OT CTFs Build Cyber Skills Through Hands-On Forensics and Context

Summary

A participant reflects on how OT CTFs teach practical analysis of protocols and network evidence, and cautions that relying on AI to solve challenges can weaken learning and leave beginners unable to assess its answers.

Key points

The Dragos exercise used scenarios involving utilities, water systems and power facilities, with network traffic and other artifacts for participants to analyze.
Challenges covered Modbus/TCP, BACnet, HTTP authentication, SMB and SSH, using tools including Wireshark, CyberChef and Impacket.
Understanding what evidence means in its environment—such as which controller received a Modbus register write—helps investigators reconstruct activity.
The exercise was approachable for beginners, with challenges unlocking sequentially and increasing in difficulty.
AI can help explain protocols or suggest next steps, but outsourcing the reasoning can prevent beginners from building skills and make it harder to challenge incorrect answers.
One example involved reconstructing and decoding a malicious PowerShell command split across multiple packets.

Article Details

Topic: Operational technology capture-the-flag exercises for cybersecurity skills development

Vendors

Dragosto real systems. That was my clearest lesson from a recent three-day capture-the-flag exercise hosted by Dragos focused largely on blue-team forensics, network analysis and operational technology.

Tools

CyberChefevent. The challenges exposed me to Modbus/TCP, BACnet, HTTP authentication, SMB and SSH. I also used CyberChef to decode data and Impacket to examine a provided Windows SAM database.Impacketme to Modbus/TCP, BACnet, HTTP authentication, SMB and SSH. I also used CyberChef to decode data and Impacket to examine a provided Windows SAM database.Wiresharkworking in operational technology. Though much of the work involved more common techniques such as Wireshark PCAP analysis, the context of the analysis contributed to the difficulty

Industries

Operational technologyexercise hosted by Dragos focused largely on blue-team forensics, network analysis and operational technology.UtilitiesThe Dragos CTF included multiple scenarios involving environments such as utilities, water systems and power facilities. Participants received network traffic and other artifacts, then had to find flags by analyzing the water systemsThe Dragos CTF included multiple scenarios involving environments such as utilities, water systems and power facilities. Participants received network traffic and other artifacts, then had to find flags by analyzing the