ICS410: SANS London May 2025

What You Will Learn
This is the ICS/OT-specific training needed to defend critical systems the world relies on.

Critical infrastructure and key resource sectors face a rapidly evolving threat landscape, where cyberattacks can disrupt essential services, compromise safety, and cause significant economic and operational harm. Professionals who operate, manage, design, implement, monitor, and defend control systems are at the forefront of this challenge. This course is designed specifically for these practitioners, providing the essential skills and knowledge needed to secure and support control systems in high-stakes environments. This course equips professionals to address the day-to-day security needs of critical infrastructure—ensuring resilience, safety, and operational continuity.
The course will provide you with:

• An understanding of industrial control system components, purposes, deployments, significant drivers, and constraints
• Hands-on lab learning experiences to control system attack surfaces, methods, and tools
• Control system approaches to system and network defense architectures and techniques
• Incident-response skills in a control system environment
• Governance models and resources for industrial cybersecurity professionals

With the dynamic nature of industrial control systems, many professionals in these environments do not fully understand the features and risks of many devices. In addition, IT support personnel who provide the communications paths and network defenses do not always grasp the systems' operational drivers and constraints. This course is designed to help traditional IT personnel fully understand the design principles underlying control systems and how to support those systems in a manner that ensures availability and integrity. In parallel, the course addresses the need for control system engineers and operators to better understand the important role they play in cybersecurity. This starts by ensuring that a control system is designed and engineered with cybersecurity built into it, and that cybersecurity has the same level of focus as system reliability throughout the system lifecycle.

When these different groups of professionals complete this course, they will have developed an appreciation, understanding, and common language that will enable them to work together to secure their industrial control system environments. The course will help develop cyber-secure-aware engineering practices and real-time control system IT/OT support carried out by professionals who understand the physical effects of actions in the cyber world.
You Will Be Able To

• Better understand various industrial control systems and their purpose, application, function, and dependencies on network IP and industrial communications
• Work with control network infrastructure design (network architecture concepts, including topology, protocols, and components) and their relation to IEC 62443 and the Purdue Model.
• Run Windows command line tools to analyze the system looking for high-risk items
• Run Linux command line tools (ps, ls, netstat, ect) and basic scripting to automate the running of programs to perform continuous monitoring of various tools
• Work with operating systems (system administration concepts for Unix/Linux and/or Windows operating systems)
• Better understand the systems' security lifecycle
• Better understand information assurance principles and tenets (confidentiality, integrity, availability, authentication, non-repudiation)
• Use your skills in computer network defense (detecting host and network-based intrusions via intrusion detection technologies)
• Implement incident response and handling methodologies
• Map different ICS technologies, attacks, and defenses to various cybersecurity standards including NIST Cyber Security Framework, ISA/IEC 62443, ISO/IEC 27001, NIST SP 800-53, Center for Internet Security Critical Security Controls, and COBIT 5

Hands-On Training

• Programming a PLC
• Programming an HMI
• Architecting a Secure DCS
• Finding Passwords in Embedded Devices
• Exploring Fieldbus Protocols
• Network Capture Analysis
• Enumerating Modbus TCP
• Network Forensics of an Attack
• Bypassing Auth with SQL Injection
• Password Fuzzing
• Baselining with PowerShell
• Configuring Host-Based Firewalls
• Windows Event Logs
• Finding Remote Access
• Incident Response Tabletop Exercise

What You Will Receive

• Electronic Download Package contining ICS cybersecurity related posters, whitepapers, use cases, and cheat sheets
• A virtual machine of the Control Things Platform, an opensourced, linux-based distribution designed for performing security assessments on ICS systems
• A virtual machine of Windows 10 for course exercises
• MP3 audio files of the complete course lecture
• A hardware PLC for students to use in class and take home with them