What it does. 'This skill covers conducting comprehensive security assessments of Operational Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/performing-ot-network-security-assessment/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-ot-network-security-assessment, or copy the skill folder into ~/.claude/skills/performing-ot-network-security-assessment/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ot-network-security-assessment/SKILL.md

SKILL.md (verbatim)

name: performing-ot-network-security-assessment
description: 'This skill covers conducting comprehensive security assessments of Operational
  Technology (OT) networks including SCADA systems, DCS architectures, and industrial
  control system communication paths. It addresses the Purdue Reference Model layers,
  identifies IT/OT convergence risks, evaluates firewall rules between zones, and
  maps industrial protocol traffic (Modbus, DNP3, OPC UA, EtherNet/IP) to detect misconfigurations,
  unauthorized connections, and attack surfaces in critical infrastructure.

  '
domain: cybersecurity
subdomain: ot-ics-security
tags:
- ot-security
- ics
- scada
- industrial-control
- iec62443
- network-assessment
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- PR.IR-01
- DE.CM-01
- ID.AM-05
- GV.OC-02
mitre_attack:
- T1078
- T1190
- T1059
- T0816
- T0836

Performing OT Network Security Assessment

When to Use

• When conducting an initial security baseline of an OT/ICS environment for a new client
• When evaluating the security posture of a facility after an IT/OT convergence initiative
• When preparing for IEC 62443 or NERC CIP compliance audits
• When assessing risk following a merger or acquisition involving industrial facilities
• When investigating whether an OT network has been compromised or has unmonitored pathways to corporate IT

Do not use for IT-only network assessments without OT components, for application-layer vulnerability scanning of IT web applications (see performing-web-app-penetration-test), or for active exploitation of live OT systems without explicit authorization and safety controls in place.

Prerequisites

• Written authorization from the asset owner and operations management for all assessment activities
• Understanding of the Purdue Reference Model and IEC 62443 zone/conduit architecture
• Passive network monitoring tools (Nozomi Guardian, Dragos Platform, or Wireshark with industrial protocol dissectors)
• Access to network diagrams, firewall rule sets, and asset inventories (or the ability to perform passive discovery)
• Safety briefing on the physical processes controlled by the OT systems under assessment

Workflow

Step 1: Establish Assessment Scope and Safety Boundaries

Define the scope based on the Purdue Reference Model levels and identify safety-critical systems that must not be actively scanned. OT assessments differ fundamentally from IT assessments because active scanning can crash PLCs, disrupt safety instrumented systems (SIS), and cause physical harm.

# OT Assessment Scope Definition
assessment:
  facility: "Chemical Processing Plant - Site Alpha"
  purdue_levels_in_scope:
    - level_0: "Physical process sensors and actuators (passive observation only)"
    - level_1: "PLCs, RTUs, safety controllers (passive only, no active scanning)"
    - level_2: "HMI stations, engineering workstations, historian (limited active with approval)"
    - level_3: "Site operations - OPC servers, application servers (active scanning permitted)"
    - level_3_5: "DMZ - data diodes, jump servers (active scanning permitted)"
    - level_4: "Enterprise IT connecting to OT (active scanning permitted)"

  safety_exclusions:
    - "Safety Instrumented Systems (SIS) - Triconex controllers"
    - "Emergency Shutdown (ESD) systems"
    - "Fire and Gas detection systems"
    - "Any Level 0/1 device during active production"

  authorized_activities:
    passive:
      - "Network traffic capture and analysis via SPAN ports"
      - "Industrial protocol deep packet inspection"
      - "Wireless spectrum analysis"
      - "Physical walkthrough and visual inspection"
    active_with_approval:
      - "Targeted Nmap scans of Level 2-4 systems during maintenance windows"
      - "Authentication testing on HMI and engineering workstations"
      - "Firewall rule verification between zones"
    prohibited:
      - "Active scanning of PLCs, RTUs, or SIS controllers"
      - "Fuzzing industrial protocols on live systems"
      - "Modifying PLC logic or firmware"

Step 2: Perform Passive Network Discovery and Asset Inventory

Deploy passive monitoring to map all devices, communication flows, and protocols on the OT network without sending any traffic that could disrupt operations.

#!/usr/bin/env python3
"""OT Network Passive Discovery and Asset Inventory Builder.

