CYBRARY Forge Plant Floor
An operational-technology shift where the IT answer is the wrong answer.
What is in it
For ot security lead, plant engineering manager, critical-infrastructure ciso — prepare responders for a plant network, where containment can be the dangerous move.
- An asset register laid out by Purdue level, from field devices to the plant DMZ
- Control traffic, a historian trend and the alarm log for one shift
- Events that look like IT incidents and are not, and IT responses scored as failures
- Graded on the asset, the event, the boundary crossed and the safe next move
What it is not
- Nothing speaks to a real controller — the protocol behavior is modeled
- Not a safety-instrumented-system engineering course
Forge Plant Floor against the field
30 capabilities that matter for this purchase, next to the platforms a buyer shortlists in this lane: Dragos Academy, Immersive, OPSWAT. Dragos Academy, OPSWAT sit outside the eight-vendor research, so they carry no marks below — named for honesty, not scored.
- Purdue-level assets, control traffic and historian trends, with IT-correct answers that are wrong on a plant floor.
- IEC 62443 zones, conduits and target security levels are graded requirements, not slideware.
| What you need | Forge Plant FloorIncluded in the platform | Immersive |
|---|---|---|
| Free entry route for an individual | Yes, in part Runs through Cybrary's existing free tier rather than a Forge-specific plan. | Immersive: Limited for Free entry route for an individual |
| Paid individual subscription | Yes, in part Sold as part of Cybrary, not separately packaged yet. | |
| Guided hands-on labs | Yes See it live | Immersive: Documented for Guided hands-on labs |
| Job-role learning paths | Yes See it live | Immersive: Documented for Job-role learning paths |
| Foundational command line and operating-system learning | Yes See it live Seven Linux distributions and Windows 11, each with distro-accurate command behavior. | Immersive: Documented for Foundational command line and operating-system learning |
| Advanced offensive target practice | Yes, in part See it live Attack paths are modeled, not executed. Genuine exploitation needs the native lane. | Immersive: Documented for Advanced offensive target practice |
| Vendor's own practical certification program | Coming Cybrary certification exists; Forge-assessed credentials are not built. | |
| Completion certificates and CPE route | Yes, in part See it live | Immersive: Documented for Completion certificates and CPE route |
| Cloud-specific learning | Yes See it live | Immersive: Documented for Cloud-specific learning |
| Application-security and developer exercises | Yes See it live Graded secure code review: a seeded pull request with one real flaw, a scanner report that is partly wrong, and a dependency list that is mostly a distraction. | Immersive: Documented for Application-security and developer exercises |
| Operational-technology content and environments | Yes See it live A graded plant shift across Purdue levels, scored on the safe response rather than the IT one — containment that would blind the control room loses marks. | Immersive: Documented for Operational-technology content and environments |
| SCADA practice mapped to IEC 62443 zones, conduits and security levels | Yes See it live The plant is built to a zone and conduit model with target security levels, and every graded decision is listed against the foundational requirement it exercises — so a coverage answer comes from what learners did, not from a syllabus. | Immersive: Limited for SCADA practice mapped to IEC 62443 zones, conduits and security levels |
| Structured feedback after practice | Yes See it live Referee scoring with per-step reasoning and a debrief that discloses what was staged. | Immersive: Documented for Structured feedback after practice |
| SOC investigation exercise | Yes See it live | Immersive: Documented for SOC investigation exercise |
| Alert triage with true and false positive decisions | Yes See it live Every case ships with innocent lookalikes so closing everything scores badly. | Immersive: Limited for Alert triage with true and false positive decisions |
| SIEM query and investigation practice | Yes See it live | Immersive: Documented for SIEM query and investigation practice |
| Endpoint analysis and access | Yes See it live | Immersive: Limited for Endpoint analysis and access |
| Threat hunting kept separate from alert triage | Yes See it live | Immersive: Documented for Threat hunting kept separate from alert triage |
| Investigation that crosses multiple tools | Yes See it live One estate behind SIEM, EDR, case service, network devices and the wire. | Immersive: Documented for Investigation that crosses multiple tools |
| Analyst report or evidence submission | Yes See it live | Immersive: Documented for Analyst report or evidence submission |
| Measured investigation and response timing | Yes See it live Dwell time, containment time and SLA clocks are scored, not just recorded. | Immersive: Documented for Measured investigation and response timing |
| Detection-engineering curriculum | Yes See it live | Immersive: Documented for Detection-engineering curriculum |
| SOAR concepts and workflow training | Yes See it live | Immersive: Documented for SOAR concepts and workflow training |
| Learner authors an executable SOAR playbookDeliberately stricter than the row above: a SOAR-looking screen is not a runtime. | Yes See it live Draft, run, fail, repair and rerun against the live estate, with an audit trail. | Immersive: Documented for Learner authors an executable SOAR playbook |
| Connector failure and replay debugger for automation | Yes See it live Deterministic integration faults with idempotent retries. Not established for any vendor in the research. | |
| Configuration changes alter the exercise | Yes See it live Firewall, routing and policy edits change what the wire and the SIEM then show. | Immersive: Documented for Configuration changes alter the exercise |
| A working corporate mail client inside the exerciseOutlook on the Windows desktop, Evolution on Linux: folders, threads, attachments, full headers and message source. | Yes See it live Phishing training is graded both ways — a missed lure costs the same as reporting a legitimate message. | |
| Rogue access point owned by the estate, not scripted | Yes See it live | |
| Each scenario carries its own SIEM, alerts and case databaseNo shared global console: an alert raises a case on the estate it came from, and cannot leak into another team's exercise. | Yes See it live | |
| The full desktop exercise usable on a phoneA trackpad cursor, edge-following viewport, gestures, an on-screen keyboard and the taskbar folded into one reachable control. | Yes See it live |
The run behind this line: A vendor login into the production cell
An operational-technology shift: the IT answer is the wrong answer, and the safe response is graded separately from the fast one.
