3 Days Left to Save $400 on SANS Cyber Defense Initiative 2014, Wash DC

Community SANS

Charlotte, NC | Mon Jul 14 - Fri Jul 18, 2014
 

ICS410: ICS/SCADA Security Essentials

SANS has joined forces with industry leaders to equip security professionals and control system engineers with the cybersecurity skills they need to defend national critical infrastructure. ICS410: ICS/SCADA Security Essentials provides a foundational set of standardized skills and knowledge for industrial cybersecurity professionals. The course is designed to ensure that the workforce involved in supporting and defending industrial control systems is trained to keep the operational environment safe, secure, and resilient against current and emerging cyber threats.

The course will provide you with:

  • An understanding of industrial control system components, purposes, deployments, significant drivers, and constraints.
  • Hands-on lab learning experiences to control system attack surfaces, methods, and tools
  • Control system approaches to system and network defense architectures and techniques
  • Incident-response skills in a control system environment
  • Governance models and resources for industrial cybersecurity professionals.

When examining the greatest risks and needs in critical infrastructure sectors, the course authors looked carefully at the core security principles necessary for the range of tasks involved in supporting control systems on a daily basis. While other courses are available for higher-level security practitioners who need to develop specific skills such as industrial control system penetration testing, vulnerability analysis, malware analysis, forensics, secure coding, and red team training, most of these courses do not focus on the people who operate, manage, design, implement, monitor, and integrate critical infrastructure production control systems.

With the dynamic nature of industrial control systems, many engineers do not fully understand the features and risks of many devices. In addition, IT support personnel who provide the communications paths and network defenses do not always grasp the systems' operational drivers and constraints. This course is designed to help traditional IT personnel fully understand the design principles underlying control systems and how to support those systems in a manner that ensures availability and integrity. In parallel, the course addresses the need for control system engineers and operators to better understand the important role they play in cybersecurity. This starts by ensuring that a control system is designed and engineered with cybersecurity built into it, and that cybersecurity has the same level of focus as system reliability throughout the system lifecycle.

When these different groups of professionals complete this course, they will have developed an appreciation, understanding, and common language that will enable them to work together to secure their industrial control system environments. The course will help develop cyber-secure-aware engineering practices and real-time control system IT /OT support carried out by professionals who understand the physical effects of actions in the cyber world.

Course Content Overlap Notice:

Please note that some course material for SEC401 may overlap with ICS410. We recommend ICS410 for those interested in security for an ICS/SCADA environment as it is approached from this viewpoint, and SEC401 for those primarily interested in a general information security course.

Course Syllabus
Course Contents InstructorsSchedule
  ICS410.1: ICS Overview Graham Speake Mon Jul 14th, 2014
9:00 AM - 5:00 PM

CPE/CMU Credits: 6

Topics
  • Overview of ICS
  • Field components
  • Network components
  • Communications
  • ICS Application Overview
  • Industry models
  • ICS drivers and constraints
  • Physical Security & Safety Systems

 
  ICS410.2: ICS Attack Surface Graham Speake Tue Jul 15th, 2014
9:00 AM - 5:00 PM

CPE/CMU Credits: 6

Topics
  • Overview of ICS Attack Surface
  • Attacks on HMIs and User Interfaces
  • Attacks on Control Servers
  • Attacks on Network Communications
  • Attacks on Remote Devices

 
  ICS410.3: Defending ICS Servers and Workstations Graham Speake Wed Jul 16th, 2014
9:00 AM - 5:00 PM

CPE/CMU Credits: 6

Topics
  • ICS Server and Workstation Technologies
  • ICS Server Operating Systems
  • System and Security Updates
  • Enforcing Security Policy
  • Automation, Auditing, and Forensics
  • System Processes and Services
  • Logs and Log Management
  • ICS System Hardening
  • Databases and Historians

 
  ICS410.4: Defending ICS Networks and Devices Graham Speake Thu Jul 17th, 2014
9:00 AM - 5:00 PM

CPE/CMU Credits: 6

Topics
  • Network Fundamentals
  • Lower Layers of TCP/IP
  • Middle Layers of TCP/IP
  • Firewalls and Honeypots
  • Wireless Network Security
  • Controller and Field Device Security
  • Cryptography Fundamentals

 
  ICS410.5: ICS Governance and Resources Graham Speake Fri Jul 18th, 2014
9:00 AM - 5:00 PM

CPE/CMU Credits: 6

Topics
  • Information assurance foundations
  • Computer Security Policies
  • Contingency and Continuity Planning
  • Risk assessment and auditing
  • Password management
  • Incident Handling
  • Resources

 
Additional Information
 
  Laptop Required

The ICS 410 Industrial Control System Security Essentials course consists of instruction and hands-on sessions. The lab sessions are designed to allow students to utilize the knowledge gained throughout the course in an instructor-led environment. Students will have the opportunity to install, configure, and use the tools and techniques that they have learned.