Uses pcap captures from SPAN ports to identify OT assets, protocols,
and communication patterns without active scanning.
"""

import json
import sys
from collections import defaultdict
from datetime import datetime

try:
    from scapy.all import rdpcap, IP, TCP, UDP
    from scapy.contrib.modbus import ModbusADURequest, ModbusADUResponse
except ImportError:
    print("Install scapy: pip install scapy")
    sys.exit(1)

# Industrial protocol port mappings
OT_PROTOCOL_PORTS = {
    502: "Modbus/TCP",
    102: "S7comm (Siemens)",
    44818: "EtherNet/IP (CIP)",
    2222: "EtherNet/IP (implicit)",
    4840: "OPC UA",
    20000: "DNP3",
    47808: "BACnet",
    1911: "Niagara Fox",
    789: "Crimson v3 (Red Lion)",
    2404: "IEC 60870-5-104",
    18245: "GE SRTP",
    5094: "HART-IP",
}

PURDUE_LEVEL_RANGES = {
    "Level 0-1 (Field Devices)": ["10.10.0.0/16", "192.168.10.0/24"],
    "Level 2 (Control Systems)": ["10.20.0.0/16", "192.168.20.0/24"],
    "Level 3 (Site Operations)": ["10.30.0.0/16", "192.168.30.0/24"],
    "Level 3.5 (DMZ)": ["172.16.0.0/16"],
    "Level 4 (Enterprise)": ["10.0.0.0/16"],
}


def classify_purdue_level(ip_addr):
    """Classify an IP address to its Purdue Reference Model level."""
    from ipaddress import ip_address, ip_network

    addr = ip_address(ip_addr)
    for level, subnets in PURDUE_LEVEL_RANGES.items():
        for subnet in subnets:
            if addr in ip_network(subnet):
                return level
    return "Unknown"


def analyze_ot_pcap(pcap_file):
    """Analyze pcap file to discover OT assets and communication patterns."""
    packets = rdpcap(pcap_file)

    assets = {}
    connections = defaultdict(lambda: {"count": 0, "protocols": set(), "ports": set()})
    protocol_stats = defaultdict(int)
    cross_zone_flows = []

    for pkt in packets:
        if not pkt.haslayer(IP):
            continue

        src_ip = pkt[IP].src
        dst_ip = pkt[IP].dst

        # Track assets
        for ip in (src_ip, dst_ip):
            if ip not in assets:
                assets[ip] = {
                    "ip": ip,
                    "purdue_level": classify_purdue_level(ip),
                    "protocols_observed": set(),
                    "roles": set(),
                    "first_seen": str(pkt.time),
                    "last_seen": str(pkt.time),
                    "mac": None,
                }
            assets[ip]["last_seen"] = str(pkt.time)

        # Identify OT protocols by port
        dst_port = None
        if pkt.haslayer(TCP):
            dst_port = pkt[TCP].dport
        elif pkt.haslayer(UDP):
            dst_port = pkt[UDP].dport

        if dst_port and dst_port in OT_PROTOCOL_PORTS:
            protocol_name = OT_PROTOCOL_PORTS[dst_port]
            protocol_stats[protocol_name] += 1
            assets[src_ip]["protocols_observed"].add(protocol_name)
            assets[dst_ip]["protocols_observed"].add(protocol_name)

            # Determine roles
            assets[src_ip]["roles"].add("client/master")
            assets[dst_ip]["roles"].add("server/slave")

        # Track connections
        conn_key = (src_ip, dst_ip)
        connections[conn_key]["count"] += 1
        if dst_port:
            connections[conn_key]["ports"].add(dst_port)
            if dst_port in OT_PROTOCOL_PORTS:
                connections[conn_key]["protocols"].add(OT_PROTOCOL_PORTS[dst_port])

        # Detect cross-zone communication
        src_level = classify_purdue_level(src_ip)
        dst_level = classify_purdue_level(dst_ip)
        if src_level != dst_level and src_level != "Unknown" and dst_level != "Unknown":
            cross_zone_flows.append({
                "src": src_ip,
                "src_level": src_level,
                "dst": dst_ip,
                "dst_level": dst_level,
                "protocol": OT_PROTOCOL_PORTS.get(dst_port, f"port/{dst_port}"),
            })

    return {
        "asset_count": len(assets),
        "assets": {ip: {k: list(v) if isinstance(v, set) else v for k, v in info.items()} for ip, info in assets.items()},
        "protocol_distribution": dict(protocol_stats),
        "total_connections": len(connections),
        "cross_zone_flows": cross_zone_flows[:50],
    }


def generate_assessment_report(results):
    """Generate the OT network assessment findings report."""
    report = []
    report.append("=" * 70)
    report.append("OT NETWORK PASSIVE DISCOVERY REPORT")
    report.append(f"Generated: {datetime.now().isoformat()}")
    report.append("=" * 70)

    report.append(f"\nTotal Assets Discovered: {results['asset_count']}")
    report.append(f"Total Unique Connections: {results['total_connections']}")

    report.append("\n--- INDUSTRIAL PROTOCOL DISTRIBUTION ---")
    for proto, count in sorted(results["protocol_distribution"].items(), key=lambda x: -x[1]):
        report.append(f"  {proto}: {count} packets")

    report.append("\n--- CROSS-ZONE COMMUNICATION FLOWS ---")
    if results["cross_zone_flows"]:
        for flow in results["cross_zone_flows"][:20]:
            report.append(
                f"  {flow['src']} ({flow['src_level']}) -> "
                f"{flow['dst']} ({flow['dst_level']}) via {flow['protocol']}"
            )
    else:
        report.append("  No cross-zone flows detected (check subnet classifications)")

