OT / ICS Security — Multi-Vendor Plant Desk
One course for the plant network, not one vendor brochure. You learn Purdue zones, safe change-control, and how Nozomi, Claroty, Dragos, Fortinet OT, Palo Alto OT, Cisco Cyber Vision, Armis and Defender for IoT actually get used on a ticket. GICSP / IEC 62443 exam prep and a Techclick certificate. Fee ₹25,000.
Who Is This For
- IT security engineers walking into a plant / substation / factory for the first time
- SOC analysts who now receive OT alerts from Nozomi, Claroty or Dragos
- Firewall / SASE engineers asked to put an NGFW or jump-host next to a PLC
- Consultants who must compare OT visibility vendors without a sales slide
- Anyone sitting GICSP or IEC 62443-oriented exams
Prerequisites
- TCP/IP, VLANs and a basic firewall idea
- Comfort reading a log line and a change ticket
- Helpful: one IT SOC or NGFW course (Palo Alto, FortiGate or Sentinel)
- No PLC programming required — we teach what you must not touch
Vendors in this course
You do not become a certified specialist in every box. You learn the same plant ticket on each vendor: what it sees, what it cannot see, and what you say on the bridge. That is how interviews and site work actually go.
| Job on the plant | Vendors you will name | What you must quote |
|---|---|---|
| Asset visibility | Nozomi Guardian, Claroty xDome / CTD, Dragos Platform, Armis, Microsoft Defender for IoT, Tenable.ot | Asset, protocol, firmware, last-seen — not a CVE dump |
| Threat detection | Nozomi, Claroty, Dragos WorldView, FortiGate OT, Palo Alto OT signatures | Protocol anomaly vs malware vs “engineer laptop” |
| Zone / conduit firewall | Palo Alto OT, Fortinet OT, Check Point OT, Cisco ISA / Cyber Vision | Purdue level, allow-list, fail-safe |
| Remote access | Claroty Secure Access, vendor jump, PAM, ZTNA | Session, who, how long, who approved |
| Frameworks | IEC 62443, NIST SP 800-82, MITRE ATT&CK for ICS, Purdue | Zone, SL, FR — not “we installed a sensor” |
Fee, exam preparation and certificate
The full OT / ICS Security multi-vendor course fee is ₹25,000. That is one price for live classes, recordings, workbook, dummy plant tickets, GICSP and IEC 62443 exam preparation, interview practice, and the Techclick Infosec completion certificate.
Vendor product exams (Nozomi, Claroty, Dragos, Fortinet NSE OT, Palo Alto OT) are separate. This course prepares the common desk first, then maps each vendor so you can sit their exam later without starting from zero.
- ₹25,000 full track · 40 live hours · 16 classes
- Exam path: GIAC GICSP and IEC 62443 concepts
- Techclick certificate after capstone + knowledge check
- Related lessons: Nozomi overview · Claroty Q&A · Dragos Q&A
Full Syllabus — 14 Modules
M 1IT vs OT — the one sentence
- Availability and safety beat confidentiality on the plant
- Why “just scan it with Nessus” is a change, not a check
- People: control engineer, OEM, integrator, IT SOC
- Say this out loud: isolate first, never patch a PLC on a P1
M 2Purdue model and zones
- Levels 0–5 in plant English (sensor → PLC → SCADA → DMZ → enterprise)
- Conduits, data diodes, jump hosts
- Where the historian, jump box and vendor laptop actually sit
- Draw one site: water plant, substations, or a factory line
M 3Protocols you must recognise
- Modbus/TCP, DNP3, IEC 61850, OPC UA, EtherNet/IP, S7, Profinet
- What a function code / MMS / GOOSE ticket looks like
- When encryption exists and when it never will
- Wireshark on a SPAN — what you may capture in a change window
M 4IEC 62443 and NIST 800-82
- Zones, conduits, Foundational Requirements, Security Levels
- NIST SP 800-82 ICS overlay on 800-53
- What an auditor asks vs what a plant manager asks
- Map one FR to one control you can show
M 5MITRE ATT&CK for ICS
- Initial access via engineering laptop and VPN
- Inhibit response function, impair process control
- TRITON / INDUSTROYER / PIPEDREAM as story, not FUD
