c0c0n is a 19 years old platform that is aimed at providing opportunities to showcase, educate, understand and spread awareness on Information Security, data protection, and privacy...
C3iHub (Cybersecurity and Cybersecurity of Cyber-physical Systems, A Technology Innovation Hub at IIT Kanpur) is a Technology Innovation Hub established at the Indian Institute of Technology Kanpur under the National Mission on Interdisciplinary Cyber-Physical Systems (NM-ICPS), Department of Science and Technology, Government of India. It focuses on research, product development, and capacity building in cybersecurity, with a particular emphasis on securing critical infrastructure, industrial control systems (ICS), and operational technology (OT) environments.
Through its OT/ICS Security Village, C3iHub aims to bridge the gap between traditional IT security practices and the specialized requirements of industrial and cyber-physical systems, offering hands-on exposure to real-world attack and defense scenarios using dedicated testbeds and simulation platforms.
The OT/ICS Village at c0c0n 2026 is a dedicated, hands-on learning track designed for security professionals, students, and enthusiasts interested in the security of industrial control systems, SCADA networks, and critical infrastructure. Unlike conventional IT-security tracks, this village focuses exclusively on the unique protocols, architectures, and threat landscape of operational technology environments.
Participants will work directly with C3iHub's industrial testbeds and simulation platforms – including a chemical plant process simulator, live PLC hardware, and a functioning OT Security Operations Centre (SOC) – to understand how attacks unfold against industrial systems and how they are detected, triaged, and investigated in practice.
The village is structured as a two-day, hands-on programme covering OT/ICS fundamentals, threat intelligence and dark-web reconnaissance, wireless and RF attack surfaces, and OT security operations, culminating in a live, end-to-end attack detection demonstration.
Each participant must bring the following:
On completion of the OT/ICS Village, participants will be able to:
Participants attending the OT/ICS Village can expect to receive:
9–10 October 2026 · Grand Saloon 2, Grand Hyatt
11:30 AM – 5:00 PM
11:30 AM – 4:00 PM
Both days of the OT/ICS Village follow an identical structure, allowing participants to attend either day independently or repeat the track for reinforcement.
Welcome & Keynote & C3iHub, IITK - Vision and Mission
IT vs OT Security & Purdue Reference Architecture, framed with real-world case studies (Stuxnet, Ukraine grid attack, Colonial Pipeline) Network Scanning & ICS Device Enumeration (nmap, Metasploit) — establishes how devices/IPs are discovered Protocol Spoofing & Traffic Interception Protocol Injection & Unauthorized Actuator Control PLC Unauthorized Reprogramming
Ajinkya Panday
, C3iHub, IIT Kanpur
"Overview of the current OT/ICS threat landscape - adversary groups, ransomware-on-OT trends, and why industrial systems are increasingly targeted Dark web as a reconnaissance surface: what's traded (access brokers, leaked credentials, ICS device leaks), how threat actors stage attacks from these forums Live demonstration of RF and Bluetooth attack surfaces using Raspberry Pi, PiFmRds, and Bluetooth devices - FM/RDS transmission, wireless signal analysis, Bluetooth discovery, and associated attack, detection, and defensive techniques
Aman Raj
, C3iHub, IIT Kanpur
OT SOC architecture end to end: OT data sources, passive sensors and collection points, the detection pipeline, and how it differs from an IT SOC. Log and traffic onboarding from PLCs, HMIs, engineering workstations and protection relays across a multi-vendor estate.
Hands-on walkthrough of the SOC console using real data captured from C3iHub's industrial testbeds (power, water treatment, manufacturing, conveyor). Alert triage, correlation across sensors, enrichment with asset context, and a worked incident investigation from first alert to root cause.
Tanmay Agrawal
, C3iHub, IIT Kanpur
Welcome & Keynote & C3iHub, IITK - Vision and Mission
live OT threat-hunting, surfacing real internet-exposed ICS/SCADA devices MITRE ICS ATT&CK attack chain reframed from a SOC analyst's perspective — what each stage looks like from the defender's side (recon → MITM → injection → escalation)
Ajinkya Panday
, C3iHub, IIT Kanpur
Formal introduction to threat intelligence: IOC/IOA analysis, TTPs, MITRE ATT&CK, and the threat intelligence lifecycle
Practical dark-web intelligence gathering, IOC extraction, enrichment, and verification, building directly on the landscape overview
Aman Raj
, C3iHub, IIT Kanpur
CyberMap, C3iHub's OT network visualisation platform: asset discovery and network topology views, mapping SOC alerts onto process layouts, and attack-path tracing from the compromised device to the affected physical process. Why process impact, and not just network severity, drives prioritisation in OT.
Live demonstration on the C3iHub PLC Test Kit: execute an attack against real PLC hardware, watch it surface on the SOC dashboard in real time, and follow its path and process consequence on CyberMap. Closing discussion on how these platforms can secure power, water and mining sites in India, plus Q&A.
Tanmay Agrawal
, C3iHub, IIT Kanpur
For queries regarding the OT/ICS Village at c0c0n 2026, please reach out to the C3iHub team on-site at the village, or through the official C3iHub, IIT Kanpur channels.
Meet the experts leading the OT/ICS Security Village.
C3iHub, IIT Kanpur
C3iHub, IIT Kanpur
C3iHub, IIT Kanpur
Together with organizations that support collaboration, innovation and a stronger cybersecurity community.