    report.append("\n--- FINDINGS ---")
    # Check for Level 4 to Level 0-1 direct connections (critical finding)
    for flow in results["cross_zone_flows"]:
        if "Level 4" in flow["src_level"] and "Level 0-1" in flow["dst_level"]:
            report.append(
                f"  [CRITICAL] Direct Enterprise-to-Field traffic: "
                f"{flow['src']} -> {flow['dst']} via {flow['protocol']}"
            )
        elif "Level 4" in flow["src_level"] and "Level 2" in flow["dst_level"]:
            report.append(
                f"  [HIGH] Enterprise-to-Control traffic bypassing DMZ: "
                f"{flow['src']} -> {flow['dst']} via {flow['protocol']}"
            )

    return "\n".join(report)


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python ot_network_discovery.py <pcap_file>")
        sys.exit(1)

    results = analyze_ot_pcap(sys.argv[1])
    print(generate_assessment_report(results))

    # Save detailed JSON
    output_file = sys.argv[1].replace(".pcap", "_inventory.json")
    with open(output_file, "w") as f:
        json.dump(results, f, indent=2, default=str)
    print(f"\nDetailed inventory saved to: {output_file}")

Step 3: Evaluate Firewall Rules Between Purdue Zones

Analyze firewall configurations between OT zones to identify overly permissive rules, missing deny defaults, and unauthorized conduits that violate the IEC 62443 zone model.

#!/usr/bin/env python3
"""OT Zone Firewall Rule Analyzer.

Parses firewall rule exports (CSV format) and evaluates them against
IEC 62443 zone/conduit model requirements.
"""

import csv
import json
import sys
from dataclasses import dataclass, field
from typing import Optional


@dataclass
class FirewallRule:
    rule_id: str
    source_zone: str
    source_ip: str
    dest_zone: str
    dest_ip: str
    service: str
    port: str
    action: str
    enabled: bool
    comment: str = ""


# IEC 62443 zone communication policy
# Defines which zone pairs are allowed to communicate and through what conduit
ALLOWED_CONDUITS = {
    ("Level 4", "Level 3.5"): {
        "allowed_ports": [443, 3389, 22],
        "description": "Enterprise to DMZ - web services, jump hosts",
        "requires_inspection": True,
    },
    ("Level 3.5", "Level 3"): {
        "allowed_ports": [443, 1433, 5432, 8080],
        "description": "DMZ to Site Ops - historian mirror, OPC relay",
        "requires_inspection": True,
    },
    ("Level 3", "Level 2"): {
        "allowed_ports": [502, 44818, 4840, 102],
        "description": "Site Ops to Control - OPC UA, Modbus, S7comm",
        "requires_inspection": True,
    },
    ("Level 2", "Level 1"): {
        "allowed_ports": [502, 44818, 102, 2222],
        "description": "Control to Field - direct industrial protocols",
        "requires_inspection": False,
    },
}

# Prohibited direct connections
PROHIBITED_CONDUITS = [
    ("Level 4", "Level 3"),
    ("Level 4", "Level 2"),
    ("Level 4", "Level 1"),
    ("Level 4", "Level 0"),
    ("Level 3", "Level 1"),
    ("Level 3", "Level 0"),
    ("Internet", "Level 3.5"),
    ("Internet", "Level 3"),
    ("Internet", "Level 2"),
    ("Internet", "Level 1"),
]


def parse_firewall_rules(csv_file):
    """Parse firewall rules from CSV export."""
    rules = []
    with open(csv_file, "r") as f:
        reader = csv.DictReader(f)
        for row in reader:
            rules.append(FirewallRule(
                rule_id=row.get("rule_id", ""),
                source_zone=row.get("source_zone", ""),
                source_ip=row.get("source_ip", ""),
                dest_zone=row.get("dest_zone", ""),
                dest_ip=row.get("dest_ip", ""),
                service=row.get("service", ""),
                port=row.get("port", ""),
                action=row.get("action", ""),
                enabled=row.get("enabled", "true").lower() == "true",
                comment=row.get("comment", ""),
            ))
    return rules


def analyze_rules(rules):
    """Analyze firewall rules against IEC 62443 zone model."""
    findings = {"critical": [], "high": [], "medium": [], "low": [], "info": []}

    for rule in rules:
        if not rule.enabled or rule.action.lower() != "allow":
            continue

        zone_pair = (rule.source_zone, rule.dest_zone)
        port = int(rule.port) if rule.port.isdigit() else 0

        # Check for prohibited conduits
        if zone_pair in PROHIBITED_CONDUITS:
            findings["critical"].append({
                "rule_id": rule.rule_id,
                "finding": f"Prohibited direct connection: {rule.source_zone} -> {rule.dest_zone}",
                "detail": f"Rule allows {rule.source_ip} to reach {rule.dest_ip}:{rule.port} ({rule.service})",
                "remediation": "Remove rule. Route traffic through DMZ (Level 3.5) with application-layer inspection.",
            })

