OT SECURITY STUDIO — PRACTITIONER CASE 001
All assets, addresses, approvals and events are synthetic.

Evidence: 18 normalized Modbus event records and six asset records.
Time basis: 3 November 2026, UTC. The controller maintenance window is 10:45–12:00 UTC for ENG-02. approved_maintenance is a normalized window-active flag, not a complete source/target authorization. Remote access exercise uses a separate stated site-local 14:00–16:00 window; do not correlate those clock values as UTC.

review_required is the exercise reference classification: an event requiring investigation, not proof of an attack. The four reference events are EVT-03, EVT-06, EVT-10 and EVT-17. Event 17 demonstrates why a time-window flag alone is insufficient. The approved write source is ENG-02 (10.20.1.35); a read from another source is not automatically malicious.

Policy JSON is a conceptual, application-aware first-match simulator, not a configuration for a named firewall. Protocol function matching requires a supporting application-aware control. Network port 502 alone cannot distinguish Modbus reads and writes. Omitted match fields act as wildcards. Default deny applies. The flow matrix is fixed, not exhaustive.

Remote access policy allows Vendor-A to ENG-02 during [14:00,16:00), with MFA, approval, jump-host routing and recording. This is a policy evaluation exercise, not a running access broker.

Use the case workbook to state observations, assumptions, operational constraints, containment gates, recovery evidence and residual risk. No production network connection, scans, credential handling or controller emulation occurs.

The separate four-packet PCAP is a small standalone packet-format teaching sample. It is not an 18-event capture and contains no TCP handshakes or responses. Read its included evidence guide before interpreting it.

References for context, not certification or endorsement:
NIST SP 800-82 Revision 3: https://csrc.nist.gov/pubs/sp/800/82/r3/final
MITRE ATT&CK for ICS, Modify Parameter T0836: https://attack.mitre.org/techniques/T0836/
