Recon for the Real World: Practical OSINT in ICS/OT Operations

Introduction

Welcome to the SANS ICS Summit 2025 OSINT Workshop. This is a two-hour event where we will walk through some basic concepts and techniques for conducting Open Source Intelligence (OSINT) analysis of targets. We are going to do this analysis without loading commercial tools or tools that require accounts or API keys. But, don’t let that stop you. Follow the process using your commercial, authenticated, and custom tools to do this workshop.

Online Workshop Website

https://cutaway-security.github.io/ics-summit-2025-osint-workshop/

SANS Evaluation

Help us by filling out a SANS Workshop Evaluation about this workshop or submit an issue or recommendation at the GitHub repository.

Agenda and Table of Contents

• Task 1: Outline of the Workshop’s OSINT Process
• Task 2: ICS / OT Passive Geolocation Reconnaissance By Sector
• Task 3: Student Target Identification
• Task 4: Initial Website Review
• Task 5: Start SpiderFoot Information Gathering
• Task 6: Domain Name Service Exploration
• Task 7: Explore External Remote Access
• Task 8: Document Exposure Analysis
• Task 9: Personnel Analysis
• Task 10: Email Analysis
• Task 11: Swagger API Analysis
• Task 12: OSINT Risk Mitigations
• Summary: Workshop Summary
• Additional Resources
  • SANS ICS Summit 2025 Evaluation Form
  • Note Taking Recommendation
  • Tool List
  • AI Tool Considerations
  • Contributors
  • Original Abstract

Additional Considerations

Experienced OSINT Analysts

Some of this might be basic for you. Stick with the class or move on at your own pace. Help your neighbors. Remember the leadership axiom “Train Your Own Replacement.” We, your team, and the industries are stronger when we work together.

Contributors

Be sure to checkout, and thank, the Contributors to this workshop.

Tools

We use very few tools for this workshop as most of the OSINT data collection and analysis can be done using a web browser. You can track all of the tools used and referenced in this workshop on the Tools page. The AI Tool Consideration page provides recommendations about using AI tools during the workshop.

Note Taking

Do not worry about taking notes during this workshop. For assessments, do make sure you are keeping accurate notes. The Notes page has some of our recommendations.