Opponent: Intruder using a legitimate vendor remote-support account. Shaped after Ukraine 2015 remote-access abuse and Unitronics 2023 exposed-device attacks. Technique and zone identifiers are published by MITRE and ISA/IEC; the mapping is ours and is not an accreditation.
How it starts — the message delivered to the mailbox
- From
- Kessler Drives Support <support@kessler-drives-service.example>
- Reply-To
- remote@kessler-service-desk.example
- Subject
- Scheduled firmware check on line 3 drives — remote session tonight
- Plant engineering has no record of agreeing to the window
- The reply address belongs to a different domain than the vendor's
- It asks for a standing remote account to be enabled, which is the access itself
Graded verdict: phish — T1566. Nothing here sends or resolves anywhere real.
The steps, and the zone each one crosses
| # | Tactic | ATT&CK | On the range | IEC 62443 zone |
|---|---|---|---|---|
| 1 | Initial access | T0865 Spearphishing attachment (ICS) | The vendor pretext gets the remote-support account enabled. | Enterprise |
| 2 | Initial access | T0822 External remote services (ICS) | The vendor account signs into the jump host in the plant DMZ. | Operations DMZ |
| 3 | Discovery | T0842 Network sniffing (ICS) | The engineering workstation's interface goes promiscuous on the cell network. | Site operations |
| 4 | Impair process control | T0831 Manipulation of control (ICS) | A setpoint is written to the line 3 controller from an unexpected client. | Supervisory control |
| 5 | Inhibit response function | T0814 Denial of service (ICS) | The controller stops answering the HMI poll and the alarm queue fills. | Basic control |
Zones in this run: Enterprise (Purdue level 4/5, via Internet mail and web egress); Operations DMZ (Purdue level 3.5, via Jump host and historian replication); Site operations (Purdue level 3, via Engineering workstation to supervisory network); Supervisory control (Purdue level 2, via HMI to controller over the control protocol); Basic control (Purdue level 1, via Controller to field device). How the zone model is used.
The alerts the SIEM raises from this run
Vendor remote account enabled outside a change window
A dormant support account enabled with no change record.
directory audit · stage 2 · LINE-PLANT-01 · T0822
Setpoint written from an unexpected client
A control write from an address that is not the HMI or the engineering station.
process historian · stage 4 · LINE-PLANT-02 · T0831
Controller stopped answering the poll
Consecutive missed poll cycles with the alarm queue growing.
process historian · stage 5 · LINE-PLANT-03 · T0814
What the case has to hold before it closes
- The asset, by Purdue level and zone
- The conduit the intruder crossed, and the rule that should have stopped it
- The safe next move, and why isolating the controller is not it
- The operations decision taken with the plant manager, and when
Walk the plant zone by zone
The plant is divided the way IEC 62443 divides it. Each zone below has its own walk and its own graded shift — open one and you are dropped into that scenario, not a description of it. Zone, conduit, requirement and security-level identifiers are the published vocabulary; the mapping to our content is ours and is not an accreditation.
Z-SAFETY · Safety instrumented system
Walk the safety zone
SL3 — Intentional, sophisticated means. An attacker with ICS-specific skills, tools and moderate resources.
The safety instrumented system is the last thing standing between a process upset and people getting hurt. It is monitored and never commanded, and its conduit allows nothing at all.
What you walk
- Read the asset register for the safety controller and confirm nothing else shares its segment.
- Check conduit C-04 for any packet at all — the allowance there is zero, so one packet is the finding.
- Compare the interlock's commanded state with the state it is reporting.
- Decide who is told first: this is an operations call before it is a security one.
Conduits touching it
- C-04 Z-CONTROL → Z-SAFETY — allowed: Nothing. The safety system is monitored, never commanded. Watched for: Any packet at all.
Requirements exercised: FR3 System integrity · FR7 Resource availability
Open the shift: A safety interlock is being held in an overridden stateGraded on: Escalating to operations before touching anything, and treating the safety system as the last line rather than another asset to contain.
