The Power Plant Challenge
The Power Plant scenario in Red vs Blue puts you in command of cybersecurity operations for a power generation facility. Your mission: protect generation control systems, SCADA infrastructure, and safety instrumented systems from a sophisticated threat actor while maintaining grid reliability.
This scenario is particularly challenging because power generation facilities operate under strict reliability requirements -- you cannot simply shut down systems for security without risking grid stability.
Understanding the Environment
Critical Assets
The power plant environment includes several high-value targets:
- Distributed Control System (DCS): Controls generation equipment including turbines, generators, and cooling systems
- SCADA: Supervisory control for plant-wide monitoring and remote operations
- Safety Instrumented Systems (SIS): Emergency shutdown and safety protection systems
- Historian: Data collection and trending for operational and compliance purposes
- Business Network: IT systems including email, ERP, and engineering workstations
Attack Surface
The threat actor can exploit multiple entry points:
- Internet-facing IT systems leading to IT/OT pivot points
- Remote access connections for vendor maintenance
- Engineering workstations with dual-homed network connections
- Removable media used for control system updates
- Supply chain compromise through third-party software updates
Defensive Strategy Guide
Layer 1: Network Architecture
Implement defense-in-depth network segmentation following the Purdue Model. Ensure clear boundaries between IT and OT zones with strictly controlled data flows through DMZ segments.
Layer 2: Monitoring and Detection
Deploy network monitoring at all critical boundaries. OT-specific detection tools can identify anomalous control system communications that traditional IT security tools would miss.
Layer 3: Access Control
Implement multi-factor authentication for all remote access. Restrict privileged access to control systems through jump servers with session recording.
Layer 4: Incident Response
Prepare OT-specific incident response procedures that account for operational safety requirements. Not all IT incident response actions are safe in an OT environment.
Pro Tips
- Prioritize safety systems protection above all else
- Monitor for lateral movement between IT and OT zones
- Maintain manual operation capability as a fallback
- Balance security spending between prevention and detection
Play the Power Plant scenario and test your defensive strategy against adaptive adversary AI.