ics-iot-ot-hardening - ICS IoT OT Hardening Framework — Industrial Cybers

项目说明

<di="center">

🏭 ICS/IoT/OT Hardening Framework

The Open-Source Industrial Cybersecurity Platform

![License: MIT]()
![]()
![Python 3.9+]()
![Kuwait 🇰🇼]()

Comprehensi hardening toolkit for Industrial Control Systems (ICS), Internet of Things (IoT), and Operational Technology (OT) en. Includes automated scanning, multi-standard compliance assessment, network segmentation tools, protocol security analysis, and an interactive web dashboard.

🌐 Li Demo · 📖 Documentation · 🐛 Report Bug · 💡 Request Feature

---

</div>

📸 Screenshots

Security Dashboard — O

<p align="center">
<img src="docs/screenshots/dashboard-o.svg" alt="ICS Security Dashboard O" width="100%">
</p>

ICS Scanner

<p align="center">
<img src="docs/screenshots/scanner-demo.svg" alt="ICS Scanner Demo" width="100%">
</p>

Multi-Standard Compliance

<p align="center">
<img src="docs/screenshots/compliance-gauges.svg" alt="Compliance Dashboard" width="100%">
</p>

CLI Interface

<p align="center">
<img src="docs/screenshots/cli-demo.svg" alt="CLI Interface Demo" width="100%">
</p>

---

🔐 Dashboard Access

The interacti includes a login screen for access control:

| Credential | Username | Password |
|-----------|----------|----------|
| Admin | admin | ICS |
| Analyst | analyst | OT@ |

Li:

Dashboard Tabs (11)

| Tab | Description |
|-----|-------------|
| O | Security posture metrics, Purdue Model, recent findings, network topology |
| Assessment | Interacti assessment with scoring across IEC 62443 domains |
| Network | Firewall rule generator for ICS protocols (Modbus, DNP3, IEC 104, etc.) |
| Compliance | Multi-standard compliance gauges (NIST, IEC 62443, NERC CIP, CIS, ISA/IEC) |
| Scanner | ICS scanner (demo mode) with C |
| Protocols | 12 ICS/SCADA protocol security reference with ports and mitigations |
| Assets | ICS asset in — 15 demo assets (PLCs, RTUs, HMIs, SIS, VFDs) with status |
| Incidents | Security incident timeline — 12 demo incidents with se classification |
| Discovery | Active ICS asset discovery scanner — scan by IP range or protocol (Modbus, DNP3, S7, OPC UA, MQTT, SNMP, etc.). 20 demo devices with C, animated scan log |
| SNMP | SNMP network monitor — query devices with SNMPv1/v2c/v3, view CPU/memory/temperature/uptime, interface table, 6-point security assessment |
| Settings | Scan configuration, SNMP settings (auth/privacy protocols), alert thresholds, compliance standard selection, syslog/SIEM integration |

🎯 Why This Framework?

Industrial Control Systems face unique cybersecurity challenges that traditional IT security tools don't address. This framework bridges that gap with purpose-built tools for OT en:

ICS Protocol Awareness — Understands Modbus, DNP3, S7comm, OPC UA, EtherNet/IP, BACnet, IEC 61850, and 5 more industrial protocols

Purdue Model Architecture — All tools designed around the ISA-95/Purdue reference model (L0–L5 + DMZ)

Safety-First Approach — Non-intrusi options that respect OT a requirements

Multi-Standard Compliance — Assess against IEC 62443, NIST SP 800-82, NERC CIP, MITRE ATT&CK for ICS, and CIS Controls simultaneously

Real-World Tested — Hardening scripts against Siemens, Allen-Bradley, Schneider, ABB, and GE en

---

✨ Features

🔍 ICS Scanner

Automated scanning with ICS protocol detection for PLCs, RTUs, HMIs, SCADA servers, and field devices. Supports full, quick, protocol-specific, and firmware scans.

📊 Interactive Web Dashboard

Full-featured security operations dashboard with Purdue model , real-time metrics, interacti tools, and compliance gauges. Deploys as a GitHub Pages site.

🛡️ Multi-Standard Compliance Engine

Simultaneous assessment against 5+ security standards with gap analysis, control mapping, and remediation tracking across 1,200+ controls.

🔥 Firewall Rule Generator

Automated firewall rule generation for Purdue model segmentation. Outputs iptables, Cisco ASA, and Palo Alto formats.

🖥️ CLI Toolkit

Rich command-line interface with progress bars, color-coded output, and exportable reports (JSON, HTML, PDF).

📡 Protocol Security Analyzer

Deep inspection of 12 ICS protocols with security posture assessment per protocol, including authentication, encryption, and access control checks.

🔧 System Hardening Scripts

Pre-built hardening scripts for Windows ICS nodes, Linux servers, SCADA applications, and HMI workstations aligned with CIS benchmarks.

📈 OT Network Monitoring

Real-time anomaly detection for industrial network traffic with SIEM integration connectors (Splunk, QRadar, Elastic).