The wrong turn: Isolating the safety controller to be safe. That removes the protection you were worried about losing.
Z-CONTROL · Line control zone
Walk the line control zone
SL3 — Intentional, sophisticated means. An attacker with ICS-specific skills, tools and moderate resources.
PLCs, the HMI and the serial gateway run the line. Everything here is real time; a containment that stops traffic stops production.
What you walk
- List everything speaking control protocol on Level 1 and compare it with the asset register.
- Find the source address that is writing rather than reading.
- Read the historian trend against the commanded value to tell an instructed change from a process upset.
- Choose a response that keeps the control room's hands on the plant.
Conduits touching it
- C-01 Z-CONTROL → Z-OPS — allowed: Historian collection, read-only, one direction. Watched for: A write function code arriving from the historian's address.
- C-04 Z-CONTROL → Z-SAFETY — allowed: Nothing. The safety system is monitored, never commanded. Watched for: Any packet at all.
Requirements exercised: FR1 Identification and authentication control · FR2 Use control · FR5 Restricted data flow · FR7 Resource availability
Open the shift: A second master is issuing commands on the control networkGraded on: Finding the host that was never in the asset register, and refusing the IT answer of blocking the control protocol outright.
The wrong turn: Blocking Modbus at the switch. The rogue master stops, and so does every legitimate read the control room depends on.
Z-OPS · Site operations zone
Walk the site operations zone
SL2 — Intentional, simple means. A low-skill attacker with generic tools and low motivation.
The historian, the batch records and the engineering workstation live here. It holds the plant's memory, and it is the first place an attacker can take something valuable without touching the process.
What you walk
- Check what the historian sent out overnight and where it went.
- Compare that volume and destination with the historian's own normal week.
- Confirm collection from the line is still running while you work.
- Preserve the historian's disk before anyone logs in and changes it.
Conduits touching it
- C-01 Z-CONTROL → Z-OPS — allowed: Historian collection, read-only, one direction. Watched for: A write function code arriving from the historian's address.
- C-02 Z-OPS → Z-DMZ — allowed: Historian replication and batch-record export. Watched for: Volume or destinations the historian has never used before.
Requirements exercised: FR4 Data confidentiality · FR5 Restricted data flow · FR6 Timely response to events
Open the shift: Process data is leaving the plant to somewhere newGraded on: Cutting the conduit at the boundary while the historian keeps collecting, and preserving its disk before it is touched.
The wrong turn: Shutting the historian down. The evidence goes with it, and so does the trend the control room reads.
Z-DMZ · Industrial DMZ
Walk the industrial DMZ
SL2 — Intentional, simple means. A low-skill attacker with generic tools and low motivation.
The DMZ is the only way in from business IT: a jump host, a replicated historian and patch staging. Nothing from the enterprise should ever terminate below it.
What you walk
- Read conduit C-03 for any flow that finished below the DMZ instead of at the replica.
- Check the jump host's sessions against the hours and the change record.
- Follow the session to the Level 2 asset it reached.
- Decide whether to cut the session, the account, or the conduit.
Conduits touching it
- C-02 Z-OPS → Z-DMZ — allowed: Historian replication and batch-record export. Watched for: Volume or destinations the historian has never used before.
- C-03 Z-DMZ → Z-ENTERPRISE — allowed: Brokered reads from the replica only. No session reaches the plant. Watched for: Any flow that terminates below the DMZ.
Requirements exercised: FR1 Identification and authentication control · FR5 Restricted data flow · FR6 Timely response to events
Open the shift: Somebody is driving the operator's panel from elsewhereGraded on: Naming the boundary that was crossed rather than the tool that crossed it, and cutting the path without stranding a live control session.
The wrong turn: Killing the remote session mid-change. The engineer's half-written change stays half-written on a running line.
Z-ENTERPRISE · Enterprise zone
Walk the enterprise boundary
SL1 — Casual or coincidental. Protection against accidental misuse.
Business IT is treated as untrusted by everything below it. The usual breach is not an exploit — it is a laptop with a foot in both networks.
What you walk
- Find the asset holding an address on two networks at once.
- Establish whether that bridge was declared as a conduit by anyone.
- Work out what crossed it and in which direction.
- Cut the undeclared path without stranding the engineer mid-change.
Conduits touching it
- C-03 Z-DMZ → Z-ENTERPRISE — allowed: Brokered reads from the replica only. No session reaches the plant. Watched for: Any flow that terminates below the DMZ.
Requirements exercised: FR1 Identification and authentication control · FR5 Restricted data flow
Open the shift: A machine is bridging the office network and the plant networkGraded on: Spotting the conduit nobody declared, and cutting it in a way that does not leave a change half-applied on the line.
The wrong turn: Disabling the engineer's account first. The bridge stays up and the change stays stuck.
Start learning this line
A vendor login into the production cell, graded on the safe response.
A tick means the other platform's own documentation shows it. A question mark means we could not confirm it publicly — it is never a claim that they lack it. Every Forge yes opens the working screen rather than a screenshot.