How to Secure OT/ICS Systems in 2026

#!/bin/bash
apt update && apt upgrade -y
apt install -y nmap wireshark sniffer tcpdump python3 python3-pip snort iptables-persistent netfilter-persistent
pip3 install scapy pyshark
systemctl enable snort
ufw enable
echo 'Installation terminée. Vérifiez avec: nmap --version'

#!/bin/bash
NETWORK="192.168.1.0/24"  # Remplacez par votre réseau OT

# Scan passif (TCP SYN stealth)
nmap -sS -T2 --top-ports 100 -O -sV $NETWORK -oN nmap-passif.txt

# Scan UDP pour DNP3/Modbus (agressif, lab only)
nmap -sU --top-ports 50 -p 102,502,20000 --script=modbus-discover $NETWORK -oN nmap-udp.txt

# Scan spécifique ICS
nmap -p 44818,2222,4480 --script enip-info $NETWORK -oN nmap-ics.txt
echo 'Rapports générés. grep "Modbus" nmap-*.txt'

#!/bin/bash
iptables -F
iptables -t nat -F

# Variables
OT_NET="192.168.10.0/24"  # Niv 0-2
DMZ_NET="192.168.20.0/24" # Niv 3
IT_NET="192.168.1.0/24"   # Niv 4-5

# Politique par défaut: DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Autoriser loopback et established
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# OT->DMZ: monitoring SNMP/OPC UA (ports 161,4840)
iptables -A FORWARD -s $OT_NET -d $DMZ_NET -p udp --dport 161 -j ACCEPT
iptables -A FORWARD -s $OT_NET -d $DMZ_NET -p tcp --dport 4840 -j ACCEPT

# Bloquer tout IT->OT
iptables -A FORWARD -s $IT_NET -d $OT_NET -j DROP

netfilter-persistent save
echo 'Segmentation appliquée. iptables -L -v -n'

alert tcp $OT_NET any -> $OT_NET 502 (msg:"Modbus TCP Scan"; flow:to_server,established; content:"|00 00|"; depth:2; content:"|00 01 00 00|"; distance:2; sid:1000001; rev:1;)

alert udp $OT_NET any -> $OT_NET 20000 (msg:"DNP3 Anomalie"; content:"|05 64|"; sid:1000002; rev:1; classtype:protocol-command-decode;)

alert tcp any any -> $OT_NET 44818 (msg:"EtherNet/IP Unauthorized"; content:"|65 00|"; sid:1000003; rev:1;)

alert icmp $EXTERNAL_NET any -> $OT_NET any (msg:"ICMP Ping Sweep OT"; itype:8; sid:1000004; rev:1; droprule;)

# Activation dans /etc/snort/snort.conf: include $RULE_PATH/ics.rules

from scapy.all import *
import sys
import json
from collections import defaultdict

OT_NET = "192.168.10.0/24"
stats = defaultdict(int)

def packet_handler(pkt):
    if IP in pkt and pkt[IP].src.startswith('192.168.10.'):
        proto = pkt[IP].proto
        sport = pkt[TCP].sport if TCP in pkt else pkt[UDP].sport
        stats[f'{proto}:{sport}'] += 1
        if stats[f'{proto}:{sport}'] > 100:  # Anomalie: >100 pkts/sec
            print(f'ALERTE: Flood {proto}:{sport} from {pkt[IP].src}')

print('Monitoring OT démarré. Ctrl+C pour arrêter.')
sniff(filter=f'net {OT_NET}', prn=packet_handler, store=0)

# Exemple sortie JSON: with open('stats.json', 'w') as f: json.dump(stats, f)

%YAML 1.1
---

vars:
  address-groups:
    OT_NET: "[192.168.10.0/24]"
    EXTERNAL_NET: "any"

rule-files:
  - /etc/suricata/rules/ics.rules

outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      filename: eve.json
      types:
        - alert:
            payload: yes
            packet: yes
        - anomaly:
            enabled: yes

af-packet:
  - interface: eth1  # SPAN OT
    threads: auto
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes