ICS515: ICS Active Defense and Incident Response

Provided by

About the course


ICS515: ICS Active Defense and Incident Response
Mon, September 23 - Fri, September 27, 2019
Contents | Additional Info
Instructor: Mark Bristow
 6,025 EUR 5,775 EUR paid by Aug 21
GRID Certification
Affiliate Pricing
30 CPEs

Laptop Required

I absolutely feel more confident in my ability to do my job.

Jim Gilsinn, Kenexis

Very good focus on the OT/ICS side & integrated into class.

Josh Tanski, Morton Salt

ICS515: ICS Active Defense and Incident Response will help you deconstruct ICS cyber attacks, leverage an active defense to identify and counter threats in your ICS, and use incident response procedures to maintain the safety and reliability of operations.

This SANS course on ICS Active Defense and Incident Response will empower students to understand their networked industrial control system environment, monitor it for threats, perform incident response against identified threats, and learn from interactions with the adversary to enhance network security. This process of monitoring, responding to, and learning from threats internal to the network is known as active defense. An active defense is the approach needed to counter advanced adversaries targeting ICS, as has been seen with malware such as Stuxnet, Havex, and BlackEnergy2. Students can expect to come out of this course with the ability to deconstruct targeted ICS attacks and fight these adversaries and others. The course uses a hands-on approach and real-world malware to break down cyber attacks on ICS from start to finish. Students will gain a practical and technical understanding of leveraging active defense concepts such as using threat intelligence, performing network security monitoring, and utilizing malware analysis and incident response to ensure the safety and reliability of operations. The strategy and technical skills presented in this course serve as a basis for ICS organizations looking to show that defense is do-able.

You Will Learn:

  • How to perform ICS incident response focusing on security operations and prioritizing the safety and reliability of operations.
  • How ICS threat intelligence is generated and how to use what is available in the community to support ICS environments. The analysis skills you learn will enable you to critically analyze and apply information from ICS threat intelligence reports on a regular basis.
  • How to identify ICS assets and their network topologies and how to monitor ICS hotspots for abnormalities and threats. Methodologies such as ICS network security monitoring and approaches to reducing the control system threat landscape will be introduced and reinforced.
  • How to analyze ICS malware and extract the most important information needed to quickly scope the environment and understand the nature of the threat.
  • How to operate through an attack and gain the information necessary to instruct teams and decision-makers on when operations must shut down, or if it is safe to respond to the threat and continue operations.
  • How to use multiple security disciplines in conjunction with each other to leverage an active defense and safeguard the ICS, all reinforced with hands-on labs and technical concepts.

Course Syllabus
  ICS515.1: Threat Intelligence
  ICS515.2: Asset Identification and Network Security Monitoring
  ICS515.3: Incident Response
  ICS515.4: Threat and Environment Manipulation
  ICS515.5: Active Defense and Incident Response Challenge


Author Statement
This class was developed from my experiences in the U.S. intelligence community and within the control system community dealing with advanced adversaries targeting industrial control systems. It is the class I wish I would have had available to me while protecting infrastructure against these adversaries. It is exactly what you'll need to maintain secure and reliable operations in the face of determined threats. ICS515 will empower you to prove that defense is do-able.

- Robert M. Lee

Related article

Cyber security training is falling short, one expert has warned. A global expert in cyber security has warned that the dearth of talent in the indu...