OT-Enabled Military Installation Critical Infrastructure Protection

Overview

Objective

The objective was to validate PacketViper Full Stack AMTD protecting the four principal utility segments of a representative forward operating base — power distribution, water treatment, fuel dispensing, and HVAC — under realistic cyber-physical attack conditions. The engagement was designed to produce documented, repeatable results directly applicable to Army installation resilience requirements and DoD OT Zero Trust guidance.

Summary of Results

Four independent automated red team runs were executed against the test environment. All four runs were fully contained. Unauthorized protocol commands were blocked inline in under two milliseconds. No exfiltration occurred across any of the four runs. No physical process was affected at any point during the engagement. Full fabric-wide isolation of the attacking source architecture was completed in an average of 4 minutes and 12 seconds. Tool attribution and exploit payload capture were achieved on every engagement. 312 total events were generated; 3 required analyst action. The remaining 309 were handled automatically by the enforcement layer.

Built with operational Army experience to support installation resilience and contested logistics requirements.

Test Environment

Lab Configuration

The test environment simulated the four principal utility segments of a forward operating base. Each segment operated independently with dedicated PLCs or RTUs and associated field devices. All four segments shared a common OT core switch, with PacketViper placed inline between the core switch and each protected segment. No agents were deployed on any PLC, RTU, HMI, or workstation at any point during the engagement.

The four segments were configured as follows:

• Power Distribution — one PLC (Modbus TCP) simulating main switchgear and feeder breakers, one RTU with DNP3 for substation-style monitoring, and one HMI workstation (Windows) for operator interface
• Water Treatment — one PLC (Modbus TCP) controlling pH adjustment and chemical dosing pumps, with simulated sensors for pH, flow, and level
• Fuel Dispensing — one PLC (Modbus TCP) for pump control and tank level monitoring, with simulated flow meters and valves
• HVAC — one BACnet device controlling air handlers and chillers, with temperature and pressure sensors

IT/OT Convergence Layer

A domain-joined Windows engineering workstation was placed on the IT network with direct network connectivity to the OT core switch. This workstation served as the initial compromise point for lateral movement scenarios — representing the most common initial access vector in IT/OT convergence environments where a compromised endpoint on the IT side has a path into the OT network.

PacketViper Configuration

Deployment Mode

PacketViper was deployed inline between the OT core switch and all four protected segments in bridge mode. No modification was made to any PLC, RTU, HMI, or workstation. The appliance had no management interfaces on the data plane. Full Stack AMTD was active across L2–L7 on all sensor IP addresses from the beginning of baseline collection.

Persona Bundles

Full Stack AMTD Persona Bundles were configured for each segment. Each bundle presents a coherent, internally consistent identity across all OSI layers — meaning cross-layer fingerprinting tools that check TCP stack behavior, TLS fingerprints, banner responses, and ARP characteristics simultaneously see a believable single device rather than a Frankenstein response that triggers automated anomaly detection in modern scanners.

The following bundles were active:

• Siemens S7-1500 persona on the power distribution and fuel dispensing segments
• Modbus TCP/RTU persona on the power distribution and water treatment segments
• BACnet persona on the HVAC segment
• DNP3 persona on the power distribution RTU segment

Persona rotation was configured on a 2–5 minute interval. Spatial rotation (sensor IP visibility) operated independently on the AMTD schedule. Rotation was entirely decoupled from production assets — no broadcast storms, ARP noise, or routing table updates reached legitimate OT devices.

Dynamic Vulnerability Emulation

Dynamic Vulnerability Emulation (DVE) was enabled on selected personas. When CVE-targeting scanners such as Nessus, Nuclei, or OpenVAS probed these personas, they received realistic vulnerable-looking responses. Exploit payloads sent to DVE personas were captured as data streams for signature analysis and attribution. No code execution was granted at any point — the responders operate in isolated, non-executable mode.

Detection and Enforcement Policy

93 action handlers were available on every sensor trigger. The default policy for this engagement was: blacklist source IP, log full context with geolocation and service context, capture payload when a Dynamic Vulnerability Emulation persona was contacted. Enforcement was surgical — individual source IPs only, never subnets.

Baseline

A 72-hour baseline of legitimate engineering workstation and HMI traffic was collected before the engagement began. Only known engineering workstations and HMIs were whitelisted for normal read/write access to production PLCs. All other sources interacted exclusively with AMTD personas and deceptive responders.

Observed Results

Reconnaissance

Nmap and custom Modbus/DNP3 scanners launched from the IT workstation received coherent but false responses across all four segments. The average time from scan initiation to first deceptive response was 1.8 seconds. Cross-layer fingerprints — checked across TCP stack behavior, banner responses, and protocol-layer characteristics simultaneously — remained internally consistent on every scan attempt. No real asset was identified by the reconnaissance phase across any of the four runs. Legitimate engineering workstations and HMIs maintained normal read/write access to production PLCs throughout.

