Every condition on the range is drawn from real water and building-automation incident patterns — reproduced inside an isolated simulation.
01 / Priority conditions
Ranked by how directly each one collapses the boundary around a physical process.
| # | Condition | Why it matters | Primary defense |
|---|---|---|---|
| 01 | Internet-exposed PLC or HMI; unnecessary remote/vendor path | Direct access collapses the boundary around the physical process. | Remove exposure; controlled gateway; MFA; allowlists; monitor remote sessions. |
| 02 | Default, shared, stale or weak credentials; no MFA | Recent water incidents repeatedly leverage poor identity controls. | Unique accounts; vaulting; MFA; revoke departures; just-in-time vendor access. |
| 03 | Unknown or incomplete OT inventory | An owner cannot patch, isolate, monitor or recover an asset it cannot name. | Field-verified inventory; owners; firmware; network paths; criticality; evidence. |
| 04 | Flat IT/OT network or permissive firewall path | One compromised endpoint can reach process control. | Zones and conduits; OT DMZ; deny by default; separate identities; bastion. |
| 05 | Outdated firmware and known exploited vulnerabilities | Publicly known weaknesses shorten attacker effort. | CISA KEV/advisory matching; vendor-approved remediation; compensating control. |
| 06 | Unauthorized controller or configuration change without a trusted baseline | Operators can be locked out or process logic altered. | Gold project/config; hashes; change windows; write monitoring; restore tests. |
| 07 | Weak logging and no ICS-aware monitoring | Writes, failed logins and path violations may be invisible. | Central logs; passive OT telemetry; config drift; maintenance-window correlation. |
| 08 | Untested or online-only backups; no manual procedure | Recovery fails exactly when operations depend on it. | Offline known-good copies; restore drill; local and manual operating plan. |
| 09 | Alarm or telemetry manipulation and loss of view | A trusted-looking screen can drive the wrong physical action. | Independent sensing; plausibility checks; field verification; alarm integrity. |
| 10 | Vendor governance and human-factor gaps | Former staff, informal remote help and undocumented SOPs create persistent paths. | Owner, authorization, expiry, competency, SOP and attestation obligations. |
02 / Controlled adversary
Nothing improvised, nothing routable to the venue. Each inject has a designed detection path and an approved defense.
A staged pump PLC/HMI is intentionally reachable from the isolated adversary zone. Teams find it through range telemetry — never Internet scanning.
A synthetic vendor account is valid outside its maintenance window. No real default passwords are used.
A scenario controller changes a dummy IP/config value, causing simulated loss of view.
A benign range client presents as a monitoring utility but performs a preauthored write to a dummy register.
A deliberately permissive synthetic firewall rule permits a canned cross-zone connection.
The simulator changes displayed pressure while the process model and independent sensor stay safe and stable.
The first online backup is deliberately unusable; an offline signed gold copy exists.
A simulated leak above an electrical room plus pump loss-of-view and a fire-water dependency question.
03 / Rules of engagement
Know your class before you touch anything. A red action ends your team's day.
Observation and interaction with synthetic or dead training assets
Read labels; trace a mock cable; inspect a staged HMI; query the graph; submit evidence; execute simulator controls
Preapproved physical or network isolation after checklist and safety-authority approval
Disconnect the training PLC network lead; disable the simulated switch port; restore a gold configuration
Any contact with venue or building production systems
Scanning venue networks; logging into live BAS/PLC/HMI; changing setpoints; closing live valves; unplugging a working pump
Twelve teams get the same imperfect estate and the same clock. Registration is free.
