 GOOSE/MMS, IEC 60870-5-104 (2404), BACnet (47808) as present.
66
67	Note that most ICS protocols have no authentication or encryption by design — any reachable client can issue commands. Use `scripts/ics_protocol_analyzer.py` to summarize an exported PCAP and flag write/control operations and unexpected talkers.
68
69	### 3. Exposure & Asset Discovery
70
71	- Passive inventory from captures (MAC/OUI → vendor, protocol → device role).
72	- External exposure (read-only, external) via Shodan/Censys dorks — never expose live device details publicly:
73	- `port:502 product:Modbus`, `port:20000 source address`, `tag:ics`, `"Siemens, SIMATIC"`, `port:47808`, `"Schneider Electric"`.
74	- For any device that must be reachable, document why, the compensating controls, and whether it should be behind the IDMZ instead.
75	- Active scanning, if authorized: use only read-only `nmap` NSE (`modbus-discover`, `s7-info`, `bacnet-info`, `enip-info`) with low rate, never against safety-instrumented systems (SIS).
76
77	### 4. Threat Modeling — MITRE ATT&CK for ICS
78
79	Map plausible adversary paths using the ICS matrix tactics: Initial Access → Execution → Persistence → Evasion → Discovery → Lateral Movement → Collection → C

People who liked this also viewed

6 picks

Type