        # Check for overly broad rules (any/any)
        elif rule.source_ip in ("any", "0.0.0.0/0") or rule.dest_ip in ("any", "0.0.0.0/0"):
            findings["high"].append({
                "rule_id": rule.rule_id,
                "finding": f"Overly permissive rule with 'any' address",
                "detail": f"{rule.source_ip} -> {rule.dest_ip}:{rule.port} in {zone_pair}",
                "remediation": "Restrict to specific host IPs per IEC 62443 least-privilege conduit policy.",
            })

        # Check allowed conduits for port violations
        elif zone_pair in ALLOWED_CONDUITS:
            conduit = ALLOWED_CONDUITS[zone_pair]
            if port and port not in conduit["allowed_ports"]:
                findings["medium"].append({
                    "rule_id": rule.rule_id,
                    "finding": f"Unauthorized port in conduit {zone_pair}",
                    "detail": f"Port {port} ({rule.service}) not in allowed list {conduit['allowed_ports']}",
                    "remediation": f"Remove port {port} from conduit or justify in risk assessment.",
                })

    return findings


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python ot_firewall_analyzer.py <rules.csv>")
        sys.exit(1)

    rules = parse_firewall_rules(sys.argv[1])
    findings = analyze_rules(rules)

    print("=" * 70)
    print("OT ZONE FIREWALL RULE ANALYSIS")
    print("=" * 70)
    for severity in ["critical", "high", "medium", "low"]:
        if findings[severity]:
            print(f"\n--- {severity.upper()} FINDINGS ({len(findings[severity])}) ---")
            for f in findings[severity]:
                print(f"  [{f['rule_id']}] {f['finding']}")
                print(f"    Detail: {f['detail']}")
                print(f"    Fix: {f['remediation']}")

Step 4: Assess Industrial Protocol Security

Evaluate the security configuration of industrial protocols in use, checking for authentication, encryption, and access controls.

# Capture Modbus/TCP traffic for analysis
tcpdump -i eth0 -w ot_capture.pcap 'port 502 or port 44818 or port 4840 or port 102 or port 20000' -c 100000

# Use Wireshark with OT protocol dissectors for deep inspection
tshark -r ot_capture.pcap -Y "modbus" -T fields \
  -e ip.src -e ip.dst -e modbus.func_code -e modbus.reference_num \
  -e modbus.word_cnt > modbus_analysis.csv

# Check for unauthenticated Modbus write operations (function codes 5,6,15,16)
tshark -r ot_capture.pcap -Y "modbus.func_code >= 5 && modbus.func_code <= 16" \
  -T fields -e ip.src -e ip.dst -e modbus.func_code -e frame.time

# Scan for OPC UA servers and check security policies
# Only run against Level 3+ systems with explicit authorization
python3 -c "
from opcua import Client
server_url = 'opc.tcp://10.30.1.50:4840'
client = Client(server_url)
endpoints = client.connect_and_get_server_endpoints()
for ep in endpoints:
    print(f'Endpoint: {ep.EndpointUrl}')
    print(f'  Security Mode: {ep.SecurityMode}')
    print(f'  Security Policy: {ep.SecurityPolicyUri}')
    print(f'  Auth Tokens: {[t.TokenType for t in ep.UserIdentityTokens]}')
"

Step 5: Generate Assessment Report

Compile findings into a structured report aligned with IEC 62443 and NIST SP 800-82 Rev.3.

OT Network Security Assessment Report
=======================================
Facility: Chemical Processing Plant - Site Alpha
Assessment Date: 2026-02-23
Standard: IEC 62443-3-3 / NIST SP 800-82r3
Assessor: [Assessor Name]

EXECUTIVE SUMMARY:
  The OT network assessment identified 47 assets across Purdue levels 0-4.
  12 critical and 23 high-severity findings were identified, primarily
  related to insufficient network segmentation, unauthenticated industrial
  protocols, and unauthorized cross-zone communication paths.

