Inside the ICS/SCADA Lab Environment
Every other security discipline protects information. This one protects a plant.
In 2021 someone remotely accessed the systems at a water treatment facility in Oldsmar, Florida, and raised the sodium hydroxide level in the town's water supply from 100 parts per million to 11,100. It was caught because an operator happened to be looking at his screen at the right moment.
That's the difference, stated as plainly as it can be. When IT security fails, data leaks. When OT security fails, the physical world changes — chemicals, pressure, temperature, turbines, things that move.
Which is precisely why ICS/SCADA security is a higher priority than traditional IT security, and why the threats against it are purpose-built rather than opportunistic: Stuxnet, Triton/TRISIS, and state-backed teams whose entire remit is energy infrastructure.
The gap this training sits in
Most security professionals have never touched an OT network. Most OT engineers have never done security.
The overlap between those two groups is nearly empty — and every factory, utility, refinery, water plant and manufacturing line needs someone standing in it. This isn't a scarcity claim invented for a course description. It's the actual condition of the market.
What you'll practise
The labs run through the ICS/SCADA curriculum, taught around a single premise: think like the attacker to defend the plant.
Introduction to ICS/SCADA network defence — with hands-on labs on the security model, and on safely allowing a service through.
TCP/IP 101 — grounding that exists because OT networks break the assumptions IT people carry in with them.
Introduction to hacking — including a lab on attacking ICS/SCADA network protocols. This is the conceptual centre of the whole course. These protocols were designed decades ago for reliability inside a closed, trusted environment. Authentication wasn't omitted by accident; it was omitted because nothing hostile was ever supposed to be on the wire. That single design decision is the root of most of what follows.
Vulnerability management — with a hands-on vulnerability assessment lab. Patching a plant bears no resemblance to patching a server farm. You cannot reboot a running process because a vendor released an update on Tuesday.
Standards and regulations for cybersecurity — the compliance frameworks governing critical infrastructure.
Securing the ICS network.
Bridging the air gap — best practices for the gap that, in practice, almost never exists. Someone always needs data out of the control network, and that requirement is where the air gap quietly dies.
Introduction to intrusion detection and prevention — with labs on intrusion detection and on ICS malware analysis.
The program is led by SCADA specialist Kevin Cardwell, and the material is built around real oil, gas and utility network architecture rather than generic examples.
What's in the box
- Official EC-Council iLabs — 6 months from activation
- Step-by-step hands-on guide for every lab
- Browser-based — nothing to install, works from anywhere
Which matters more here than anywhere else in the catalogue, because the alternative is practising on a live plant. There is no version of that which ends well for anyone.
Why a lab is the only realistic way to learn this
IT security people can build a home lab. Spin up VMs, break things, rebuild.
You cannot do that with a control system. The equipment costs a fortune, the software is licensed to industrial customers, and the failure modes involve physical machinery. Nobody is running a Modbus test bench in their spare room.
So the options are: learn on a range, or learn on production. One of those is a training environment. The other is a news story.
Who this is for
- IT professionals responsible for infrastructure security policy at industrial organisations
- Business system analysts supporting SCADA interfaces
- System administrators and engineers administering, patching or securing ICS/SCADA
- Security consultants performing assessments of SCADA or ICS environments
- Anyone at a utility, plant, refinery or manufacturer who has been handed OT security along with no training and no budget
Prerequisites — take these seriously
EC-Council expects:
- Linux fundamentals, including basic command line usage
- Conceptual knowledge of programming or scripting
- Solid grasp of essential networking — OSI model, TCP/IP, devices, transmission media
- Understanding of basic security concepts — malware, IDS, firewalls, vulnerabilities
- Familiarity with traffic inspection tools (Wireshark, TShark, TCPdump) strongly recommended
This is not a beginner course, and arriving without those will waste your six months. Get them first.
Common questions
Is this the genuine EC-Council platform? Yes. The same iLabs environment EC-Council uses.
How long is access? Six months from activation.
Do I need an ICS background? No, but you need IT and networking fundamentals. The course supplies the ICS context.
Does this include the exam voucher? No. Lab access.
0 comments