Lateral Movement

Credential abuse and living-off-the-land techniques launched from the compromised IT workstation were contained at the IT/OT boundary. Attempts to enumerate or communicate with real PLCs consistently intercepted deceptive personas and triggered immediate enforcement. No unauthorized communication with production PLCs resulted in successful operational interaction or write execution on any attempt.

Protocol Manipulation

47 unauthorized write commands were blocked inline across the engagement — including Modbus register modifications targeting pH setpoints, breaker positions, and fuel pump controls, as well as unauthorized control-state changes via DNP3 and BACnet. Each command was blocked instantaneously at the inline enforcement layer. Operations on all four segments continued without deviation throughout. No operator intervention was required.

Ransomware-Style Activity

Encryption and file modification attempts on the compromised engineering workstation remained isolated to the IT environment. OT segments were not reached. No lateral impact was observed on any of the four OT segments.

Automated Multi-Vector Runs

Four independent runs of automated, multi-vector attack scripts were executed sequentially, with the test environment reset to baseline state between runs. Each run combined automated reconnaissance, credential abuse, adaptive retry logic, and protocol-aware targeting across all four OT segments simultaneously.

All four runs were fully contained. Zero exfiltration occurred on any run. Zero successful disruptive commands were executed on any production OT asset. While individual unauthorized packets were blocked instantaneously at the inline enforcement layer, complete fabric-wide isolation of the attacking source architecture — including blacklisting across the full deployment footprint — was finalized in an average of 4 minutes and 12 seconds per run.

Red team assessment: reconnaissance produced high volumes of unusable data. The adaptive retry logic in runs 3 and 4 modified targeting strategy in response to inconsistent responses — but was adapting to deceptive data, not real network intelligence.

Framework and Control Mapping

DoD OT Zero Trust Alignment (Nov 2025)

This deployment maps directly to the DoD Zero Trust for Operational Technology Activities and Outcomes framework across four pillars:

• Networks and Environments — Inline micro-segmentation and least-privilege enforcement between the IT/OT boundary and each functional segment. Unauthorized sources received deceptive responses only; no real asset was reachable.
• Automation and Orchestration — 93 action handlers executed automated, surgical enforcement on every decoy touch without human intervention. The enforcement chain from first contact to blacklist completion required no analyst action.
• Visibility and Analytics — Tool attribution, payload capture, and deception telemetry provided continuous monitoring data. 312 total events were reduced to 3 requiring analyst review.
• Devices — Agentless deployment with Full Stack AMTD personas strengthens device posture and visibility without requiring any modification to OT assets.

These results provide direct evidence toward both Target Level (84 activities) and Advanced activities in the 105-activity DoD OT Zero Trust framework.

MITRE ATT&CK for ICS

The following tactics were tested and defeated:

• Lateral Movement (TA0100) — IT-to-OT pivot attempts contained at the boundary
• Inhibit Response Function (TA0103) — Write command blocking prevented manipulation of control sequences
• Manipulation of Control (TA0104) — 47 unauthorized setpoint changes blocked
• Impair Process Control (TA0105) — No successful disruption of power, water, fuel, or HVAC processes
• Discovery (TA0102) — Full Stack AMTD personas defeated reconnaissance across L2–L7 on all four runs

RMF and ATO Implications

This engagement provides direct, empirical testing evidence across 14 NIST 800-53 control families — mapped, documented, and structured for SCA review and Authorizing Official package delivery. The continuous monitoring posture established by deception telemetry and automated tool attribution supports cATO objectives directly: evidence is generated as a natural output of normal operations, not as a separate documentation step.

The deployment attack surface is minimal: a single inline appliance with zero agents on OT assets. The RMF assessment scope stays small. Appliance resource overhead measured below 8% CPU and 12% memory during peak attack windows.

Operational Safety Notes

All OT processes continued without deviation throughout the engagement. No setpoints, pump controls, valve positions, chemical dosing rates, or physical outputs were affected at any point. Inline latency on OT protocols remained below 2 ms during both baseline collection and attack conditions. The appliance is configured fail-open — on power loss or appliance fault, production traffic passes without modification. No valid control traffic from whitelisted engineering workstations or HMIs was modified at any point.

AMTD rotation intervals were configured at a 2–5 minute dwell. This cadence provides robust deceptive variance while ensuring zero impact on legitimate telemetry or baseline polling frequencies. Rotation is entirely decoupled from production assets; no rotation event generated broadcast storms, ARP noise, or routing table updates visible to legitimate OT devices.

Documentation Delivered

The following artifacts were produced as part of the engagement:

• Network diagram with PacketViper placement and segment architecture
• PacketViper configuration export (Persona Bundles, AMTD parameters, sensor baselines, action handler policy)
• Red team engagement report with before/after comparison and per-run event logs
• NIST 800-53 / DoD OT Zero Trust control mapping spreadsheet
• Video of attack execution and containment showing physical outputs unchanged throughout