ASSET INVENTORY SUMMARY:
  Level 0-1 (Field):    18 devices (PLCs, RTUs, I/O modules)
  Level 2 (Control):     9 devices (HMIs, engineering workstations)
  Level 3 (Operations): 12 devices (historians, OPC servers, app servers)
  Level 3.5 (DMZ):       3 devices (data diode, jump server, patch server)
  Level 4 (Enterprise):  5 devices (domain controllers, file servers)

CRITICAL FINDINGS:
  [OT-001] Direct Enterprise-to-PLC communication detected
    Source: 10.0.5.22 (Level 4 - IT workstation)
    Dest: 10.10.1.15 (Level 1 - Allen-Bradley PLC)
    Protocol: EtherNet/IP (port 44818)
    Impact: An attacker on the corporate network could directly modify PLC logic
    Remediation: Block direct L4-L1 traffic; route through DMZ proxy

  [OT-002] Modbus/TCP write commands without authentication
    Affected: 8 PLCs accepting unauthenticated FC6 (Write Single Register)
    Impact: Any device on the OT network can modify process setpoints
    Remediation: Deploy Modbus-aware firewall; restrict write-capable sources

  [OT-003] Flat network - no segmentation between Purdue levels
    Detail: All OT devices share VLAN 100 (10.10.0.0/16)
    Impact: Compromised HMI has direct access to all PLCs and SIS
    Remediation: Implement zone-based segmentation per IEC 62443-3-2

RISK MATRIX:
  Critical: 12 findings (immediate remediation required)
  High:     23 findings (remediate within 30 days)
  Medium:   15 findings (remediate within 90 days)
  Low:       8 findings (remediate in next maintenance cycle)

Key Concepts

Term	Definition
Purdue Reference Model	Hierarchical architecture model (Levels 0-5) for organizing industrial control systems, defining security zones from physical process to enterprise IT
IEC 62443	International standard series for industrial automation and control systems (IACS) security, defining security levels, zones, conduits, and security requirements
Zone	A grouping of logical or physical assets that share common security requirements, defined by IEC 62443-3-2
Conduit	A logical grouping of communication channels connecting two or more zones, subject to common security policies
SCADA	Supervisory Control and Data Acquisition - system architecture for high-level process supervisory management of industrial processes
DCS	Distributed Control System - control system architecture where control elements are distributed throughout the system
Air Gap	Physical isolation of OT networks from IT/internet, increasingly replaced by managed conduits with firewalls and data diodes
Safety Instrumented System (SIS)	Independent system designed to bring a process to a safe state when a hazardous condition is detected

Tools & Systems

• Nozomi Networks Guardian: Passive OT network monitoring platform providing asset discovery, vulnerability assessment, and anomaly detection for industrial environments
• Dragos Platform: OT cybersecurity platform with asset visibility, threat detection, and vulnerability management designed for critical infrastructure
• Claroty xDome: Cyber-physical systems protection platform providing comprehensive asset inventory and risk scoring across OT, IoT, and IIoT
• Wireshark/tshark: Network protocol analyzer with industrial protocol dissectors for Modbus, DNP3, S7comm, EtherNet/IP, OPC UA, and BACnet
• Nmap with OT scripts: Network scanner with NSE scripts for OT protocol enumeration (use only on Level 2+ with authorization)
• Grassmarlin: NSA-developed passive OT network mapping tool for identifying SCADA/ICS network topology

Common Scenarios

Scenario: Flat OT Network with No Segmentation

Context: A water utility has all OT devices on a single VLAN. Passive network monitoring reveals HMIs, PLCs, historians, and a domain controller all sharing the same Layer 2 broadcast domain. There is no DMZ between the corporate network and the OT environment.

Approach:

1. Deploy passive monitoring on the SPAN port to capture a complete communication baseline over 2-4 weeks
2. Map all device-to-device communication flows with protocols and data volumes
3. Classify assets into Purdue levels based on their function and communication patterns
4. Design zone architecture with VLANs and inter-zone firewalls per IEC 62443-3-2
5. Prioritize DMZ creation between Level 3 and Level 4 as the highest-impact segmentation
6. Present segmentation plan with migration phases that avoid production disruption

Pitfalls: Active scanning PLCs during production can cause communication timeouts and process disruptions. Implementing segmentation without a complete traffic baseline will break legitimate control system communications. Relying solely on network-layer firewalls without industrial protocol inspection leaves Modbus/TCP and EtherNet/IP write commands unchecked.

Output Format

OT Network Security Assessment Report
=======================================
Facility: [Facility Name]
Assessment Date: YYYY-MM-DD
Standard: IEC 62443-3-3 / NIST SP 800-82r3

EXECUTIVE SUMMARY:
  [2-3 sentence overview of findings and risk level]

ASSET INVENTORY:
  Level 0-1: [count] field devices
  Level 2:   [count] control systems
  Level 3:   [count] operations systems
  Level 3.5: [count] DMZ systems
  Level 4:   [count] enterprise systems

FINDINGS BY SEVERITY:
  Critical: [count] (immediate action required)
  High:     [count] (30-day remediation)
  Medium:   [count] (90-day remediation)
  Low:      [count] (next maintenance window)

DETAILED FINDINGS:
  [OT-NNN] Finding Title
    Severity: Critical|High|Medium|Low
    Affected Assets: [list]
    IEC 62443 Reference: [section]
    NIST 800-82r3 Reference: [section]
    Description: [technical detail]
    Impact: [operational and safety impact]
    Remediation: [specific technical remediation steps]

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

OT Network Security Assessment Report Template

Document Information

Field	Value
Facility	[Facility Name and Location]
Assessment Date	YYYY-MM-DD to YYYY-MM-DD
Lead Assessor	[Name, Certification]
Standard	IEC 62443-3-3 / NIST SP 800-82r3
Classification	[Confidential / Internal Use Only]
Report Version	1.0

Executive Summary

[2-3 paragraphs summarizing the assessment scope, methodology, key findings, and overall risk rating. Written for C-level and operations management audience.]

