Cdude1909/ICS-AUDITOR

🛡️ ICS Auditor (Beta) | Next-Generation Industrial Control Systems (ICS/SCADA) & Operational Technology (OT) Cybersecurity Assessment and Compliance Platform

CISA's CSET inspired (https://github.com/cisagov/cset/releases)

Tailored for Critical Infrastructure Security Engineers, OT Auditors, Plant Managers, and CISO Offices
Compliant with IEC 62443, NIST SP 800-82 r3, CISA CSET, NCIIPC, CERT-In, and BIS IS 16335

Public Beta Notice

ICS Auditor 1.0 is currently in Public Beta. While the core assessment engine, offline encryption vaults, Gemini Vision diagram analyzer, and PDF generation suites are fully operational, the project is actively undergoing user-experience refinements, performance tuning, and expanding its regulatory library. See Future Scope & Framework Development for our architectural roadmap.

• Overview
• Key Features
• System Architecture & Visual Figures
  • Figure 1: High-Level Platform Architecture
  • Figure 2: AI workflow overview
  • Live Runtime Screenshot and working
• Supported Standards & Regulatory Frameworks
• Prerequisites & Requirements
• Installation & Quickstart Guide
  • Running the Web Application (Vite SPA)
  • Running as a Native Desktop App (Tauri v2)
  • Environment Variables Configuration
  • Air-Gapped & Offline Deployment
• Detailed Module Walkthrough
• Future Scope: Framework Development
• Project Directory Structure
• Security & Air-Gap Compliance
• Contributing
• License

Industrial Control Systems (ICS) and Operational Technology (OT) networks power critical national infrastructure: power grids, nuclear plants, oil & gas refineries, chemical manufacturing, water treatment facilities, and pharmaceutical plants.

Conducting cybersecurity assessments in OT environments has traditionally been hindered by:

• Disjointed spreadsheets with high human error and static checklists.
• Lack of OT topology context, ignoring the Purdue Model and zone/conduit segmentation.
• Lengthy reporting turnaround, taking weeks to correlate findings into executive summaries and technical roadmaps.
• Security risks with sensitive plant data, exposing architecture diagrams to untrusted public cloud services.

ICS Auditor 1.0 transforms this paradigm. It provides a specialized, local-first assessment platform with computer vision-based diagram inspection, dynamic question synthesis based on Security Assurance Levels (SAL), real-time visual analytics, and automated executive & technical PDF generation all protected by client-side AES-256 encryption and designed for air-gapped plant operation.

• AI-Powered Visual Diagram Inspection: Upload architectural schematics or photos of network topologies. Powered by Google Gemini Vision to automatically detect 30+ ICS components (PLCs, RTUs, HMIs, SIS safety controllers, DCS, firewalls, jump hosts, historians, data diodes, and IIoT gateways).
• Security Assurance Level (SAL) Calibration: Tailor question depth according to consequence severity (Low, Medium, High, Very High) following IEC 62443 guidance.
• Purdue Model & Zone-Conduit Mapping: Built-in reference templates (Purdue Standard, Flat Network, Converged IIoT/Cloud Edge, Air-Gapped Island, SIS Safety, Distributed RTU/WAN, Micro-Grid).
• Paper Checklist & Evidence Digitization: Scan physical paper audit forms via camera OCR into digital questions. Capture and attach cryptographic image proofs and justifications for partial compliance.
• Real-Time Visual Analytics: Interactive domain compliance bar charts, answer distribution pie charts, and domain radar metrics powered by Recharts.
• CSET-Grade PDF Report Engine: One-click generation of professional executive reports with executive summaries, radar compliance metrics, gap analysis, Purdue topology risk assessments, and prioritized remediation roadmaps.
• Defense-in-Depth Cryptography:
• AES-256 local encrypted storage for in-progress assessments.
• Quick 4-digit PIN lock for screen-privacy during walk-through plant inspections.
• Password-protected encrypted export/import of .icsaudit bundles.
• Dual Deployment (Web + Native Desktop):
  • Responsive Vite + React 19 PWA with offline capabilities.
  • Ultra-lightweight native Desktop App packaged with Tauri v2 (Rust core).
• Optional Cloud Collaboration: Firebase Auth (Google OAuth & Email/Password) and Firestore sync with fine-grained access rules when working in hybrid/IT environments.

