XUTS OT Operator Node

Safety System Awareness

Safety system awareness means understanding the difference between operational control systems and systems designed to protect life, equipment, and the environment, such as Safety Instrumented Systems.

Difficultyhard

XP Reward100

PurdueL3/L2

AssetOT System

OT / ICSSafety Aware

OT Safety Gate

Assume every action can affect the process until proven otherwise.

OT testing is not just exploitation. It is controlled validation around availability, safety, process continuity, deterministic operations, and recovery.

Prefer passive enumeration before active scanning. OT networks may contain fragile controllers, legacy stacks, deterministic traffic patterns, and vendor-supported systems that react poorly to noisy probes.

Never perform protocol writes, force coils, download logic, change controller state, or interact with safety systems in production unless the scope, approval, rollback plan, and operational window are explicit.

Treat engineering workstations, historians, HMI servers, jump hosts, and OT domain controllers as high-impact assets because they can affect visibility, control, recovery, and trusted engineering workflows.

Coordinate testing with operations, control engineers, vendors, and site leadership. In OT, the blast radius can include production, safety, environmental impact, and physical equipment damage.

What it is

Why it matters

In OT, some systems are directly tied to physical safety. A responsible operator must know where testing stops and where safety-critical risk begins.

How to identify it

Look for SIS, safety PLC, ESD, burner management, trip system, or protection system terminology.Identify safety networks and systems that are separate from basic process control.Review diagrams and asset names for safety-related systems.Escalate uncertainty instead of testing unknown safety assets.

Expected output

A list of systems that may be safety-related.A clear boundary for no-touch or coordination-required assets.Documentation explaining why safety systems require special handling.

Success looks like

You can identify likely safety-related systems.You avoid interacting with systems that could affect safety functions.You communicate safety boundaries clearly in reporting.

Failure looks like

You treat SIS assets like normal OT endpoints.You attempt validation that could alter safety behavior.You fail to stop when system purpose is unclear.

Troubleshooting

If a system may be safety-related, document evidence and pause active testing.

If diagrams conflict with scan results, treat the system as higher risk until clarified.

If ownership is unclear, escalate through the engagement lead or process owner.

Lab setup ideas

Create a mock process diagram with control systems and separate safety systems.

Practice writing report findings that distinguish cyber risk from safety impact.

Build decision trees for when testing should stop.

EXO automation ideas

Flag hostnames and documentation terms that indicate safety-critical assets.

Automatically mark safety-related paths as coordination-required.

Generate report language for safety-sensitive findings.

Operational Tradecraft

How to talk about this like an OT operator

Lead with process risk.

Explain how this topic affects visibility, control, safety, availability, recovery, and engineering workflows.

Explain passive-first methodology.

Mention SPAN/TAP collection, firewall review, switch tables, historian visibility, HMI observation, configuration review, and controlled validation before active probing.

Tie the concept to an attack path.

Connect the node to IT/OT pivoting, Level 3 operations, historians, engineering workstations, HMIs, PLCs, protocols, vendor access, and segmentation boundaries.

EXO Guidance

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.