Overall Risk Rating: [Critical / High / Moderate / Low]

Key Statistics:

• Total OT assets discovered: [N]
• Critical findings: [N]
• High findings: [N]
• Unauthenticated protocol exposures: [N]
• Cross-zone violations: [N]

1. Scope and Methodology

1.1 Assessment Scope

Purdue Level	In Scope	Activity Type
Level 0-1 (Field)	Yes/No	Passive Only
Level 2 (Control)	Yes/No	Passive + Limited Active
Level 3 (Operations)	Yes/No	Active Permitted
Level 3.5 (DMZ)	Yes/No	Active Permitted
Level 4 (Enterprise)	Yes/No	Active Permitted

1.2 Exclusions

• [List safety-critical systems excluded from assessment]
• [List maintenance windows utilized for active testing]

1.3 Methodology

• Passive network monitoring via SPAN ports ([duration])
• Industrial protocol deep packet inspection
• Firewall rule analysis
• [Other assessment activities performed]

1.4 Tools Used

2. Asset Inventory

2.1 Asset Summary by Purdue Level

Level	Device Type	Count	Key Vendors
Level 0-1	PLCs, RTUs, I/O	[N]	[Vendors]
Level 2	HMI, EWS	[N]	[Vendors]
Level 3	Historian, OPC	[N]	[Vendors]
Level 3.5	DMZ systems	[N]	[Vendors]
Level 4	Enterprise	[N]	[Vendors]

2.2 Industrial Protocol Distribution

Protocol	Port	Packet Count	Device Count	Auth Support
Modbus/TCP	502	[N]	[N]	No
EtherNet/IP	44818	[N]	[N]	No
OPC UA	4840	[N]	[N]	Yes
S7comm	102	[N]	[N]	No
DNP3	20000	[N]	[N]	Optional

3. Network Architecture Assessment

3.1 Zone Architecture Evaluation

[Assessment of current zone/conduit architecture against IEC 62443-3-2]

3.2 Cross-Zone Communication Analysis

[Summary of authorized and unauthorized cross-zone communication flows]

3.3 Firewall Rule Analysis

[Summary of firewall rule review findings]

4. Findings

4.1 Finding Template

Finding ID: OT-[NNN]
Severity: [Critical / High / Medium / Low]
Title: [Finding Title]
Affected Assets: [Asset list]
IEC 62443 Reference: [Section reference]
NIST 800-82r3 Reference: [Section reference]

Description:
[Detailed technical description of the finding]

Evidence:
[Screenshots, packet captures, or tool output demonstrating the finding]

Operational Impact:
[Impact on process safety, availability, and operations]

Remediation:
[Specific technical steps to remediate the finding]

Compensating Controls:
[Interim measures if immediate remediation is not feasible]

4.2 Critical Findings

[List all critical findings using template above]

4.3 High Findings

[List all high findings]

4.4 Medium Findings

[List all medium findings]

4.5 Low Findings

[List all low findings]

5. Risk Matrix

Finding ID	Likelihood	Safety Impact	Operational Impact	Overall Risk
OT-001	[H/M/L]	[H/M/L]	[H/M/L]	[Critical/High/Medium/Low]

6. Remediation Roadmap

Phase 1: Immediate (0-30 days)

• [Critical finding remediation items]

Phase 2: Short-term (30-90 days)

• [High finding remediation items]

Phase 3: Medium-term (90-180 days)

• [Medium finding remediation items]

Phase 4: Long-term (6-12 months)

• [Architecture improvements and low findings]

7. Compliance Gap Analysis

IEC 62443-3-3 Compliance

Requirement	Status	Gap Description
SR 1.1 Human User IAC	[Met/Partial/Not Met]	[Gap detail]
SR 2.1 Authorization Enforcement	[Met/Partial/Not Met]	[Gap detail]
SR 3.1 Communication Integrity	[Met/Partial/Not Met]	[Gap detail]
SR 5.1 Network Segmentation	[Met/Partial/Not Met]	[Gap detail]

Appendices

Appendix A: Complete Asset Inventory

[Detailed asset list with IPs, MACs, firmware versions, protocols]

Appendix B: Network Diagrams

[Updated network topology diagrams showing discovered assets and flows]

Appendix C: Firewall Rule Analysis Detail

[Complete firewall rule review with per-rule assessment]

Appendix D: Tool Output

[Relevant tool output and packet captures]

references/api-reference.md (verbatim)