NOTE: Do not bring a regular production laptop for this class! When installing software, there is always a chance of breaking something else on the system. Students should assume that all data could be lost.

NOTE: It is critical that students have administrator access to the operating system and all security software installed. Changes may need to be made to personal firewalls and other host-based software in order for the labs to work.

  • Laptop with at least one USB port.
  • Laptop with DVD Reader.
  • Latest VMware Player, VMware Workstation, or VWware Fusion installed. Other virtualization software such as Parallels or VirtualBox will probably work if the attendee is familiar with its functionality; however VMware Player should be prepared as a backup just in case.
  • Ability to disable all security software on their laptop such as Antivirus and/or firewalls
  • At least twenty (20) GB of hard drive space
  • At least four (4) GB of RAM

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

 
  Who Should Attend

The course is designed for the range of individuals who work in, interact with, or can affect industrial control system environments, including asset owners, vendors, integrators, and other third parties. These personnel primarily come from four domains:

  • IT (includes operational technology support)
  • IT security (includes operational technology security)
  • Engineering
  • Corporate, industry, and professional standards

 
  Prerequisites

Course participants need to have a basic understanding of networking and system administration, TCP/IP, networking design/architecture, vulnerability assessment, and risk methodologies. ICS410 covers many of the core areas of security and assumes a basic understanding of technology, networks, and security. For those who are brand new to the field and have no background knowledge, SEC301: Intro to Information Security would be the recommended starting point. While SEC301 is not a prerequisite, it provides introductory knowledge that will help maximize a student's experience with ICS410.

 
  What You Will Receive
  • Software tools
  • Virtual Machine environments will be utilized throughout the labs

 
  You Will Be Able To
  • Run Windows command line tools to analyze the system looking for high-risk items
  • Run Linux command line tools (ps, ls, netstat, ect) and basic scripting to automate the running of programs to perform continuous monitoring of various tools
  • Install VMWare and create virtual machines to create a virtual lab to test and evaluate tools/security of systems
  • Better understand various industrial control systems and their purpose, application, function, and dependencies on network IP and industrial communications
  • Work with operating systems (system administration concepts for Unix/Linux and/or Windows operating systems)
  • Work with network infrastructure design (network architecture concepts, including topology, protocols, and components)
  • Better understand the systems' security lifecycle
  • Better understand information assurance principles and tenets (confidentiality, integrity, availability, authentication, non-repudiation)
  • Use your skills in computer network defense (detecting host and network-based intrusions via intrusion detection technologies)
  • Implement incident response and handling methodologies

 
  Hands-on Training
  • Introduction to Samurai STFU
  • Architect a secure DCS
  • Information Leakage
  • Password Fuzzing
  • Bypassing Authentication with SQLi
  • Spoofing Modbus-TCP control signals
  • Finding Passwords in EEPROM dumps
  • Host Based Firewalls
  • Linux Hardening
  • ICS Network Capture Analysis
  • Network Capture Forensics
  • Attack Tree Analysis
  • Incident response exercise

 
  What To Take Next?

Courses that lead in to ICS410:

  • SEC 301
  • STH Modules
  • STH.Engineer Modules

Courses that are prerequisites:

  • SEC 301 is not required, but it is recommended that students either take that course or have a working knowledge of the concepts taught in it.

Courses that are good follow-ups:

  • SANS Hosted: Critical Infrastructure and Control System Cybersecurity
  • SANS Hosted: Assessing and Exploiting Control Systems
  • SEC440: 20 Critical Security Controls: Planning, Implementing and Auditing

 

Author Statement

Eric Cole, Eric Cornelius, and Justin Searle

This course provides students with the essentials for conducting cybersecurity work in industrial control system environments. After spending years working with industry, we believe there is a gap in the skill sets of industrial control system personnel, whether it be cybersecurity skills for engineers or engineering principles for cybersecurity experts. In addition, both information technology and operational technology roles have converged in today's industrial control system environments, so there is a greater need than ever for a common understanding between the various groups who support or rely on these systems. Students in ICS410 will learn the language, the underlying theory, and the basic tools for industrial control system security in settings across a wide range of industry sectors and applications.

Venue Information

  • SERC Reliability Corporation
  • 3701 Arco Corporate Dr
    Charlotte, NC 28273 US