Operational technology, the PLCs, sensors and control networks that run physical processes like chemical plants, water systems and power grids, was traditionally built to be reliable, not secure. The protocols trust anything that talks to them, the devices can't run antivirus, and you usually can't just patch and reboot a running plant. OT Defense with GRFICSv3 is a hands-on course that teaches you to defend a real industrial control system the way a plant security engineer actually has to: by knowing your network, segmenting it, watching the right traffic, and having a plan for when something gets through.
You'll work in GRFICSv3, a full simulated chemical plant you run on your own machine: a live PLC, an operator HMI, an engineering workstation, a segmenting firewall, and a SIEM. Over ten short chapters you'll take the same attacks that can blow up the simulated reactor and learn to prevent them, catch them, and respond to them.
Who this course is for
IT security professionals moving into OT, plant and controls engineers taking on security responsibilities, students, and anyone curious about how industrial systems are attacked and defended. It is a companion to the attack-focused course Intro to OT Security with GRFICSv3, but it stands completely on its own, every attack you need to understand is explained and re-run from the defender's side here, so you don't need to have taken the attack course first.
No prior OT experience required. If terms like PLC, HMI and Modbus are new to you, Chapter 1 introduces every one of them before you touch a tool. What you do need is covered under "What you'll need" below.
What you'll be able to do
By the end of the course you'll be able to:
- Explain why defending a plant is different from defending an office network, and what that changes about your priorities.
- Baseline normal OT network traffic and spot what doesn't belong, using DNS logs and flow data.
- Segment a control network and write firewall allowlists that permit only the connections a plant actually needs.
- Detect rogue Modbus commands and man-in-the-middle attacks with Suricata and ARP monitoring, and route the alerts into a SIEM.
- Protect PLC logic from unauthorized changes and detect when it's been tampered with.
- Investigate an incident across your tools and walk through a structured response.
- Put it all together in a capstone: a mystery attack you have to detect, identify and explain using only the defenses you built.
Tools you'll use
Everything runs inside the GRFICSv3 lab:
- OpenPLC — the programmable logic controller running the reactor.
- ScadaLTS — the operator HMI.
- A router/firewall with a web UI for segmentation, allowlisting, DNS logging and ARP monitoring.
- Suricata — intrusion detection tuned for OT traffic.
- Wazuh — a SIEM/EDR that collects and correlates the alerts.
- Zeek (optional, where your setup supports it) — network monitoring that catches attacks the others miss.
What you'll need
- The lab. GRFICSv3 installed and runnable with
dockeron your machine. The simulation is resource-hungry — plan for a machine with at least 8 GB of RAM free (16 GB recommended). - Comfort with the basics. You should be able to open a terminal and run a command, and recognize an IP address (like
192.168.95.2) and a network port (like502). No prior OT, PLC or Modbus experience needed. - A Linux or WSL2 host for the full experience. The lab runs best on native Linux or on Windows via a WSL2 Ubuntu distribution running Docker Engine. If you're on Windows with Docker Desktop or on a Mac without a Linux VM, everything still works except the optional Zeek network-mirror exercises; those chapters tell you when that applies and what to do instead.