OT Penetration Testing: A Beginner-to-Advanced Learning Roadmap

My OT/ICS Pentesting Journey: Understanding the Industrial Process

Learning why process knowledge must come before security testing

Today OT/ICS penetration-testing learning plan. My first objective was not to scan a PLC, run an exploit or use an industrial-security tool. It was to understand the industrial process that those systems control.

This is an important difference between traditional IT penetration testing and OT penetration testing. In an IT environment, a failed service may affect information or business operations. In an OT environment, a similar failure could affect machinery, production, the environment or human safety.

What is a Control System?

A control system is the hardware and software that monitors and directly controls physical industrial processes in real time — turning digital commands into physical actions like starting/stopping motors, opening valves, tripping breakers, or adjusting temperature and pressure.

Components I studied

I began by learning the purpose of seven common industrial components:

• A PLC executes control logic and controls industrial equipment.
• An HMI gives operators visibility into the process and may allow authorized control actions.
• SCADA supervises industrial processes across multiple systems or locations.
• An RTU collects field information and communicates with supervisory systems.
• A DCS distributes process-control functions across an industrial facility.
• An engineering workstation is used to configure controllers and maintain control programs.
• A historian stores process measurements, alarms and operational events.

The main lesson was that these components do not operate independently. They exchange measurements, commands and status information to maintain the physical process.

My simplified water-tank process

For the practical exercise, I modelled a water tank containing a level sensor, PLC, pump and HMI.

The sensor measures the water level and sends the value to the PLC. The PLC evaluates that value using its programmed logic and decides whether the pump should run. The HMI allows the operator to observe the water level, pump condition and alarms.

This simple model helped me connect network communication with physical behaviour.

Failure scenarios

I examined three situations.

Normal operation

The sensor reports the correct water level. The PLC starts or stops the pump according to its configured setpoints, while the HMI displays the correct status.

Sensor stuck at a low value

If the sensor continues reporting a low level when the tank is already full, the PLC could make an incorrect decision and continue requesting water. In a real environment, additional interlocks or independent safety systems may prevent an unsafe condition.

Loss of HMI communication

Losing HMI communication does not necessarily mean that the PLC stops operating. The controller may continue executing its local logic, but the operator could lose visibility and the ability to respond effectively.

This showed me why an OT security assessment must consider both technical results and process consequences.

Why OT pentesting requires a different approach

An OT pentester cannot assume that a test is safe simply because it is common in an IT environment. Aggressive scanning, unexpected protocol requests, controller changes or service interruption could affect process availability.

A responsible OT assessment therefore requires:

• Clearly defined scope
• Process-owner and engineering involvement
• Passive assessment before active testing
• Approved test cases
• Stop conditions
• Backups and recovery procedures
• Evidence that normal operation was restored

Resource link:

Open Fortiphyd Learning and select:ICS101 — Introduction to ICS — Basic Training (FREE)

You may alternatively watch the introductory sections of the ICS Basics YouTube playlist.

Fundamentals of OT Cybersecurity (ICS/SCADA) — Udemy

Started in OT/ICS Cybersecurity 2026 — Mike Holcomb

ICS Architectures and Key Components

ICS architecture shows how business systems, industrial networks, controllers and physical equipment connect. The diagram uses the Purdue Model to group systems by their purpose and role.

Think of the levels as a guide for understanding the system. A real facility may place some components differently or combine several architectures.

Level 5 — Enterprise Network

Level 5 contains company-wide business systems. These systems support the organization and usually do not control machines directly.

Components shown:

• Email: Used for communication, such as Outlook.
• ERP (Enterprise Resource Planning): Manages business processes such as purchasing, finance, inventory and planning. Examples include SAP and Oracle.
• Business applications: Support functions such as finance and human resources.
• Internet: Provides access to external networks and services. It should not be treated as a trusted part of the OT control network.
• Remote access VPN: Provides an encrypted connection for approved remote users. The connection should be restricted and routed through controlled access systems.

Example: A business planner may use ERP to review production information, but should not directly connect from an office computer to a PLC.

