Exercise – performing an ICS-centric penetration test
For this chapter's exercise, we will be performing a penetration test engagement on the same Company Z we used as a target in Chapter 16, Red Team/Blue Team Exercises. The exercise will mainly concentrate on pentest activities for the industrial environment since Chapter 16, Red Team/Blue Team Exercises, already showed the enterprise side of things in detail. We will include the high-level planning for the enterprise side of the pentest engagement in this chapter.
Preparation work
Just like a red team assessment, we need to prepare the engagement. Details such as scope, timelines, allowed attack methods, and logistics such as target asset information, engagement deliverables, and any restrictions on when the pentest activities can be performed should be discussed, detailed, and written down in a contract to avoid any misconceptions.
Setting up the test environment
For this exercise, we will be setting up...
