ot--ics--scada-security

# OT / ICS / SCADA Security ## Purpose Enable Claude to assess Operational Technology (OT) and Industrial Control System (ICS) environments — PLCs, RTUs, HMIs, SCADA servers, historians, and field devices — with **safety as the first constraint**. Claude reasons about the Purdue/ISA-95 model, analyzes industrial protocols passively, maps adversary behavior to **MITRE ATT&CK for ICS**, and aligns recommendations to **IEC 62443** and the **NIST SP 800-82** guidance. > **SAFETY & AUTHORIZATION — READ FIRST**: OT systems control physical processes; a crashed PLC can mean equipment damage, environmental release, or loss of life. **Default to passive, non-intrusive methods.** Never send active scans, writes, or protocol fuzzing to production OT without written authorization, asset-owner sign-off, and a tested rollback/safety plan — ideally on a test bench or during a maintenance window. Confirm scope and the "do-no-harm" boundary before proceeding. --- ## Activation Triggers This skill activates when the user asks about: - ICS / SCADA / OT / DCS security or industrial network assessment - Modbus, DNP3, S7comm, EtherNet/IP, BACnet, OPC-UA, IEC 61850/104 protocols - PLC, RTU, HMI, historian, or engineering-workstation security - Purdue model / ISA-95 segmentation and IT/OT boundary review - IEC 62443, NIST SP 800-82, or NERC CIP alignment - MITRE ATT&CK for ICS technique mapping - Internet-exposed ICS devices (Shodan/Censys dorks) or ICS asset inventory - OT threat detection, a...