- Operational Technology
OT201: OT Cyber Security Understanding Attacks, Defence Tactics to Compliance
Deepen your OT security skills with hands-on threat modelling, MITRE ATT&CK ICS mapping, and zero-trust applications.
- Intermediate
- In-person
Course at a glance
From theory to practice – applied OT threat defence
This course will teach you how to conduct a comprehensive threat assessment of Operational Technology (OT) environments using the MITRE ATT&CK framework for ICS, analysing historical cyberattacks targeting ICS/OT systems. Youโll apply these tactics and techniques in simulated OT scenarios, identify key mitigation strategies, and use Cyber Assessment Framework (CAF) guidelines to perform risk assessments. The course also covers the implementation of zero-trust architecture to enhance security in OT environments and guides you through applying layered defence strategies and incident response approaches to protect critical national infrastructure.
Whoโs this course for?
OT engineers, security specialists, and CNI operators who need to strengthen their ability to assess threats, apply defence-in-depth strategies, and align OT security to industry frameworks and regulations.
Modules
- The difference – IT vs OT
- The Architecture – Purdue Reference Model
- Threat to OT
- Vulnerabilities in OT
- Challenges in OT
- Industrial Automation and Control Systems
Understand how cyberattacks are carried out in both IT and OT contexts, dissect the anatomy of an attack, and map real-world examples to the MITRE ATT&CK for ICS framework.
- Setting up the scene
- Cyber Security Attacks (Discover, Attack and Intrusion Phase)
- Discovery Phase (Attack Surface – External/Internal โ Physical Surveillance, Open-source Intelligence, Public Domain Information Aggregation, Social Engineering, Scanning)
- Attack Phase (Configuration Management, Software and Security Updates, Protocols, Multi-prolonged Attack, Vulnerability Information)
- Intrusion Phase (Maintain Access, Escalate Access, Undetected Access, Compromise, Covering Tracks)
- Attack MITRE (Key Concepts, Tactics, Techniques, How can we use ATT&CK, How should we not use ATT&CK?)
- Application of Attack Methods (Different Cyber Security Attack Methods, Cyber security campaigns, malware and associated threat actors)
Learn how to adapt layered security concepts from IT to OT environments, covering baseline creation, security management, physical, network, hardware, and software layers, plus zero-trust and CARTA imperatives.
- Securing ICS
- Security by obscurity (Security strategy that doesn’t work)
- Defence-in-Depth (No one solution, layered approach, Baselines)
- Security Management Layer (Security Model, Security Policy, Change Management, Common ICS modifications, Change Control, Access Control, Malware Protection, Incident Response, Testing, Forensics).
- Physical Security Layer (Physical Access)
- Network Security Layer (Purdue Model, Network Personnel, Security Technologies, External Connections, Perimeter Components (Firewall, IDS/IPS – Placement, Implementation, Tuning), Antivirus, Malware Preventions, Central Logging, Log Consolidation )
- Hardware Security Layer (Hardware Security)
- Software Security Layer (Software Security, Patch Management, Patches, Secure Code Development, Encryption, Impacts)
- Zero Trust Architecture (Introduction, Challenges and CARTA Imperatives (Continuous Adaptive Risk and Trust Assessment))
Identify and manage OT cyber risks using established frameworks (NIST SP-800, CAF, OG86), conduct in-depth assessments, run tabletop incident response exercises, and secure CNI through structured evaluation.
