ICS612: SANS London July 2025

What You Will Learn

ICS-Aware malware and attacks on critical infrastructure are increasing in frequency and sophistication. You need to identify threats and vulnerabilities and methods to secure your ICS environment. Let us show you how!

The ICS612: ICS Cybersecurity In-Depth course will help you

• Learn active and passive methods to safely gather information about an ICS environment
• Identify vulnerabilities in ICS environments
• Determine how attackers can maliciously interrupt and control processes and how to build defenses
• Implement proactive measures to prevent, detect, slow down, or stop attacks
• Understand ICS operations and what "normal" looks like
• Build choke points into an architecture and determine how they can be used to detect and respond to security incidents
• Manage complex ICS environments and develop the capability to detect and respond to ICS security events

The course concepts and learning objectives are primarily driven by the focus on hands-on labs. The in-classroom lab setup was developed to simulate a real-world environment where a controller is monitoring/controlling devices deployed in the field along with a field-mounted touchscreen Human Machine Interface (HMI) available for local personnel to make needed process changes. Utilizing operator workstations in a remotely located control center, system operators use a SCADA system to monitor and control the field equipment. Representative of a real ICS environment, the classroom setup includes a connection to the enterprise, allowing for data transfer (i.e., Historian), remote access, and other typical corporate functions.

The labs move students through a variety of exercises that demonstrate how an attacker can attack a poorly architected ICS (which, sadly, is not uncommon) and how defenders can secure and manage the environment.