API Reference — Performing OT Network Security Assessment

Libraries Used

• csv: Parse asset inventories and firewall rule exports
• subprocess: Execute nmap for OT protocol scanning
• xml.etree.ElementTree: Parse nmap XML output

CLI Interface

python agent.py assets --csv ot_inventory.csv
python agent.py segmentation --csv firewall_rules.csv
python agent.py protocols --subnet 192.168.1.0/24
python agent.py report --assets inventory.csv [--firewall fw_rules.csv]

Core Functions

assess_asset_inventory(csv_file) — Purdue model zone analysis

Groups assets by Purdue level. Flags end-of-life and unknown firmware.

assess_network_segmentation(csv_file) — Firewall rule audit

Detects: direct IT-to-OT access (CRITICAL), allow-any-protocol rules (HIGH).

scan_ot_protocols(target_subnet) — OT protocol discovery

Scans ports: 102 (S7), 502 (Modbus), 4840 (OPC-UA), 44818 (EtherNet/IP), 47808 (BACnet), 20000 (DNP3).

generate_assessment_report(...) — Comprehensive report

OT Protocol Ports

Port	Protocol	Usage
102	S7Comm	Siemens S7 PLCs
502	Modbus TCP	Industrial automation
4840	OPC-UA	Industrial data exchange
44818	EtherNet/IP	Allen-Bradley PLCs
47808	BACnet	Building automation
20000	DNP3	SCADA/utility

Dependencies

System: nmap (optional, for protocol scanning) No Python packages required.

references/standards.md (verbatim)

Standards Reference - OT Network Security Assessment

IEC 62443 (ISA/IEC 62443)

IEC 62443-1-1: Terminology, Concepts, and Models

• Defines foundational concepts including zones, conduits, security levels, and the IACS reference architecture
• Establishes the vocabulary used across all parts of the standard

IEC 62443-2-1: Security Management System Requirements

• Requirements for an IACS security management system (SMS)
• Covers risk assessment, security policies, organization, staff competence, and awareness

IEC 62443-3-2: Security Risk Assessment for System Design

• Defines the process for partitioning an IACS into zones and conduits
• Establishes Security Level targets (SL-T) for each zone based on risk assessment
• Zone characteristics: assets, access points, communication channels, data flows
• Conduit characteristics: connected zones, protocols, security countermeasures

IEC 62443-3-3: System Security Requirements and Security Levels

• Foundational requirements (FR) mapped to security levels (SL 1-4):
  • FR 1: Identification and Authentication Control (IAC)
  • FR 2: Use Control (UC)
  • FR 3: System Integrity (SI)
  • FR 4: Data Confidentiality (DC)
  • FR 5: Restricted Data Flow (RDF)
  • FR 6: Timely Response to Events (TRE)
  • FR 7: Resource Availability (RA)

Security Levels

Level	Description
SL 1	Protection against casual or coincidental violation
SL 2	Protection against intentional violation using simple means
SL 3	Protection against sophisticated attack with moderate resources
SL 4	Protection against state-sponsored attack with extensive resources

NIST SP 800-82 Revision 3

Guide to Operational Technology (OT) Security

• Published September 2023, replacing the ICS-focused Rev. 2
• Expanded scope covers: ICS/SCADA, building automation, transportation, physical access control, physical environment monitoring
• Provides OT overlay for NIST SP 800-53r5 security controls
• Tailored security control baselines for low/moderate/high-impact OT systems

Key Sections for Network Assessment

• Section 3: OT Overview and Architectures (Purdue Model reference)
• Section 4: OT Risk Management
• Section 5: OT Security Architecture (network segmentation, DMZ design)
• Section 6: Applying Security Controls to OT (overlay guidance)

OT-Specific Control Tailoring

• AC-4 (Information Flow Enforcement): Implement data diodes for unidirectional flows from Level 3 to Level 3.5
• SC-7 (Boundary Protection): Industrial firewalls with protocol-aware deep packet inspection
• AU-6 (Audit Record Review): Correlate OT network events with process alarms

NERC CIP Standards (Power Sector)

CIP-002-5.1a: BES Cyber System Categorization

• Identify and categorize Bulk Electric System (BES) cyber systems as high, medium, or low impact

CIP-005-7: Electronic Security Perimeters

• Define Electronic Security Perimeters (ESP) around BES cyber systems
• Require Electronic Access Points (EAP) at all ESP boundaries
• 2025 update requires MFA for remote access to medium and high-impact systems

CIP-007-6: System Security Management

• Port and service management, security patch management
• Malicious code prevention, security event monitoring
• System access controls and authentication

CIP-010-4: Configuration Change Management and Vulnerability Assessments

• Baseline configurations for BES cyber systems
• Transient cyber asset and removable media management
• Active vulnerability assessments at least every 15 months

Purdue Reference Model (ISA-95)

