homepage
Open menu
Go one level top
  • Train and Certify
    Train and Certify

    Immediately apply the skills and techniques learned in SANS courses, ranges, and summits

    • Overview
    • Courses
      • Overview
      • Full Course List
      • By Focus Areas
        • Cloud Security
        • Cyber Defense
        • Cybersecurity and IT Essentials
        • DFIR
        • Industrial Control Systems
        • Offensive Operations
        • Management, Legal, and Audit
      • By Skill Levels
        • New to Cyber
        • Essentials
        • Advanced
        • Expert
      • Training Formats
        • OnDemand
        • In-Person
        • Live Online
      • Course Demos
    • Training Roadmaps
      • Skills Roadmap
      • Focus Area Job Roles
        • Cyber Defence Job Roles
        • Offensive Operations Job Roles
        • DFIR Job Roles
        • Cloud Job Roles
        • ICS Job Roles
        • Leadership Job Roles
      • NICE Framework
        • Security Provisionals
        • Operate and Maintain
        • Oversee and Govern
        • Protect and Defend
        • Analyze
        • Collect and Operate
        • Investigate
        • Industrial Control Systems
    • GIAC Certifications
    • Training Events & Summits
      • Events Overview
      • Event Locations
        • Asia
        • Australia & New Zealand
        • Latin America
        • Mainland Europe
        • Middle East & Africa
        • Scandinavia
        • United Kingdom & Ireland
        • United States & Canada
      • Summits
    • OnDemand
    • Get Started in Cyber
      • Overview
      • Degree and Certificate Programs
      • Scholarships
    • Cyber Ranges
  • Manage Your Team
    Manage Your Team

    Build a world-class cyber team with our workforce development programs

    • Overview
    • Why Work with SANS
    • Group Purchasing
    • Build Your Team
      • Team Development
      • Assessments
      • Private Training
      • Hire Cyber Professionals
      • By Industry
        • Health Care
        • Industrial Control Systems Security
        • Military
    • Leadership Training
  • Security Awareness
    Security Awareness

    Increase your staff’s cyber awareness, help them change their behaviors, and reduce your organizational risk

    • Overview
    • Products & Services
      • Security Awareness Training
        • EndUser Training
        • Phishing Platform
      • Specialized
        • Developer Training
        • ICS Engineer Training
        • NERC CIP Training
        • IT Administrator
      • Risk Assessments
        • Knowledge Assessment
        • Culture Assessment
        • Behavioral Risk Assessment
    • OUCH! Newsletter
    • Career Development
      • Overview
      • Training & Courses
      • Professional Credential
    • Blog
    • Partners
    • Reports & Case Studies
  • Resources
    Resources

    Enhance your skills with access to thousands of free resources, 150+ instructor-developed tools, and the latest cybersecurity news and analysis

    • Overview
    • Webcasts
    • Free Cybersecurity Events
      • Free Events Overview
      • Summits
      • Solutions Forums
      • Community Nights
    • Content
      • Newsletters
        • NewsBites
        • @RISK
        • OUCH! Newsletter
      • Blog
      • Podcasts
      • Summit Presentations
      • Posters & Cheat Sheets
    • Research
      • White Papers
      • Security Policies
    • Tools
    • Focus Areas
      • Cyber Defense
      • Cloud Security
      • Digital Forensics & Incident Response
      • Industrial Control Systems
      • Cyber Security Leadership
      • Offensive Operations
  • Get Involved
    Get Involved

    Help keep the cyber community one step ahead of threats. Join the SANS community or begin your journey of becoming a SANS Certified Instructor today.

    • Overview
    • Join the Community
    • Work Study
    • Teach for SANS
    • CISO Network
    • Partnerships
    • Sponsorship Opportunities
  • About
    About

    Learn more about how SANS empowers and educates current and future cybersecurity practitioners with knowledge and skills

    • SANS
      • Overview
      • Our Founder
      • Awards
    • Instructors
      • Our Instructors
      • Full Instructor List
    • Mission
      • Our Mission
      • Diversity
      • Scholarships
    • Contact
      • Contact Customer Service
      • Contact Sales
      • Press & Media Enquiries
    • Frequent Asked Questions
    • Customer Reviews
    • Press
    • Careers
  • Contact Sales
  • SANS Sites
    • GIAC Security Certifications
    • Internet Storm Center
    • SANS Technology Institute
    • Security Awareness Training
  • Search
  • Log In
  • Join
    • Account Dashboard
    • Log Out
  1. Home >
  2. Blog >
  3. SANS Addresses ICS/OT Cyber Defence | Training in Oslo
SANS ICS

SANS Addresses ICS/OT Cyber Defence | Training in Oslo

Dean Parsons, Certified Industrial Control System instructor, addresses control system cyber defence through teaching the newly updated ICS515 course.

November 23, 2021

Can your security and engineering teams run your industrial operations and control system operations in manual mode in the case of a ransomware cyber event? How are your facilities conducting remote access, and is it secure? Does your ICS/OT security program monitor control networks with ICS-specific traffic analysis tools to prepare for active incident response and a resilient incident recovery?

