OT Cyber Quest

Operational Technology Cybersecurity Training

Status

Floor: 1

Devices: -

Failures: 0/5

hallway

Inventory

Firewall Software x0
Intrusion Prevention System x0
Software Patches x0
Anti-malware Software x0
Network Scanner x0
Privileged Access Management x0
Multi-Factor Authentication x0
Firmware Integrity Monitor x0
Application Whitelisting x0
Immutable Backups x0
Email Filter x0
Vulnerability Assessment x0
CVSS Software x0

Mini-map

Compromised Device

How to Play

You are a cybersecurity defender. Your office building has been hit by multiple cyber attacks. Move through the building to find compromised OT devices and fix them before the attackers succeed. Collect security tools from offices and other rooms and apply them to compromised devices. You have a limited number of attempts. Applying the wrong tool to the wrong device counts as a failure. Too many failures will end the game.

Movement & Controls

Arrow keys - Move in that direction.
D-pad buttons - Move in that direction.
Click the map - Click an adjacent tile to move there, or
click on the player circle to move in that direction.
h or ? - Open Help (or switch to Help tab if already open).
g - Open Glossary (or switch to Glossary tab if already open).
Dismiss / Escape - Close the current message or popup.

Fixing Devices

When you enter a room with a compromised device, the Inventory panel highlights which tools can fix it. Click a highlighted tool to apply it. If you choose the wrong tool the device will break permanently and a failure is counted.

If you are not ready to fix a device yet, simply move away and come back later.

Devices & Tools

Attack	Compromised Device	Security Tool
Port Sniffing	Internet Connection	Firewall Software
Intruders	Router	Intrusion Prevention System
Rogue Devices	SCADA Device	Software Patches
Malware	Workstation	Anti-malware Software
Security Holes	Database	Network Scanner
Privilege Escalation	Admin Console	Privileged Access Management
Credential Theft	Authentication System	Multi-Factor Authentication
Firmware Tampering	PLC / RTU	Firmware Integrity Monitor
Command Injection	HMI	Application Whitelisting
Ransomware	File Server	Immutable Backups
Phishing	Email Server	Email Filter

Special Tools

Vulnerability Assessment (VA) - Found mostly in Offices. When picked up, immediately reveals all compromised Workstations on the current floor's mini-map, even rooms you have not yet visited.

CVSS Software - Found mostly in Offices. When picked up, immediately reveals all compromised Server Rooms on the current floor's mini-map, even rooms you have not yet visited.

Mini-map

Find the Security Station to unlock the mini-map. It shows all rooms you have visited and highlights compromised devices. VA and CVSS tools extend the mini-map to show specific unvisited threats.

On multi-floor buildings, the mini-map always shows the current floor. Use Stairs Up / Stairs Down to move between floors.

