ICS410: ICS/SCADA Security Essentials SANS has joined forces with industry leaders to equip security professionals and control system engineers with the cybersecurity skills they need to defend national critical infrastructure. ICS410: ICS/SCADA Security Essentials provides a foundational set of standardized skills and knowledge for industrial cybersecurity professionals. The course is designed to ensure that the workforce involved in supporting and defending industrial control systems (ICS) is trained to keep the operational environment safe, secure, and resilient against current and emerging cyber threats. The course will provide you with: • An understanding of ICS components, purposes, deployments, significant drivers, and constraints • Hands-on lab learning experiences to control system attack surfaces, methods, and tools • Control system approaches to system and network defense architectures and techniques • Incident-response skills in a control system environment • Governance models and resources for industrial cybersecurity professionals When examining the greatest risks and needs in critical infrastructure sectors, the course authors looked carefully at the core security principles necessary for the range of tasks involved in supporting control systems on a daily basis. While other courses are available for higher-level security practitioners who need to develop specific skills such as industrial control system penetration testing, vulnerability analysis, malware analysis, forensics, secure coding, and red team training, most of these courses do not focus on the people who operate, manage, design, implement, monitor, and integrate critical infrastructure production control systems. With the dynamic nature of industrial control systems, many engineers do not fully understand the features and risks of many devices. In addition, IT support personnel who provide the communications paths and network defenses do not always grasp the systems’ operational drivers and constraints. This course is designed to help traditional IT personnel fully understand the design principles underlying control systems and how to support those systems in a manner that ensures availability and integrity. In parallel, the course addresses the need for control system engineers and operators to better understand the important role they play in cybersecurity. This starts by ensuring that a control system is designed and engineered with cybersecurity built into it, and that cybersecurity has the same level of focus as system reliability throughout the system lifecycle. When these different groups of professionals complete this course, they will have developed an appreciation, understanding, and common language that will enable them to work together to secure their industrial control system environments. The course will help develop cyber- secure-aware engineering practices and real-time control system IT /OT support carried out by professionals who understand the physical effects of actions in the cyber world. Author Statement “This course provides students with the essentials for conducting cybersecurity work in industrial control system environments. After spending years working with industry, we believe there is a gap in the skill sets of industrial control system personnel, whether it be cybersecurity skills for engineers or engineering principles for cybersecurity experts. In addition, both information technology and operational technology roles have converged in today’s industrial control system environments, so there is a greater need than ever for a common understanding between the various groups who support or rely on these systems. Students in ICS410 will learn the language, the underlying theory, and the basic tools for industrial control system security in settings across a wide range of industry sectors and applications.” – Justin Searle You Will Be Able To • Better understand various industrial control systems and their purpose, application, function, and dependencies on network IP and industrial communications • Work with control network infrastructure design (network architecture concepts, including topology, protocols, and components) and their relation to IEC 62443 and the Purdue Model. • Run Windows command line tools to analyze the system looking for high-risk items • Run Linux command line tools (ps, ls, netstat, ect) and basic scripting to automate the running of programs to perform continuous monitoring of various tools • Work with operating systems (system administration concepts for Unix/Linux and/or Windows operating systems) • Better understand the systems’ security lifecycle • Better understand information assurance principles and tenets (confidentiality, integrity, availability, authentication, non- repudiation) • Use your skills in computer network defense to detect host and network- based intrusions via intrusion detection technologies • Implement incident response and handling methodologies • Map different ICS technologies, attacks, and defenses to various cybersecurity standards including the NIST Cyber Security Framework, ISA/IEC 62443, ISO/IEC 27001, NIST SP 800-53, the Center for Internet Security Critical Security Controls, and COBIT 5 6 Day Program 36 CPEs Laptop Required GICSP Industrial Cyber Security Professional giac.org/gicsp sans.org/ics410 • Watch a preview of this course • Discover how to take this course: In-Person, Live Online, or OnDemand “ A mix of hands-on and theoretical class, being driven by a highly skilled instructor, makes this the best training in ICS security.” —Rafael Issa, Technip
