11 · Wireless, IoT, and OT

Depth: outline — expanded teaching material and exercises are still being written. See the content and coverage map.

Outcomes

For developed industrial lessons, continue to SCADA architecture, Modbus trace analysis, and OT investigation. Wireless, mobile, and hardware need their own expanded chapters; this combined outline does not cover them in depth.

Describe radio, embedded, industrial-control, and safety boundaries. Separate a protocol weakness from a safe, authorized test plan.

Lab contract

Use a shielded or explicitly authorized lab. Begin with passive inventory and documentation review. Record frequency/channel, device identity, firmware/version, physical safety constraints, and expected operational impact before transmitting or changing state.

Asset:
Authorization and safety owner:
Passive observations:
Protocol and trust boundary:
Allowed active action:
Abort condition:
Evidence and cleanup:

The correct result may be “not tested.” In OT, preserving availability and safety outranks demonstrating a technique.

Teach-back

Explain why a passive observation can be useful evidence while an active test may be rejected even when it would be technically interesting.

Safety and scope

Use a shielded or explicitly authorized environment with a named safety owner and abort condition. Passive work is the default.

Evidence

Record passive observations, device and firmware identifiers, safety constraints, and whether any active action was approved or deliberately omitted.