Lion Cipher Lab
Explore ICS/OT security with a Modbus simulator
- SOC Analyst / Blue Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
There is a whole hidden layer of computing that most people in cybersecurity never touch: the systems that run the physical world — the pumps at a water plant, the breakers on a power grid, the robots on a factory line, the heating and cooling in a hospital. These are called Industrial Control Systems (ICS), part of a broader category called Operational Technology (OT), and they are protected far more poorly than ordinary IT, run on protocols designed decades ago with no security at all, and are exactly where a serious attack can cause real-world harm rather than just data loss. The field…
What you'll learn
- understanding what ICS, OT, SCADA, a PLC, and an HMI actually are, in plain English
- understanding the Modbus industrial protocol and its data model: coils and registers
- installing Python and the free pymodbus library on Windows, macOS, or Linux
- running a SIMULATED industrial device (a Modbus TCP server) on your own machine — never real equipment
- using a Modbus client to read and write coil and register values on that simulated device
- capturing local Modbus traffic in Wireshark and reading it with the built-in Modbus dissector
- seeing, firsthand, that Modbus has no authentication and no encryption — any command is obeyed and any value is readable
- explaining why OT/ICS security is different from IT: safety and availability come first, protocols are legacy, and network segmentation is the primary control
- understanding the Purdue model, the 'air gap', and network segmentation as the main way OT networks are defended
- knowing the one rule: practice ICS protocols only against a local simulator you own and run, never against live industrial systems
Steps in this lab
- The one rule that makes this safe: a local simulator only, never real equipment
- The words you need, from zero: ICS, OT, SCADA, PLC, HMI
- What Modbus is, and why it has no security
- Install Python and the free pymodbus library
- Stand up a SIMULATED industrial device (a Modbus TCP server) on your own machine
- Read and write coils and registers with a Modbus client
- Capture the traffic in Wireshark and SEE that Modbus is wide open
- Why OT/ICS security is different, and why segmentation is the answer
- What you proved, and a real career door you just opened