# Down the Rabbit Hole: Fostering Active Learning through Guided Exploration of a SCADA Cyber Range
## 4 Guided Learning, Hands-On: Course Plan and Execution Strategy
### Introduction and Context  
As most trainees come from an IT background, the first step must encompass an effort to bring the group to a similar level of basic knowledge regarding cyber-physical systems and the ICS domain. This initial module was designed to address these issues, being organized as depicted in Figure 9.  
The adopted strategy starts by introducing the concept of Critical Infrastructure and Essential Services, later moving into the specific details about the kind of Industrial Control Systems supporting these infrastructures. Later on during this stage, trainees are presented to the physical process that is part of the cyber range (presented in Section 3.2), being given  
Figure 9: Organization of the first training module (6 h).  
access to the HMI and allowed to directly interact with it. This first interaction has proven vital to stimulate curiosity and trainee motivation.  
Once the introductory stage of the module is completed, comes the moment to deliver a conceptual and technical introduction of what a SCADA system is, in parallel with a detailed walkaround of the cyber range ICS process--the Purdue Model adopted by IEC 62443 [22] is an important instrument to assist in this task, as it helps categorize the equipment by functional levels within an organizational structure. In this process, students become familiarized with the concept of master station, slave and field devices, also learning about the role performed by PLCs and RTUs.  
Regarding the latter point, and because of its relevance within the ICS domain, special care is taken regarding the explanation of how PLCs work and how they are distinct from general-purpose computers: this includes an analysis of the PLC scan cycle (see Figure 10), as well as the concept of cycle time and a quick overview of IEC 61131-3 [28] programming languages.  
Still within the scope of the IEC 61131-3 programming language introduction, trainees are are also put into contact with simple Structured Text (ST) and Ladder Logic (LL) examples (see Figure 11). For this specific purpose, students are put into contact with the OpenPLC project, which is used to provide a containerized PLC runtime and a IDE (OpenPLC Editor) that can be used to experimentation purposes.  
Being a crucial part of what makes SCADA systems possible, domain-specific communications protocols are also introduced and discussed. Among them, the Modbus protocol is dissected into detail, not only to provide an insight about the kind of legacy technologies which are still being widely used, but also because this protocol was adopted in the cyber range environment scenario.  
The analysis of the Modbus protocol covers aspects such the framing structure (see Figure 12), operation semantics and Function Codes, as well as the data types and addressing modes (Modicon and IEC/Quantum). During the discussion of communications-related topics, instructors also take advantage of the context to review other related aspects such as serial communications or TCP/IP protocol fundamental concepts (such as the three-way handshake or sequence numbers, for instance).  
Experimentation is always encouraged along the progression path; during this stage, a CANVAS ephemeral playground with several OpenPLC VMs is made available, also  
Figure 11: Simple example for a Greater-Than (GT) function block: LL vs. ST representations.  
Figure 10: PLC scan cycle.  
including some editor-bundled Windows VMs (for students who do not use the Windows OS or do not have resources to run VMs on their own PCs).