Level 4 — Site Business and Plant IT

Level 4 contains site-level IT systems used by office staff and plant support teams.

Components shown:

• Office PCs: Used for reports, planning and other office work.
• File servers: Store shared site documents and files.
• Domain Controller (Active Directory): Manages user accounts, computers and login permissions.
• Patch Management: Helps prepare and distribute approved software updates.
• Antivirus Server: Provides antivirus definitions and management for supported computers.
• Plant Business Applications: Support site planning and scheduling.

These systems may need information from the plant, but their connections to OT should be limited to approved paths.

Level 3 — Operations Management

Level 3 supports the day-to-day running of production. It connects operational information with production planning and reporting.

Components shown:

• MES (Manufacturing Execution System): Tracks production orders, materials, work in progress and product status.
• Historian: Collects and stores process values, alarms and equipment data over time. Engineers can use this information to review trends or investigate an event.
• Asset Management: Stores information about industrial equipment, such as its identity, location and maintenance status.
• Reporting systems: Turn production and process information into reports for operations or management.

The image places these components at Level 3. In actual facilities, exact placement and boundaries can vary.

Level 3.5 — Industrial DMZ

The industrial DMZ is a controlled network zone between business IT and OT. It provides a place to manage approved information exchange without allowing unrestricted connections between the two environments.

Components shown:

• Jump Server: A controlled computer that administrators connect to before accessing approved systems. Access can be authenticated, limited and logged.
• Patch Server: Holds updates that have been reviewed and approved for use in the OT environment.
• Proxy: Relays or controls selected network requests.
• Antivirus (AV) Server: Supports malware scanning and approved antivirus updates.
• IDS and Monitoring: Watches network traffic or system events for suspicious activity.
• Data Diode: Allows information to flow in one direction only. It is useful when data needs to leave OT without providing a return communication path.

A DMZ is a boundary, not a guarantee of security by itself. Its rules and systems need careful configuration and monitoring.

Level 2 — Supervisory Control

Level 2 gives operators a view of the process and supports supervisory actions.

Components shown:

• SCADA Server: central computer/server in a Supervisory Control and Data Acquisition (SCADA) system. It collects data from industrial devices and allows operators to monitor and supervise the industrial process.
• HMI (Human-Machine Interface): Displays process values, equipment status and alarms to an operator. Depending on permissions and design, it may also let an operator send commands.
• Engineering Workstation: Used by authorized engineers to configure controllers, edit programs or diagnose equipment. Changes to control programs can affect the physical process, so access should be controlled.
• Alarm/Event Server: Records alarms and events so operators can see abnormal conditions and review what happened.
• Trend Server: Displays process values over time, such as changes in pressure, temperature or water level.

Level 1 — Basic Control

Level 1 contains controllers that read field inputs and run control logic.

Components shown:

• PLC (Programmable Logic Controller): Executes a program that reads inputs and controls outputs. A PLC might read a sensor and switch a pump on or off.
• RTU (Remote Terminal Unit): Collects information and controls equipment at remote locations. RTUs are common in geographically spread systems.Can also execute remote control commands.
• DCS Controller: Controls part of a larger integrated process. Multiple controllers can work together under a supervisory system.
• IED (Intelligent Electronic Device): smart field device commonly used in electrical power systems. It can monitor electrical conditions and perform protection or control functions.

Level 0 — Process and Field Equipment

Level 0 is the physical process: the equipment that senses conditions or changes what is happening in the real world.

Components shown:

• Sensors: Measure conditions such as temperature, pressure, flow or liquid level.
• Actuators: Turn a control signal into a physical action. Examples include opening a valve or moving a damper.
• Motors: Drive machines or other equipment.
• Pumps: Move liquids through a process.
• Conveyors: Move materials along a production line.
• Robots: Perform automated tasks, such as moving or handling products.
• Tanks and boilers: Hold or process materials.

Three Common Control Architectures

PLC-based architecture: One or more PLCs control machines or a local process. For example, a PLC may coordinate sensors, motors and conveyors on a packaging line.

SCADA architecture: A central control location monitors and supervises equipment spread across multiple sites. It commonly communicates with remote PLCs or RTUs. The remote controllers may handle local control while the central system gathers information and presents it to operators.