- Introduction to Security Frameworks and Regulation
- Cyber Security Framework for OT (NIST SP-800: Identify, Protect, Detect, Respond, Recover)
- CAF or OG86 In-Depth and securing CNI Assessment
- ICS Incident Response Tabletop
Youโll work through practical scenarios, work with ourโฏportable industry 4.0 compatible field-site box, interactive group exercises, and simulated real-world OT attack/defence situations to apply concepts directly in context. Including:
Activity 1: Discovery Phase | Physical Surveillance
- Scrap Area Investigation
- Internal Network Exploitation
- OT Room Breach
- Searching for Vulnerabilities using Google
Activity 2: Discovery Phase | Perimeter Reconnaissance
- Searching for Targets using Shodan
- Open-Source Information Gathering using Maltego
Activity 3: Attack Phase | Vulnerability Scanning and Exploitation
- Perform Network Scanning using Nmap
- Using Metasploit to Exploit Apache Tomcat
- Gathering Information from Node-RED Web Interface
- Brute-Force SSH Login Using Hydra
- Attempt to Access Sensitive Files
Activity 4: Intrusion Phase | Privilege Escalation
- Windows Privilege Escalation using Metasploit Web Delivery
- Dump User Credentials using Mimikatz (Kiwi Extension)
- Create a Persistent Backdoor
- Clear Tracks and Activity
- Linux Privilege Escalation
- Identify and Exploit a Writable Cron Job
Activity 5: Achieving Objective and Visualising Impact
- Reading Data From PLC
- Writing Data into the PLC
Activity 6: Defence-in-Depth | Baseline | CSET Exploration Activity
- Conducting Assessment Based on NIST CSF 2.0
Activity 7: Defence-in-Depth | Security Management Layer | Create a Policy
- Creating an OT Policy
Activity 8: Defense-in-Depth | Security Management Layer | Cracking and Securing Passwords
- Crack NTLM Hashes using Hashcat
- Review Windows Audit Policy Settings
Activity 9: Defence-in-Depth | Network Security Layer | Asset Management
- Building an Asset Register
Activity 10: Defence-in-Depth | Network Security Layer | Data Flow
- Extracting Network Communication Information
Activity 11: Defence-in-Depth | Network Security Layer | Firewall
- Firewall Configuration – Any to Any Rules
- Switch Configuration
- Firewall Configuration – Deny Rules
Activity 12: Defence-in-Depth | Network Security Layer | IDS
- Snort Configuration
Activity 13: Defence-In-Depth | Network Security Layer | Gathering Logs and Investigation
- Identify Time Range using SPI Graph
- Detect Scanning from the Suspicious Host
- Confirm RDP/SMB Reconnaissance
- Identifying Exposed Web Interfaces and Default Credentials via HTTP
- Confirm Upload of Malicious WAR Payload
- Verify Reverse Shell
- SSH Connection Established
- Identify evidence of the PLC read and write operations
- Build a Timeline Based on Observations
- Creating a Detection Rule
How will you learn?
Training is delivered face-to-face by experienced OT security practitioners, combining:
- Expert-led content with real-world case studies.
- Guided walkthroughs of frameworks and methodologies.
- Group discussions to explore application in your own OT environment.
- Practical exercises to reinforce skills and build confidence.
Prerequisites
A working knowledge of OT and basic OT cyber security concepts (completion of OT102 or equivalent experience recommended).
Book your date…
Book for 16th June 2026
(Youโll be redirected to Cardiff Universityโs website to complete your booking)
Or find out more…
Book a meeting with our sales team
Make an enquiry
The APMG International and swirl device logo is a trade mark of the APM Group Limited, used under permission of The APM Group Limited. All rights reservedย
Feedback from past attendees
- Training Courses
Working with Cyber Innovation Hub to deliver our Business Continuity and Cyber Threat Simulation Day was outstanding. Their facilitation encouraged โฏengagement from the team and created a safe space for honest reflection and learning. The scenarios tested our thinking and exposed areas for improvement, which led to tangible outcomes in refining our continuity plans and strengthening our overall resilience. Highly recommended for any organisations looking to test and or improve their Cyber security responses.
- Training Courses
โParticipating in the OT102: Foundations of OT Cybersecurity course, delivered by Cyber Innovation Hub, strengthened our understanding of OT risks and practices. The programme was relevant and expertly delivered, equipping staff with knowledge to safeguard infrastructure. We recommend this course to organisations seeking greater resilience.”
- Training Courses
โThe Cyber Innovation Hubโs Applied Foundations of OT Cybersecurity was a package that developed our understanding of OT and security control requirements. Well-paced and delivered, it gave us hands-on experience which consolidated learning. Iโm looking forward to future packages to build upon this foundation.โ
Related courses
Letโs build cyber resilience together
From training to testing to innovation, if you’re building something that needs to stay secure, weโre ready to help you simulate, learn , and protect what matters.