Presentation by Paul Coggin | SpaceCoastSec August 2026 Monthly Meeting
Purpose
Shareable summary of the presentation, discussion, named people/projects, events, and practical follow-ups.
Scope
OT/ICS/SCADA and IoT security at Purdue Level 0: the physical signals, power, ground, timing, vibration, and environmental side of digital engineering.
Executive Summary
Core Takeaway
Traditional network-centric Zero Trust does not address every path into an OT environment. Security programs should extend their trust boundaries and telemetry to the physical layer: power, grounding, radio frequency, sensors, actuators, timing, and environmental systems.
Paul framed “Level 0” as the southbound, real-world signal layer beneath the network connection: the electrical and physical interface between sensors/actuators and the systems they control. The talk surveyed research-based examples where carefully shaped electrical, RF, magnetic, or mechanical signals could cause devices to misread inputs or accept unintended commands without using TCP/IP. The defensive implication is multidisciplinary: cybersecurity, OT engineering, facilities, electrical engineering, and physical security need shared threat models, baselines, and response procedures.
Q&A reinforced the value of passive OT monitoring, SDR/RF telemetry for high-consequence sites, careful post-event forensics, and avoiding active scans that can destabilize ICS equipment.
Presentation Notes
Why Level 0 Matters
Paul contrasted the familiar OSI model with the Purdue model used in OT. Security investment often concentrates around Levels 3–5, where enterprise and industrial networks meet, while Level 0 devices and signals receive less attention. Level 0 in this talk means the physical/electrical side of sensors, PLCs, robotic arms, and actuators—not IP traffic. The central question: what can an attacker influence through physics before traffic ever reaches a firewall? Paul characterized weakly configured IT/OT separation as a recurring “vendor persistent threat”: a firewall may exist but be operationally ineffective because of permissive configuration or vendor access practices.
Threat Concepts and Research Examples
Volttack
Research described signal injection through an accessible AC circuit. With physical access and target-specific preparation, an attacker could potentially influence certain nearby powered sensors or actuators. Defensive reading: treat publicly accessible outlets and electrical circuits as part of the attack surface; validate physical access controls and electrical-isolation assumptions.
Reference: https://ieeexplore.ieee.org/document/10179340
PowerRadio
A related research concept described remote RF coupling into exposed/shared grounding paths, allowing targeted signals to reach a device via its ground relationship. Defensive reading: review grounding architecture with qualified electrical/facilities partners; separate or protect OT/IT grounds where appropriate; restrict access to exposed rooftop/HVAC/utility grounding points.
Reference: https://arxiv.org/abs/2412.18103
Hall-Sensor Manipulation
A small concealed electromagnet/Arduino/Zigbee setup was described as able to trip a Hall sensor, using a solar inverter/grid example. Defensive reading: include unexplained objects and electromagnetic devices in insider-threat and site-inspection training; consider tamper detection around critical inverters and sensors.
Water-Hammer Attack Chain
A hypothetical chained scenario combined physical signal injection with rapid valve actuation, creating pressure shocks that could damage cooling infrastructure or disrupt a data center without a conventional network exploit. Defensive reading: threat-model dependencies across OT, facilities, cooling, and cyber operations, including flooding and loss-of-cooling outcomes.
Timing, Acoustics, Harmonics, and RF
Paul highlighted timing physics, signal injection, acoustic effects on processors, power harmonics, and positioning/navigation timing as areas worth researching and monitoring. Defensive reading: baseline the physical telemetry that matters to the mission and investigate unexplained deviations alongside digital security alerts.
Defensive Themes Proposed by the Presenter
Expand the Trust Boundary
Include power, ground, physical access, exposed electrical infrastructure, and sensor/actuator signal paths alongside identities, applications, and network paths.
Partner Across Disciplines
Work with electrical, facilities, and OT engineering teams to identify shared grounds, exposed grounding paths, accessible outlets, rooftop/HVAC interfaces, and other physical dependencies.
Collect Physical Telemetry
For high-value environments, consider passive RF/SDR monitoring, environmental data, and anomaly detection against a known-good baseline.
Preserve Forensic Evidence
Retain physical telemetry around high-consequence events so teams can perform physics-aware forensics, not only review IP connections and application logs.