- Hunt hypothesis that does not stop the process
M 6Visibility vendors — Nozomi, Claroty, Dragos
- Nozomi Guardian / Vantage: asset, protocol, CMC, ARC
- Claroty xDome / CTD and Secure Access sessions
- Dragos Platform + WorldView intel
- Choose-when table: site sensor vs cloud console vs air-gap
M 7More visibility — Armis, Defender for IoT, Tenable.ot
- Armis for mixed IoT + OT campuses
- Microsoft Defender for IoT (sensor + Sentinel hand-off)
- Tenable.ot / passive + safe active
- What “unique assets” means when the same PLC has three names
M 8OT firewalls — Palo Alto, Fortinet, Check Point, Cisco
- Palo Alto OT App-ID / Industrial protocols
- FortiGate OT / FortiSwitch industrial, NSE OT path
- Check Point OT / 1570R-class stories
- Cisco Cyber Vision + ISA3000 / industrial switching
- Allow-list a conduit. Never “any any” because the OEM asked
M 9Remote access and vendors on site
- Jump host, PAM, Claroty Secure Access, ZTNA
- Who approved, how long, what was recorded
- USB, engineering workstation, “we always RDP the HMI”
- Dummy ticket: OEM needs access at 02:00
M 10Safe assessment — what you must not do
- Passive first. Active only with a written window
- Why a TCP SYN can trip a 20-year-old PLC
- Backup, golden image, rollback owner
- Write the change ticket before you type
M 11Incident desk on a running plant
- Safety first — who can hit the E-stop story, who cannot
- Contain IT side without stopping Level 1
- Evidence: sensor alert, firewall session, jump-host log
- Handover to control engineer in one paragraph
M 12Architecture patterns
- Brownfield plant with one SPAN and one DMZ
- Substation / IEC 61850 notes
- Multi-site: collector, CMC / central, air-gap export
- Cloud console vs on-prem — what leaves the plant
M 13Interview and RFP language
M 14Exam prep + capstone
- GICSP domains mapped to these modules
- IEC 62443 FR / SL table you can redraw from memory
- 30 judgment MCQs + 3 plant tickets
- Capstone: one site — Purdue drawing, vendor pick, conduit policy, incident sentence
- Techclick certificate
Labs and dummy plant tickets
Lab 1
Draw Purdue for a dummy water plant. Mark SPAN, jump host, historian and internet.
Lab 2
Compare Nozomi vs Claroty vs Dragos on the same “unknown PLC” ticket.
Lab 3
Write an OT firewall allow-list for Modbus from HMI VLAN to PLC VLAN. Fail-safe notes.
Lab 4
Capstone: OEM remote access at 02:00 — who approves, what is recorded, what you never change.
Exam preparation
GICSP and IEC 62443 questions are judgment, not trivia. You finish with a scored knowledge check, three plant tickets, and a one-page “say this out loud” sheet: Purdue, zone, conduit, fail-safe, next evidence.
Practice: exam.techclick.in. Interview desks for the visibility vendors are linked in Module 13.
What You Get
Live + recorded
40 hours with lifetime replay of the batch recordings.
Workbook
Purdue templates, vendor compare table, dummy SPAN evidence.
Exam prep
GICSP + IEC 62443 mapped to these 14 modules.
Certificate
Techclick Infosec completion certificate after the capstone.
Official References
FAQ
Q 1What is the fee?
₹25,000 for the full multi-vendor OT course. Workbook, recordings, exam prep and Techclick certificate are included. Vendor exam vouchers are not included unless a batch offer says so.
Q 2Is this one vendor or many?
Many. The desk is the same. We compare Nozomi, Claroty, Dragos, Armis, Defender for IoT, Tenable.ot, Palo Alto OT, Fortinet OT, Check Point OT and Cisco Cyber Vision so you can work a plant that already bought something.
Q 3Will we scan live PLCs?
No. Class uses dummy traffic, recorded PCAPs and training consoles. On a real plant you only run active checks in a written change window with the control engineer in the room.
Enroll in OT / ICS Security — ₹25,000
Multi-vendor plant desk. Exam preparation. Certificate. Message us with your industry (power, water, factory, oil & gas).