DCS architecture: Controllers distributed throughout a facility work together to control an integrated process. A DCS is commonly used where many related process areas need coordinated control.

These designs are not mutually exclusive. A SCADA system can supervise PLCs and RTUs, and PLCs can also be part of a DCS.

ICS/OT Architecture Memory Trick

Level 5 → 🏢 BUSINESS
 Email, ERP, Internet, Corporate Applications

Level 4 → 🌉 BRIDGE
 IT/OT Integration, Active Directory, Patching, Security Servers

Level 3 → 📊 MANAGE
 MES, Historian, Asset Management

Level 2 → 👀 WATCH
 SCADA, HMI, Alarm Server, Engineering Station

Level 1 → ⚙️ CONTROL
 PLC, RTU, DCS Controller, IED

Level 0 → 🏭 DO
 Sensors, Actuators, Motors, Valves, Robots

Level 5 → 🏢 BUSINESS
 Email, ERP, Internet, Corporate Applications

Level 4 → 🌉 BRIDGE
 IT/OT Integration, Active Directory, Patching, Security Servers

Level 3 → 📊 MANAGE
 MES, Historian, Asset Management

Level 2 → 👀 WATCH
 SCADA, HMI, Alarm Server, Engineering Station

Level 1 → ⚙️ CONTROL
 PLC, RTU, DCS Controller, IED

Level 0 → 🏭 DO
 Sensors, Actuators, Motors, Valves, Robots

• PLC = Local Control ⚙️
• RTU = Remote Control/Telemetry 📡
• IED = Electrical Protection/Control ⚡
• HMI = Human/Operator Screen 🖥️
• SCADA = Supervisory Monitoring 👀
• Engineering Workstation = Programming/Configuration 💻
• Historian = Historical Process Data 🗄️
• MES = Manufacturing Management 📊
• Sensor = Measure 🌡️
• Actuator = Act 🔧

How Information Flows

A basic control loop works like this:

Sensor → PLC, RTU or DCS controller → Actuator → Physical process

For example, a sensor measures a tank's water level. The controller uses that measurement to decide whether the pump should run. The pump changes the water level, and the sensor measures it again.

Information also travels upward for monitoring and reporting:

Controller → HMI or SCADA → Historian, reporting or operations systems

Approved information may then pass between OT and business systems through controlled network paths.

In the diagram's legend:

• Green arrows show two-way data flow.
• Blue arrows show main permitted flow between IT and OT.
• Red arrows show direct communication that is blocked.
• Grey arrows show communication between levels.
• Firewalls control connections across network boundaries.
• The dashed boundary marks the industrial DMZ.

These arrows describe the diagram's example. A real network's permitted paths must be confirmed from its design and configuration.

Why the Layers Matter for Security

Layering helps an organization control which systems can communicate. For example, an office computer should not have an unrestricted route to a controller that operates a pump or production machine.

The diagram highlights these security practices:

1. Separate network zones: Keep business IT, the DMZ and OT networks appropriately separated.
2. Limit connections: Permit only the communication paths needed for operations.
3. Use least privilege: Give each user and system only the access required for its role.
4. Monitor communications: Watch for unusual activity at important network boundaries and within OT.
5. Control remote access: Use approved gateways, such as a jump server, with appropriate authentication and logging.
6. Manage updates carefully: Review and test patches before introducing them into OT.
7. Protect safety and reliability: Consider how a security change could affect people, equipment and the process.

The Purdue Model is a useful reference for understanding an ICS network. Confirm actual devices, connections and responsibilities with the site's engineers and operators. NIST's Guide to Operational Technology Security is a useful reference for further study: https://csrc.nist.gov/pubs/sp/800/82/r3/final

ICS Process Types

Industrial Control Systems (ICS) control machines and industrial operations. The type of process helps us understand what the system does and what could happen if it fails.

Discrete Processes

Discrete processes handle separate items one at a time. Machines may move, assemble, sort or package products.

Example: Sensors detect bottles on a conveyor. A PLC controls when they move and when they are filled.

