OT CT (Ep. 18): Intro to OT/ICS Penetration Testing

Value of the Information & Strength of the Argument

The video provides valuable insights into OT/ICS penetration testing, drawing on the author’s extensive experience. It clarifies common misconceptions, such as the belief that OT pentesting is entirely different from IT pentesting, and highlights the importance of understanding attack paths from IT to OT. The argumentation is based on practical examples and real-world incidents, which strengthens the credibility of the advice. However, the discussion is largely anecdotal and lacks formal citations, which limits its scientific rigor. The author’s emphasis on safety and the risks of active testing is well-founded and supported by examples of incidents where testing caused outages. Overall, the content is informative and practical for professionals in the field.

Scientific Rigor, Source Quality, Title Accuracy

The video does not cite specific sources or references, relying instead on the author’s personal experience and general industry knowledge. The title accurately reflects the content, which is an introductory overview of OT/ICS penetration testing. The lack of formal citations reduces the scientific rigor, but the information is consistent with established practices in the field. The author mentions the Dragos year-in-review report and conferences like S4, but does not provide specific references. The content is suitable for professionals seeking an overview, but those requiring detailed, citable information would need to consult additional resources.

The title accurately reflects the content, which provides an introduction to OT/ICS penetration testing, covering key concepts, attack vectors, and safety considerations.

7/10

The content is based on the author's extensive experience in OT/ICS security, but it is largely anecdotal and lacks formal citations or references to specific standards or research. The information is practical and generally aligns with industry knowledge, but the lack of verifiable sources and the informal presentation reduce its scientific rigor.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 02:00Introduction and housekeeping, including upcoming conferences and announcements.
• 10:00Discussion on the importance of learning from incidents and emulating attackers.
• 20:00Overview of common attack vectors into OT networks, including IT compromise and remote access.
• 30:00Explanation of OT assets like PLCs and HMIs, and the prevalence of Windows systems.
• 40:00Discussion on safety considerations and the risks of active testing in production environments.
• 50:00Q&A session addressing lab resources and testing without disruption.

• Intro to OT/ICS Penetration Testing course on YouTube — The author mentions this course as a resource for more detailed content and lab manuals.

• NIST SP 800-82 — Provides guidance on securing ICS, aligning with the video's emphasis on OT security.
• MITRE ATT&CK for ICS — Catalog of adversary techniques in ICS, supporting the video's discussion of attack vectors.

• No specific discordant sources identified — The video does not contradict established knowledge, but its anecdotal nature lacks formal verification.