Level Architecture

Level	Name	Examples
Level 0	Physical Process	Sensors, actuators, analyzers
Level 1	Basic Control	PLCs, RTUs, safety controllers
Level 2	Area Supervisory Control	HMI, engineering workstations, local historian
Level 3	Site Operations	OPC servers, site historian, MES
Level 3.5	DMZ	Data diodes, jump servers, patch servers
Level 4	Enterprise	ERP, email, corporate IT
Level 5	Internet/Cloud	Remote access, cloud services

references/workflows.md (verbatim)

Workflows - OT Network Security Assessment

Assessment Lifecycle

Phase 1: Scoping          Phase 2: Discovery       Phase 3: Analysis
+-----------------+       +-----------------+      +-----------------+
| Define scope    |       | Passive capture |      | Protocol review |
| Safety limits   | ----> | Asset inventory | ---> | Zone evaluation |
| Authorization   |       | Traffic mapping |      | Firewall audit  |
+-----------------+       +-----------------+      +-----------------+
                                                          |
Phase 6: Verify           Phase 5: Remediate       Phase 4: Report
+-----------------+       +-----------------+      +-----------------+
| Validate fixes  |       | Segmentation    |      | Risk scoring    |
| Re-assessment   | <---- | FW rule changes | <--- | Finding detail  |
| Compliance map  |       | Protocol harden |      | Prioritization  |
+-----------------+       +-----------------+      +-----------------+

Phase 1: Scoping and Authorization

Inputs

• Facility type and industry vertical
• Regulatory requirements (NERC CIP, IEC 62443, NIST CSF)
• Existing network diagrams and asset inventories
• Maintenance window schedules

Activities

1. Meet with operations, engineering, and IT security teams
2. Define Purdue levels in scope and safety-critical exclusions
3. Obtain written authorization specifying permitted assessment activities
4. Identify SPAN/TAP points for passive monitoring deployment
5. Review prior assessment reports and known issues

Outputs

• Signed Rules of Engagement document
• Assessment scope matrix (Purdue levels vs. activity types)
• SPAN/TAP deployment plan
• Emergency contact list and escalation procedures

Phase 2: Passive Network Discovery

Inputs

• SPAN port access on OT network switches
• Assessment scope document

Activities

1. Deploy passive monitoring sensors on SPAN ports at each Purdue level boundary
2. Capture network traffic for minimum 2 weeks to observe full operational cycle
3. Build asset inventory from observed traffic (MAC, IP, protocols, firmware versions)
4. Map all communication flows with source, destination, protocol, and frequency
5. Identify industrial protocols in use (Modbus, DNP3, OPC UA, EtherNet/IP, S7comm)
6. Detect unauthorized devices and rogue connections

Activities - Wireless Assessment

1. Scan for wireless access points in OT areas using spectrum analyzer
2. Identify wireless industrial protocols (WirelessHART, ISA100.11a, Zigbee)
3. Check for unauthorized Wi-Fi networks bridging IT and OT

Outputs

• Complete asset inventory with Purdue level classification
• Network communication flow map
• Protocol distribution analysis
• Unauthorized device/connection list

Phase 3: Analysis and Evaluation

Inputs

• Asset inventory and traffic capture data
• Firewall rule exports
• Network architecture diagrams

Activities

1. Evaluate zone architecture against IEC 62443-3-2 requirements
2. Analyze firewall rules for overly permissive or prohibited conduits
3. Assess industrial protocol security (authentication, encryption, access controls)
4. Review remote access architecture and authentication mechanisms
5. Evaluate patch levels of HMI, engineering workstations, and servers
6. Check for known vulnerabilities in discovered OT firmware versions
7. Assess physical security of network equipment in field locations

Outputs

• Finding list with severity ratings
• Gap analysis against applicable standards
• Risk matrix mapping findings to operational/safety impact

Phase 4: Reporting

Report Structure

1. Executive Summary (1 page)
2. Scope and Methodology
3. Asset Inventory Summary
4. Network Architecture Assessment
5. Detailed Findings (Critical/High/Medium/Low)
6. Compliance Gap Analysis
7. Remediation Roadmap with Prioritization
8. Appendices (asset inventory, network diagrams, tool output)

Phase 5: Remediation Support

Priority Order

1. Immediate: Block unauthorized cross-zone paths (enterprise to field devices)
2. 30-day: Implement DMZ between corporate IT and OT operations
3. 60-day: Deploy industrial protocol-aware firewalls between zones
4. 90-day: Harden remote access with MFA and jump servers
5. 6-month: Full zone/conduit segmentation per IEC 62443 design

Risk Scoring for OT Environments

OT risk scoring must account for safety impact beyond traditional CIA triad:

Factor	Weight	Description
Safety Impact	30%	Potential for physical harm to personnel or public
Operational Impact	25%	Production disruption or equipment damage
Environmental Impact	15%	Release of hazardous materials
Financial Impact	15%	Direct costs and regulatory penalties
Reputational Impact	15%	Public trust and regulatory scrutiny

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.