ICS Auditor 1.0 maps questionnaires and generates gap analyses directly aligned with globally recognized critical infrastructure standards:

• Node.js: v18.0.0 or higher (Node 20+ recommended)
• Package Manager: npm (v9+), bun, or pnpm
• Modern Web Browser: Chrome, Edge, Firefox, or Safari (WebCrypto and Canvas API support required)
• Google Gemini API Key: Free or paid key from Google AI Studio for AI vision diagram analysis and automated report generation.

• Rust Toolchain: rustc and cargo (1.77+ recommended)
• Platform Dependencies:
  • Windows: Visual Studio C++ Build Tools & WebView2
  • macOS: Xcode Command Line Tools
  • Linux: libwebkit2gtk-4.1-dev, build-essential, curl, wget, file, libssl-dev, libgtk-3-dev, libayatana-appindicator3-dev, librsvg2-dev

# 1. Clone the repository
git clone https://github.com/your-username/ics-auditor-1.0.git
cd ics-auditor-1.0

# 2. Install dependencies
npm install

# 3. Configure environment variables
cp .env.example .env.local
# Open .env.local and insert your GEMINI_API_KEY

# 4. Start the Vite development server
npm run dev

The application will be live at: http://localhost:3000 (or http://localhost:5173).

To build for production:

npm run build
npm run preview

The desktop edition provides a sandboxed, standalone binary ideal for offline laptops carried by auditors onto plant floors:

# 1. Ensure Rust is installed
rustc --version

# 2. Run in Tauri desktop development mode
npm run tauri dev

# 3. Build a release desktop installer (.exe, .dmg, or .deb/.AppImage)
npm run tauri build

The compiled binaries will be output into src-tauri/target/release/bundle/.

Create a .env.local file in the project root:

# Google Gemini API Key for Vision diagram analysis & AI Report generation
# Obtain a key at: https://aistudio.google.com/app/apikey
GEMINI_API_KEY=your_google_gemini_api_key_here

# Optional: Firebase config overrides (if not using local default config)
# VITE_FIREBASE_API_KEY=your_firebase_api_key
# VITE_FIREBASE_PROJECT_ID=your_firebase_project_id

ICS Auditor 1.0 was intentionally engineered to work seamlessly in air-gapped industrial environments:

1. Local-First Caching: The core questionnaire engine, scoring metrics, and PDF generation run entirely in client-side WebAssembly / JavaScript. No outbound internet connection is required for manual auditing.
2. Encrypted File Transfer: Assessments can be exported to .icsaudit encrypted files, copied to a secure USB drive, and imported onto another auditor's workstation.
3. Graceful AI Fallback: If an internet connection is unavailable, the application gracefully skips cloud vision analysis and uses manual component selectors and pre-packaged IEC 62443 question catalogs.

+--------------------------------------------------------------------------------------------------+
|                                    WORKFLOW STEPS                                                |
+--------------------------------------------------------------------------------------------------+
| [1. PREPARE]   -->   [2. DIAGRAM]   -->   [3. QUESTIONS]   -->   [4. RESULTS]   --> [5. REPORT]  |
+--------------------------------------------------------------------------------------------------+

• Define facility metadata: Facility Name, Facility Type (Oil & Gas, Power Generation, Chemical, Water Treatment, Manufacturing, Nuclear, Rail).
• Configure Security Assurance Level (SAL): Low, Medium, High, or Very High.
• Select applicable regulatory frameworks (NCIIPC, CERT-In, IEC 62443, NIST SP 800-82, BIS IS 16335, CSET, ISO 27001).
• Assemble the audit team with specific roles (Lead Auditor, OT Specialist, Safety Engineer, Network Architect).

• Choose an architectural template or upload a plant network diagram image (PNG, JPG, WebP).
• Trigger Gemini Vision Analysis to automatically detect firewalls, PLCs, HMIs, SIS controllers, engineering stations, historians, and jump hosts.
• Manually tag or fine-tune detected equipment across Network, Control, IIoT, and Supporting Infrastructure categories.

