The interactive dashboard includes a login screen for access control:

Live Dashboard: https://siteq8.github.io/ics-iot-ot-hardening/gui/

Industrial Control Systems face unique cybersecurity challenges that traditional IT security tools don't address. This framework bridges that gap with purpose-built tools for OT environments:

• ICS Protocol Awareness — Understands Modbus, DNP3, S7comm, OPC UA, EtherNet/IP, BACnet, IEC 61850, and 5 more industrial protocols
• Purdue Model Architecture — All tools designed around the ISA-95/Purdue reference model (L0–L5 + DMZ)
• Safety-First Approach — Non-intrusive scanning options that respect OT availability requirements
• Multi-Standard Compliance — Assess against IEC 62443, NIST SP 800-82, NERC CIP, MITRE ATT&CK for ICS, and CIS Controls simultaneously
• Real-World Tested — Hardening scripts validated against Siemens, Allen-Bradley, Schneider, ABB, and GE environments

Automated scanning with ICS protocol detection for PLCs, RTUs, HMIs, SCADA servers, and field devices. Supports full, quick, protocol-specific, and firmware validation scans.

Full-featured security operations dashboard with Purdue model visualization, real-time metrics, interactive assessment tools, and compliance gauges. Deploys as a GitHub Pages site.

Simultaneous assessment against 5+ security standards with gap analysis, control mapping, and remediation tracking across 1,200+ controls.

Automated firewall rule generation for Purdue model segmentation. Outputs iptables, Cisco ASA, and Palo Alto formats.

Rich command-line interface with progress bars, color-coded output, and exportable reports (JSON, HTML, PDF).

Deep inspection of 12 ICS protocols with security posture assessment per protocol, including authentication, encryption, and access control checks.

Pre-built hardening scripts for Windows ICS nodes, Linux servers, SCADA applications, and HMI workstations aligned with CIS benchmarks.

Real-time anomaly detection for industrial network traffic with SIEM integration connectors (Splunk, QRadar, Elastic).

Full Docker and docker-compose support for isolated deployment of all framework components.

Option 1: pip install (recommended)

pip install ics-hardening

Option 2: From source

git clone https://github.com/SiteQ8/ics-iot-ot-hardening.git
cd ics-iot-ot-hardening
pip install -e ".[full]"

Option 3: Docker

docker build -t ics-hardening .
docker run --rm ics-hardening --help

# Discover ICS assets on your network
ics-harden assets --cidr 10.100.0.0/16

# Run a comprehensive security assessment
ics-harden assess --target 10.100.0.0/16 --level deep --output report.json

# Generate Purdue model firewall rules
ics-harden network --cidr 10.100.0.0/16

# Multi-standard compliance report
ics-harden report --format html --output compliance.html

# Launch the web dashboard
cd gui && python -m http.server 8080
# Open http://localhost:8080

ics-iot-ot-hardening/
├── gui/                            # 🌐 Interactive Web Dashboard (GitHub Pages)
│   └── index.html                  #    Single-page security operations center
├── src/ics_hardening/              # 📦 Python Package
│   ├── cli.py                      #    CLI entry point (Click + Rich)
│   └── modules/                    #    Framework modules
├── scripts/                        # 🔧 Automation Scripts
│   ├── assessment/                 #    Vulnerability assessment tools
│   ├── compliance/                 #    CBK/IEC/NIST compliance checkers
│   ├── networksecurity/            #    Firewall gen, traffic analyzer, scanner
│   ├── system-hardening/           #    Windows & Linux hardening scripts
│   │   ├── linux/                  #    Linux CIS benchmark hardening
│   │   └── windows/                #    Windows ICS node hardening
│   ├── siem/                       #    SIEM integration connectors
│   ├── shodan/                     #    Shodan exposure monitoring
│   └── app/                        #    SCADA/HMI app hardening
├── tools/                          # 🛠️ Custom Security Tools
│   └── asset-discovery/            #    OT asset inventory scanner
├── monitor/                        # 📡 Network Monitoring
│   └── anomaly-detector.py         #    ICS traffic anomaly detection
├── templates/                      # 📋 Configuration Templates
│   ├── firewall-rules/             #    Firewall rule templates
│   ├── policies.md                 #    Security policy templates
│   └── procedures.md               #    Operational procedures
├── docs/                           # 📖 Documentation
│   ├── screenshots/                #    Dashboard & tool screenshots
│   ├── framework.md                #    Core framework documentation
│   ├── implementation/             #    Implementation guides
│   ├── kuwait.md                   #    Kuwait/GCC specific guidance
│   └── gcc.md                      #    GCC regional considerations
├── tests/                          # ✅ Test Suite
├── docker-compose.yml              # 🐳 Multi-container deployment
├── Dockerfile                      #    Container build config
├── pyproject.toml                  #    Python packaging (PEP 621)
└── requirements.txt                #    Core dependencies

This framework maps controls to the following international standards:

# Build and run the full stack
docker-compose up -d

# Run standalone scanner with host network access
docker-compose run --rm ics-scanner --target 10.0.0.0/24 --type full

# Run network monitor
docker-compose run --rm ics-monitor --interface eth0

# View logs
docker-compose logs -f ics-dashboard

Contributions are welcome! Please see the Contributing Guidelines for details.

Priority areas for contribution:

• Additional ICS protocol parsers (PROFIBUS, Foundation Fieldbus)
• Vendor-specific hardening guides (Honeywell, Yokogawa, Emerson)
• Cloud-connected OT security (Azure IoT Hub, AWS IoT Greengrass)
• OT-specific threat intelligence feeds
• Additional compliance standards (ISO 27019, IEC 62351)
• Localization and GCC/MENA regional guidance

This project is licensed under the MIT License — see the LICENSE file for details.

• CISA ICS Advisories
• NIST Cybersecurity Framework
• ISA/IEC 62443 Standards
• MITRE ATT&CK for ICS
• SANS ICS Security

Ali AlEnezi (SiteQ8)

• GitHub: @SiteQ8
• Email: [email protected]
• Location: Kuwait 🇰🇼