// STUDY TRAINING · TR-06 · 3 DAYS · HARDENING
Hardening Control Networks
Three days on the networks that run process control, building automation, and utilities, where a default switch configuration and a flat network are the normal starting point. Purdue levels and IEC 62443 zones as working tools, industrial switches configured properly, the protocols on the wire, remote access that does not bypass everything, and the Windows boxes that hold the engineering software. Hands-on on industrial hardware.
What you will be able to do
- Draw the site as Purdue levels and IEC 62443 zones and conduits, and put the industrial DMZ at level 3.5 where it belongs.
- Configure industrial switches, Cisco IE, Hirschmann, and Moxa among them, from default to a hardened baseline with ring redundancy left working.
- Recognise Modbus, EtherNet/IP, DNP3, BACnet, PROFINET, and OPC UA on the wire and know which ones carry no authentication at all.
- Write conduit firewall rules between zones from the protocol list, not any-any, and verify them without stopping production.
- Set up remote access for vendors and integrators through a jump host with recorded sessions, instead of a cellular modem behind the panel.
- Harden the engineering workstation and HMI servers within the vendor’s supported configuration, and back up the PLC programs so a restore is possible.
Day by day
The control network as it is
- Morning Purdue, IEC 62443, and the site in front of you
Levels 0 to 5, zones and conduits, the industrial DMZ, what the standard asks for, and a walk through 3 real site topologies with the weak points marked.
- Afternoon Asset inventory and passive capture lab
Finding what is on the network without scanning it. Span ports, passive capture, Modbus and EtherNet/IP decoded in Wireshark, and the inventory sheet the rest of the course works from.
Switches, zones, and conduits
- Morning Industrial switch hardening
Cisco IE, Hirschmann, and Moxa from default: management plane, ring protocols, port security, storm control, and the settings that break a PLC if set the IT way.
- Afternoon Segmentation lab
Each team cuts a flat plant network into zones, builds the conduits, writes the firewall policy from the protocol list, and proves the HMI still talks to the PLC afterward.
Remote access, Windows, and keeping it hardened
- Morning Remote access and the engineering workstation
Jump hosts, session recording, vendor access windows, the cellular modem problem, and Windows hardening for HMI servers and engineering workstations within the vendor matrix.
- Afternoon Full build and handover
PLC program backups, configuration backups, patch windows that match the outage schedule, change control, and an as-built security document for the site. Each team presents theirs.
Who this is for
Controls and automation technicians, plant and facilities IT, security integrators working in industrial and institutional sites, and MSPs supporting them.
Prerequisites. Comfortable with VLANs and IP addressing. Network Fundamentals for Security Integrators, or the free Network Primer and OT Networks courses, covers it.
What is included
- Lab access during the course, industrial switches and a PLC and HMI pair per team
- The zone and conduit worksheet, switch baselines, and the as-built template as files
- A copy of the free OT Networks and Network Hardening courses for review afterward
- Certificate of completion with contact hours
What this is not
Not a PLC programming course and not a SCADA product course. Safety instrumented systems, process control logic, and anything the AHJ or the process safety review reserves stay with the people who own them.
Free courses that pair with it
Reserve a seat
Reserving costs nothing and commits you to nothing. You get the next cohort dates for this course first, and the invoice only once the dates are confirmed. Groups of 6 or more can ask for private delivery on their own site.