2FA — Two-Factor Authentication: An alternate name for Multi-Factor Authentication (MFA) that specifically uses exactly two verification factors. The terms are often used interchangeably. See MFA — Multi-Factor Authentication.
Application Whitelisting: A security control that defines an explicit list of approved applications permitted to run on a system, blocking all others by default. Particularly important on HMIs and engineering workstations, where unauthorized software could be used to manipulate industrial processes or issue unauthorized commands to field equipment.
CVSS — Common Vulnerability Scoring System: A standardized framework for rating the severity of software security vulnerabilities on a scale from 0 to 10, helping security teams prioritize which issues to address first.
Command Injection: An attack that exploits vulnerable software to execute unauthorized commands on a system. In OT environments this can allow attackers to run malicious programs on HMIs and other control system components.
Credential Theft: The unauthorized acquisition of login usernames and passwords, typically through phishing, malware, or data breaches. In OT systems, stolen credentials can give attackers direct access to control interfaces.
DNP3 — Distributed Network Protocol 3: A communication protocol widely used in SCADA systems, particularly in electric utilities and water treatment. Designed for reliable communication between field devices and control centers.
Firewall: A network security system that monitors and filters network traffic based on defined security rules. Acts as a barrier between trusted internal networks and untrusted external connections.
Firmware: Software permanently embedded inside a hardware device (such as a PLC, RTU, or sensor) that controls how the device operates at its most fundamental level. Stored directly in the device’s memory rather than on a drive.
Firmware Tampering: Unauthorized modification of a device’s firmware to alter its behavior. In OT systems, tampered firmware in a PLC or RTU could cause it to operate incorrectly while appearing completely normal to operators.
FIM — Firmware Integrity Monitor: A security tool that continuously compares the firmware running on networked devices against a verified reference copy. Any deviation indicates potential tampering, triggering an alert so the affected device can be isolated and inspected before it causes harm.
HMI — Human-Machine Interface: The display and controls operators use to monitor industrial processes and interact with equipment. Shows sensor readings, alarms, and process status, and allows operators to adjust settings and issue commands.
Historian: A specialized database used in industrial environments to record time-stamped data from sensors and control devices. Used to analyze process trends, troubleshoot problems, and verify systems operated within normal parameters.
IPS — Intrusion Prevention System: A network security tool that monitors traffic for suspicious activity and automatically blocks detected threats in real time, rather than just raising an alert.
IT — Information Technology: The use of computers, servers, networks, and software to process and communicate information for business purposes. Distinguished from OT (Operational Technology), which controls physical processes.
Ladder Logic: A graphical programming language used to program PLCs, designed to resemble traditional electrical relay diagrams. The most widely used PLC programming language in industrial automation.
Malware: Malicious software designed to disrupt, damage, or gain unauthorized access to computer systems. Includes viruses, ransomware, spyware, trojans, and other harmful programs.
MFA — Multi-Factor Authentication: A security method requiring users to verify their identity using two or more independent factors — typically something they know (a password) combined with something they have (a mobile phone or hardware token). Also called 2FA (Two-Factor Authentication) when exactly two factors are used.
Modbus: One of the oldest and most widely used industrial communication protocols, found in PLCs, RTUs, and SCADA systems. Originally designed for serial communications in the 1970s and still in widespread use today.
OT — Operational Technology: Hardware and software systems that monitor and control physical devices, industrial processes, and critical infrastructure — such as power grids, pipelines, water treatment plants, and manufacturing equipment. OT systems directly interact with the physical world.
PAM — Privileged Access Management: A security discipline that controls, monitors, and audits the use of administrative access to critical systems. Ensures that elevated permissions are tightly controlled and that every privileged action is logged.
Phishing: A social engineering attack using fraudulent emails or websites that impersonate trusted sources to trick users into revealing credentials or installing malware. One of the most common initial access methods for OT network breaches.
PLC — Programmable Logic Controller: A specialized industrial computer that automates control of machinery and processes. PLCs monitor sensor inputs and issue commands to actuators such as motors, valves, and pumps based on programmed logic.
Port Sniffing: Monitoring network traffic to discover which communication ports are open on networked devices. Used by attackers to map a network and identify potential entry points and vulnerabilities to exploit.
Privilege Escalation: An attack in which an intruder who has gained limited access exploits a vulnerability to obtain higher-level permissions. In OT, this can allow unauthorized changes to control system configurations or safety settings.
Ransomware: Malware that encrypts a victim’s files and demands payment for the decryption key. In OT environments it can encrypt engineering files, SCADA configurations, and historian data, making industrial systems impossible to operate or recover without backups.
Rogue Device: An unauthorized device connected to a network without the knowledge of the network administrator. Can be used as an entry point for attackers or to intercept and manipulate network communications.
RTU — Remote Terminal Unit: A microprocessor-based field device that monitors equipment at remote locations, collects data from sensors, relays it to a central SCADA system, and executes commands from that system.
SCADA — Supervisory Control and Data Acquisition: A control system architecture that uses software and networked communications to monitor and control industrial infrastructure. Used in power grids, pipelines, water treatment, and manufacturing.
Setpoint: A target value that a control system is programmed to maintain — for example, a temperature, pressure, or flow rate. Attackers who gain access to control systems can alter setpoints to cause industrial processes to operate unsafely.
SOC — Security Operations Centre: A dedicated team and facility responsible for continuously monitoring an organization’s networks and systems for security threats, and responding to incidents when they occur. A SOC maintains visibility across both IT and OT environments to detect attacks that could affect physical processes and critical infrastructure.
Stuxnet: A sophisticated piece of malware discovered in 2010, widely believed to be a nation-state cyberweapon. It specifically targeted industrial PLCs to physically damage centrifuges used in nuclear enrichment — the first known cyberattack to cause real-world physical destruction.
VA — Vulnerability Assessment: A systematic process of identifying and ranking security weaknesses in a system. Produces a prioritized list of vulnerabilities that should be addressed before they can be exploited by attackers.
VPN — Virtual Private Network: An encrypted connection between a remote device and a private network over the internet. Allows engineers and operators to securely access OT systems from off-site locations.
WORM — Write Once, Read Many: A data storage technology where data can be written only once and then read any number of times, but never modified or deleted. Used for immutable backups to ensure that ransomware cannot encrypt or destroy backup copies.

OT Cyber Quest

Operational Technology Cybersecurity Training

The building where you work as a (junior) cybersecurity expert has been compromised by cyber-attackers and is being held for ransom. They have compromised Operational Technology hardware and software and this need to be corrected as soon as possible. You have secured access to the lobby but now you must search the building for the tools needed to fix and clean up all the devices that the cyber-intruders have taken over. Move carefully and act with care.