Used in: Factories, robotics, car assembly and packaging.

Continuous Processes

Continuous processes run without stopping for long periods. The system monitors things like temperature, pressure, water level and flow.

Example: A water-treatment plant keeps water flowing while it filters and treats it.

Used in: Refineries, chemical plants, power stations and water treatment.

Batch Processes

Batch processes make a set amount of a product. The system follows a recipe or a series of steps. When one batch is finished, the next one can begin.

Example: A food plant mixes ingredients, heats the mixture and sends it for packaging.

Used in: Food and drink production, medicine, chemicals and brewing.

Hybrid Processes

Hybrid processes combine different types of work, such as continuous processing, batch production and packaging.

Example: A drink factory treats water continuously, mixes drinks in batches, then fills and packages bottles on a production line.

Used in: Food and drink, medicine and chemical production.

Distribution Systems

Distribution systems move a utility or resource through a network.

Example: Power systems send electricity through substations. Water systems use pumps and pipes to deliver water.

Used in: Electricity grids, water networks, gas pipelines and heating networks.

Distribution describes how a resource is delivered. The equipment in a distribution network may use different kinds of control.

Easiest way to remember all 5

Discrete_ → Individual items 📦 Continuous → Never stops 🌊 Batch → One batch/recipe at a time 🧪 Hybrid → Combination 🔀 Distribution → Moves/delivers resources ⚡_

Why This Matters for OT Security

A security problem can affect each process differently. A stopped conveyor may delay production. A wrong setting in a water or chemical process could affect equipment, product quality or safety.

Before testing an OT system, learn what the process does, what normal operation looks like and who must approve the test.

Purdue Reference Model

Level 5: Enterprise Network, BUSINESS 🏢

This is the traditional corporate IT environment.

Examples:

• Email
• ERP such as SAP/Oracle
• Business applications
• Internet access

Purpose: Runs business activities rather than directly controlling industrial machinery.

Remember: Level 5 = BUSINESS

Level 4: Site Business Network, BRIDGE 🌉

Level 4 connects the business environment with plant/site operations.

Examples:

• Office PCs
• File servers
• Active Directory
• Patch management
• Antivirus/security servers

Security controls and network boundaries are important here because this area sits close to the IT/OT boundary.

Remember: Level 4 = BRIDGE

Level 3: Operations Management, MANAGE 📊

Level 3 manages plant operations and production-related information.

Examples:

• MES
• Historian
• Asset management
• Reporting systems
• Engineering systems

MES

Manufacturing Execution System helps manage manufacturing/production operations.

Historian

Stores historical process information such as:

• Temperature
• Pressure
• Flow
• Equipment status
• Process measurements

Remember: Level 3 = MANAGE

Level 2: Supervisory Control, WATCH 👀

Level 2 is used to monitor and supervise industrial processes.

Examples:

• SCADA Server
• HMI
• Engineering Station
• Alarm Server
• Trend Server

SCADA

Supervisory Control and Data Acquisition provides centralized supervisory monitoring and control.

HMI

Human Machine Interface provides operators with a visual interface to monitor the process and issue operational commands.

Example:

Operator → HMI → PLC → Motor

Remember: Level 2 = WATCH

Level 1: Basic Control, CONTROL ⚙️

This is where controllers interact with field equipment.

Main devices:

• PLC: Programmable Logic Controller
• RTU: Remote Terminal Unit
• DCS Controller: Distributed control
• IED: Intelligent Electronic Device

PLC

Reads inputs → executes control logic → updates outputs.

RTU

Commonly used for remote telemetry and control in geographically distributed environments.

IED

Common in electrical environments for monitoring, protection and control.

Remember: Level 1 = CONTROL

Level 0: Physical Process, DO 🏭

This is the actual physical process.

Examples:

• Sensors
• Actuators
• Motors
• Pumps
• Valves
• Conveyors
• Robots
• Boilers

Sensor

Measures physical conditions.

Physical process → Sensor → Controller

Actuator

Performs a physical action based on a control signal.

Controller → Actuator → Physical process

Remember: Level 0 = DO

Upcoming content will be updated