Protect the Analytics Pipeline
If using AI/ML for detection, account for poisoned or manipulated data that can distort baselines and suppress alerts.
Q&A and Discussion
Cooling Failure Modes
An attendee noted that a damaged water line can create both a flood risk and a cooling-loss/overheating risk. The group also recalled research in which generator-frequency manipulation produced damaging mechanical stress.
Power-Line Networking
An online question connected the signal-injection theme to X10 and broadband-over-power-line. Paul cited a B-Sides South Africa presentation (speaker/title not captured) that reportedly demonstrated unexpected in-building signal paths using inexpensive equipment.
Space Research References
Paul offered to share a Google Drive of his presentations, including work on satellites and rocketry. He recommended Dr. Greg Falco’s work, especially a paper focused on launch-ground-facility security.
EMI vs. Intentional Interference
Paul suggested SDR-based environmental collection for critical sites, machine-learning anomaly detection, and retaining telemetry near events. He noted resource constraints for smaller utilities.
Named People, Organizations, Tools, and Projects
Joe Weiss
Recommended by Paul as an influential control-systems engineer and advocate for attention to Level 0 / physics-based risks.
https://www.linkedin.com/in/joew1/
Dr. Greg Falco
Recommended by Paul for published research on space systems, including launch-ground-facility security.
https://aerospaceadversary.org/
MITRE ATT&CK / MITRE Emb3d
Paul encouraged attendees familiar with ATT&CK to look at an additional MITRE resource he pronounced as “Embed.” https://attack.mitre.org/ https://emb3d.mitre.org/
Idaho National Laboratory
Referenced for OT/SCADA training, an in-person Red vs. Blue exercise, and tools pronounced in the transcript as “Malcolm” (SIEM). https://inl.gov/national-security/ics-malcolm/
NSA “GRASSMARLIN”
Referenced as a free passive OT/IoT network tool. https://github.com/nsacyber/GRASSMARLIN
Claroty
Described by Robbie as an OT/appliance platform used to review launch-pad sensor logs and connections after an incident.
“Threat Hunting Digital Energy and Space with Physics”
Paul’s earlier presentation, identified as the origin of the current talk.
“Endless Door”; Salt Typhoon / “Bolt Typhoon”
Briefly mentioned late in chat; Paul said he had not yet read the Endless Door write-up and had been following Typhoon-related reporting.
Community Announcements and Events
SpaceCoastSec Community Channels
Linktree, Meetup, social accounts, and Discord were promoted. Discord was described as the first location for slides, announcements, and the meeting video; invite link valid for seven days at the time of the meeting.
SpaceCoastSec Meetings
Monthly public meetings; free to attend, with in-person presence and a planned/expanding hybrid format. The Meetup page contains the Zoom link for late online attendees.
Hack The Box Chapter
Official Melbourne chapter meets the fourth Wednesday monthly at 6:30 p.m. The next meeting was stated as August 26, with an AI-security pathway planned; recent topics included reverse engineering and binary analysis.
Space Coast ISC² Chapter
Next meeting stated as August 25; attendees were directed to LinkedIn or Eventbrite for details.
Security BSides Orlando Conference
Scheduled for September 25–26. September 25: paid workshops. September 26: conference. Student admission was described as free, with discounts/volunteer options mentioned.
Suggested Security-Group Follow-Up
Priority
Use the talk as a threat-modeling prompt, not as a claim that every listed technique applies to every environment. Validate research citations and scope with OT, facilities, and electrical engineering stakeholders.
Inventory
Document critical Level 0 dependencies: sensors, actuators, PLCs, power supplies, shared grounds, remote facilities interfaces, cooling controls, and public-access electrical points.
Tabletop
Run a joint tabletop with security, OT, facilities, and physical security: “What happens if a sensor is manipulated or a cooling/valve signal is altered without an IP intrusion?”
Telemetry
Define baseline and retention requirements for physical telemetry: RF, timing, voltage/power quality, temperature, vibration, and process signals at high-consequence sites.
Safety
Review OT monitoring methods for safety: identify where passive discovery/monitoring is required and prohibit uncontrolled active scanning.
Research
Request Paul’s source/reference deck and shared presentation library.