🐳 Docker Ready

Full Docker and docker-compose support for isolated deployment of all framework components.

---

🚀 Quick Start

Installation

Option 1: pip install (recommended)

Option 2: From source

Option 3: Docker

First Assessment

CLI Commands

| Command | Description |
|---------|-------------|
| ics-harden assess | Run ICS security assessment with configurable depth |
| ics-harden harden | Apply hardening configurations (supports dry-run) |
| ics-harden network | Network segmentation analysis and firewall generation |
| ics-harden report | Generate multi-standard compliance reports |
| ics-harden assets | Asset discovery and in |
| ics-scan | Standalone ICS scanner |
| ics-comply | Standalone compliance checker |
| ics-monitor | Real-time OT network monitor |

---

🏗️ Architecture

---

🔒 Security Controls Co

Purdue Model Zones

| Zone | Level | Description | Tools Provided |
|------|-------|-------------|----------------|
| Enterprise | L5 | ERP, Email, Business Systems | Network isolation, access policies |
| Site Business | L4 | Historian, OPC Gateway, Reporting | Data diode config, gateway hardening |
| Industrial DMZ | DMZ | Jump Servers, Patch Management | Segmentation rules, jump host setup |
| Operations | L3 | SCADA Servers, HMI Servers, Eng WS | SCADA hardening, session control |
| Super | L2 | HMI Panels, Area Controllers | HMI lockdown, USB policy |
| Basic Control | L1 | PLCs, RTUs, DCS Controllers | PLC security config, firmware |
| Process | L0 | Sensors, Actuators, Field Devices | Physical security, tamper detection |

ICS Protocol Security

| Protocol | Port | Risk Level | Security Features |
|----------|------|------------|-------------------|
| Modbus TCP/RTU | 502 | 🔴 Critical | No native auth/encryption |
| DNP3 | 20000 | 🟠 High | Secure Auth v5 a |
| IEC 61850 MMS | 102 | 🟠 High | GOOSE auth support |
| OPC UA | 4840 | 🟡 Medium | Built-in X.509, TLS |
| EtherNet/IP (CIP) | 44818 | 🟠 High | CIP Security extension |
| BACnet/IP | 47808 | 🟠 High | Minimal nati |
| MQTT | 1883/8883 | 🟡 Medium | TLS, ACLs a |
| CoAP | 5683/5684 | 🟡 Medium | DTLS, OSCORE |
| PROFINET | Dynamic | 🟠 High | Integrity classes |
| S7comm/S7comm+ | 102 | 🔴 Critical | S7comm+ adds crypto |
| IEC 60870-5-104 | 2404 | 🟠 High | TLS wrapper option |
| HART-IP | 5094 | 🟡 Medium | Limited auth |

---

<a name="compliance-standards"></a>📋 Compliance Standards

This framework maps controls to the following international standards:

| Standard | Controls | Description |
|----------|----------|-------------|
| ISA/IEC 62443 | 96 | Industrial automation and control systems security |
| NIST SP 800-82 | 82 | Guide to ICS security (Rev. 3) |
| NERC CIP | 62 | Critical infrastructure protection for electric utilities |
| MITRE ATT&CK for ICS | 66 | Ad tactics and techniques for ICS |
| CIS Controls v8 | 48 | Center for Internet Security controls (OT-adapted) |
| CBK CORF | 876 | Kuwait Central Bank Cyber & Operational Resilience Framework |

---

🐳 Docker Deployment

---

🤝 Contributing

Contributions are welcome! Please see the Contributing Guidelines for details.

Priority areas for contribution:

Additional ICS protocol parsers (PROFIBUS, Foundation Fieldbus)

hardening guides (Honeywell, Yokogawa, Emerson)

Cloud-connected OT security (Azure IoT Hub, AWS IoT Greengrass)

OT-specific threat intelligence feeds

Additional compliance standards (ISO 27019, IEC 62351)

Localization and GCC/MENA regional guidance

---

📄 License

This project is licensed under the MIT License — see the LICENSE file for details.

🔗 Related Resources

CISA ICS Ad

NIST Cybersecurity Framework

ISA/IEC 62443 Standards

MITRE ATT&CK for ICS

SANS ICS Security

---

👤 Author

Ali AlEnezi (SiteQ8)

GitHub:

Email:

Location: Kuwait 🇰🇼

---

<di="center">

⭐ Star this repo if you find it useful! ⭐

Made with ❤️ in Kuwait 🇰🇼 for the global ICS security community

*Aligned with NIST SP 800-82 · IEC 62443 · NERC CIP · MITRE ATT&CK for ICS · CIS Controls v8*

</div>

项目信息

开发语言：Python

Star 数：15

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕ICS IoT OT Hardening Framework — Industrial Cybersecurity Platform featuring an asset discovery scanner, SNMP monitor, incident timeline, vulnerability scanner, compliant with IEC 62443, NIST 800-82, NERC CIP, and MITRE ATT&CK ICS, includes 20 demo devices and a settings panel展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。