ICS515: ICS Visibility, Detection, and Response ICS515: ICS Visibility, Detection, and Response will help you gain visibility and asset identification in your Industrial Control System (ICS)/Operational Technology (OT) networks, monitor for and detect cyber threats, deconstruct ICS cyber attacks to extract lessons learned, perform incident response, and take an intelligence-driven approach to executing a world-leading ICS cybersecurity program to ensure safe and reliable operations. The course will empower students to understand their networked ICS environment, monitor it for threats, perform incident response against identified threats, and learn from interactions with the adversary to enhance network security. This approach is important to being able to counter sophisticated threats such as those seen with malware including STUXNET, HAVEX, BLACKENERGY2, CRASHOVERRIDE, TRISIS/TRITON, and ransomware. In addition, the efforts are also critical to understanding and running a modern day complex automation environment and achieving root cause analysis for non cyber-related events that manifest over the network. Students can expect to come out of this course with core skills necessary for any ICS cybersecurity program. The course uses a hands-on approach with numerous technical data sets from ICS ranges and equipment with emulated attacks and real world malware deployed in the ranges for a highly simulated experience detecting and responding to threats. Students will also interact with and keep a programmable logic controller (PLC), physical kit emulating electric system operations at the generation, transmission, and distribution level, and virtual machine set up as a human machine interface (HMI) and engineering workstation (EWS). Students will spend roughly half the course performing hands on skills across more than 25 technical exercises and an all day technical capstone. Students will gain a practical and technical understanding of defining an ICS cybersecurity strategy, leveraging threat intelligence, performing network security monitoring, and performing incident response. Frameworks such as the ICS Cyber Kill Chain, Collection Management Framework, and Active Cyber Defense Cycle will be taught to give students repeatable frameworks and models to leverage post class. The strategic and technical skills presented in this course serve as a basis for ICS organizations looking to show that ICS defense is do-able. Author Statement “This class was developed from my experiences in the U.S. intelligence community, at Dragos and within the control system community dealing with advanced adversaries targeting industrial control systems. It is the class I wish I would have had available to me while protecting infrastructure against these adversaries. It is exactly what you’ll need to maintain secure and reliable operations in the face of determined threats. ICS515 will empower you to prove that defense is do-able.” – Robert M. Lee You Will Be Able To • Analyze ICS-specific threats and take proper courses of action to defend the industrial control systems • Establish collection, detection, and response strategies for your ICS networks • Use proper procedures during ICS incident response • Examine ICS networks and identify the assets and their data flows in order to understand the network information needed to identify advanced threats • Use active defense concepts such as threat intelligence consumption, network security monitoring, malware analysis, and incident response to safeguard the ICS • Build your own Programmable Logic Controller using the SANS ICS515 Student Kit, which you retain after the class ends • Gain in-depth knowledge on ICS targeted threats and malware including STUXNET, HAVEX, BLACKENERGY2, CRASHOVERRIDE, TRISIS/TRITON, and EKANS • Leverage technical tools such as Shodan, Wireshark, Zeek, Suricata, Volatility, FTK Imager, PDF analyzers, PLC programming software, and more • Create indicators of compromise (IOCs) in YARA • Take advantage of models such as the Sliding Scale of Cybersecurity, the Active Cyber Defense Cycle, the Collection Management Framework, and the ICS Cyber Kill Chain to extract information from threats and use it to encourage the long-term success of ICS network security 6 Day Program 36 CPEs Laptop Required GRID Response and Industrial Defense giac.org/grid “ This course was like a catalyst. It not only boosted my knowledge about the threats facing ICS environments and provided me with a framework to actively defend these threats, it also inspired me to learn more.” —Srinath Kannan, Accenture sans.org/ics515 GIAC Response and Industrial Defense The GRID certification is for professionals who want to demonstrate that they can perform Active Defense strategies specific to and appropriate for an Industrial Control System (ICS) network and systems. Candidates are required to demonstrate an understanding of the Active Defense approach, ICS-specific attacks and how these attacks inform mitigation strategies. Candidates must also show an understanding of the strategies and fundamental techniques specific to core subjects with an ICS-focus such as network security monitoring (NSM), digital forensics and incident response (DFIR). • Active Defense Concepts and Application, Detection and Analysis in an ICS environment • Discovery and Monitoring in an ICS environment, ICS- focused Digital Forensics, and ICS-focused Incident Response • Malware Analysis Techniques, Threat Analysis in an ICS environment, and Threat Intelligence Fundamentals GRID Response and Industrial Defense giac.org/grid • Watch a preview of this course • Discover how to take this course: In-Person, Live Online, or OnDemand