• Questions adapt dynamically to the facility's SAL level, detected components, and selected standards.
• Evaluate controls with standard responses: Yes, No, Partial (requires justification note), or Alternative (ALT).
• Flag critical items for follow-up review.
• Upload photo evidence and documents for audit verification.
• Use OCR Camera Scan to convert paper notes or clipboard checklists into structured digital answers.

• Instant domain-by-domain compliance scores (0 - 100%).
• Response distribution breakdown (Compliance vs. Non-Compliance vs. Compensating Controls).
• High-level Purdue Model risk segmentation indicator.

• Generate an AI-synthesized Executive Summary, Compliance Strengths, Weaknesses, and Purdue Model Gap Analysis.
• Formulate a prioritized remediation roadmap (Immediate 0-30 days, Mid-Term 30-90 days, Strategic 90+ days).
• Export professional, branded PDF reports ready for boardrooms and regulatory filings.
• Save encrypted backup files with password protection.

ICS Auditor 1.0 is currently evolving from a standalone assessment tool into a comprehensive, open-source ICS/OT Security Framework:

1. Industrial Schema Definition Language (ISDL):

   • A standardized, declarative schema format (in YAML/JSON) enabling security teams, regulators, and OEMs to author and share custom compliance modules, sector-specific rule packs, and vendor-specific hardening baselines (e.g., Siemens TIA Portal, Rockwell Studio 5000, Schneider EcoStruxure).

2. Modular Protocol Probe Plugin Architecture:

   • An extensible plugin interface allowing safe, read-only passive discovery and validation of OT communication protocols (Modbus TCP, DNP3, OPC UA, EtherNet/IP, IEC 60870-5-104, Siemens S7comm).

3. MITRE ATT&CK for ICS Grounding:

   • Direct cross-referencing between identified audit non-conformances and MITRE ATT&CK for ICS techniques (e.g., T0814: Denial of Service, T0855: Unauthorized Command Message, T0886: Remote Services), helping teams visualize adversary kill chains.

4. Headless Audit CLI & CI/CD Pipeline Automation:

   • A command-line interface (ics-audit-cli) to enable continuous compliance checking for digital twins, PLC logic source code repositories, and Infrastructure-as-Code (Terraform / Ansible) OT network definitions.

5. Multi-Site Enterprise Fleet Management:

   • Centralized multi-tenant dashboard allowing CISOs to compare compliance posture and risk indexes across dozens of geographically distributed power substations, offshore platforms, or manufacturing plants.

ics-auditor-1.0/
├── .env.example                    # Sample environment variables template
├── firebase-applet-config.json     # Firebase project configuration
├── firebase-blueprint.json         # Firestore collections schema blueprint
├── firestore.rules                 # Granular Firestore security access rules
├── index.html                      # Single-page application entry HTML
├── metadata.json                   # Applet metadata & permissions manifest
├── package.json                    # Project dependencies and script definitions
├── tsconfig.json                   # TypeScript compiler options
├── vite.config.ts                  # Vite build tool and Tailwind CSS plugins
│
├── public/                         # Static assets and Web App icons
│   ├── favicon.svg
│   └── pwa-192x192.png
│
├── src-tauri/                      # Tauri v2 Desktop Engine
│   ├── Cargo.toml                  # Rust dependencies & metadata
│   ├── tauri.conf.json             # Desktop window, bundle, and security settings
│   └── src/                        # Rust backend entrypoints
│
└── src/                            # Frontend Application Source Code
    ├── App.tsx                     # Main application orchestrator & wizard views
    ├── index.tsx                   # React root mount point
    ├── index.css                   # Global styles & Tailwind v4 imports
    ├── types.ts                    # TypeScript types (SAL, Question, Report, etc.)
    ├── data.ts                     # Regulatory standards & Purdue templates
    │
    ├── components/                 # Reusable UI & Visualization Components
    │   ├── Dashboard.tsx           # Recharts compliance domain bar & pie charts
    │   └── NetworkDiagram.tsx      # OT topology selector & AI vision uploader
    │
    ├── lib/                        # Utility & Integration Libraries
    │   ├── firebase.ts             # Firebase Auth & Firestore client SDK
    │   └── imageUtils.ts           # Client-side image compression & format conversion
    │
    └── services/                   # Application Services
        ├── geminiService.ts        # Google Gemini Vision & LLM report synthesis
        └── pdfGenerator.ts         # High-resolution PDF document export engine