WS7 - Purple Teaming Industrial Control Systems

Instructed by:  Arnaud SOULLIE 

Level of Difficulty: Beginner, Intermediate, Advanced, Expert

Abstract:

Security monitoring is often presented as the silver bullet for Industrial Control System (ICS) security - but how effective is it against realistic adversaries?

In this 4-hour, hands-on workshop, participants will use CALDERA, the open-source adversary emulation framework, to conduct purple-team exercises against simulated & live industrial environments. Attendees will simulate real-world IT and OT attacks, observe what is (and is not) detected across EDR, logs, and network monitoring, and map results to MITRE ATT&CK for ICS.

Rather than focusing on exploitation alone, this workshop teaches a repeatable methodology to assess detection coverage, identify OT blind spots, and improve monitoring strategies. Participants leave with concrete techniques they can apply in their own environments - from tabletop exercises to continuous detection testing.

Pre-Requisites:

No prior knowledge required, we'll have an ICS/detection intro at the beginning to make sure everyone has some notions.