Supply Chain attacks are increasingly a viable vector for some adversaries. Malware such as Ryuk, Darkside and Ekans-type ransomware continue to threaten Industrial Control System (ICS) operations. Suboptimal secure remote access will be abused by adversaries on the Internet if multi factor authentication is not deployed. ICS targeted attacks are “living off the land” – abusing and turning legitimate ICS/OT systems and software against the ICS itself to cause impact.

Recent targeting and an intrusion into a water utility in Oldsmar Florida [1] in early 2021 shows an attacker remotely using the Human Machine Interface (HMI) on an operator’s machine to manipulate the process. Specifically, the attacker manipulated set points and increased the amount of a chemical normally used in the water process, Sodium Hydroxide (NaOH). NaOH is normally used in the process of treating drinking water, but in higher than normal amounts it can be very hazardous to humans.

The method of attack is not limited to water utilities. Facilities should ensure remote access, if required, follow the principle of least privilege, should deploy multi-factor authentication to a secure “jump box” in an ICS-DMZ zone with separate authentication than that of a business domain, and always monitor remote connections. Furthermore, ICS networks should always be properly segmented from business networks, between process zones, safety systems and the Internet. Another significate event from 2021 was the effects of Ransomware on an IT network as part of the Colonial Pipeline infrastructure, where the incident did in several ways have impacts on logistics and/or billing of the ICS operations. The incident ultimately lead to a pipeline shutdown as a safety precaution [2].

Cybersecurity in ICS is all about safety 1st! So, those new to managing OT security, or in a recently converged IT & OT environment should know IT practices will need to be adapted for ICS networks to prioritize safety. This means a nuanced discussion on if or where encryption is used, network traffic threat prevention vs. detection, and a growing requirement for “plant-floor” and ICS specific control system network visibility for proactive ICS defence and industrial incident response.

A significant number of adversary tactics, techniques, and attack procedures (TTPs or tradecraft) can be detected by Network Security Monitoring (NSM) of control system traffic. This is crucial to detecting the types of threats briefed here and can also spot "living off the land" techniques seen in recent ICS targeted events such as CRASHOVERRIDE [3] and TRISIS/Hatman [4] - adversaries abusing native ICS protocols. At a minimum, ICS facilities and critical infrastructure operations should work to deploy and maintain the ICS ACDC [5] (Active Cyber Defense Cycle). This means a dedicated team being actively involved with monitoring and responding appropriately to ICS threats, how are specifically trained in ICS/OT control system cyber security and defence. Trained ICS/OT defenders know well how to setup, deploy, and maintain the ACDC cycle for proactive control systems defence. ACDC consists of five parts.

Picture_1.png


1. Threat Intelligence Consumption. Cyber threat intel is refined information with context on cyber threats and threat groups, which defenders can leverage to detect, scope, or prevent the same or similar attacks previously observed.

2. Visibility. This means having a comprehensive asset inventory and a passive view of the ICS network traffic, utilizing technology that can dissect and properly interpret specific industrial protocols in network.

3. Threat Detection. Detecting threats requires the capability to leverage technology that sifts through data for malicious signs of attack attempts or intruder entry, and trained ICS specific defenders that can hunt for threats.

4. Incident Response. Successful incident response requires having forensic capabilities to execute quick triage and adapting steps of incident response specific to control systems, while maintaining and considering safety, by trained ICS specific defenders

5. Threat and Environment Manipulation. To make the environment less habitable for the threat, defenders need to know how to change the threat during the attack or change the control system to “fight through the attack.” A threat is defined as a malware capability introduced by a threat actor, or human threat actors abusing legitimate operational software or legitimate protocols with malicious intent to cause

      ACDC is best deployed after proper ICS network architecture is completed to enable a dedicated team to spot abnormal network activity compared to what’s “normal” for the ICS environment and ICS protocols.

      Join Dean in class in Oslo, In-Person March 28 - April 2 for the massively updated ICS515 class – ICS Visibility, Detection, and Response: https://www.sans.org/cyber-sec...

      The course has updated ICS case studies with lessons learned applicable to all ICS sectors and critical infrastructure systems. Each student is provided with an industrial lab kit for us in class and to keep after the class for further learning back at their home or work. The newly updated ICS515 course also has more than 25 hands on technical labs and a full day of ICS NetWars activities to apply the course knowledge to attack and defence scenarios.

      Picture_2.png


      Dean Parsons B.SC., GICSP, GRID, CISSP, GSLC, GCIA

      Certified SANS ICS Instructor | Critical Infrastructure & ICS Cybersecurity Leader

      http://linkedin.com/in/dean-parsons-cybersecurity

      https://www.sans.org/profiles/dean-parsons/

      1. https://www.youtube.com/watch?v=MkXDSOgLQ6M&ab_channel=PinellasSheriff

      2. 

      3. https://www.dragos.com/wp-cont...

      4. https://us-cert.cisa.gov/ics/M...

      5. https://www.sans.org/cyber-sec...

      Share:
      TwitterLinkedInFacebook
      Copy url Url was copied to clipboard
      Subscribe to SANS Newsletters
      Receive curated news, vulnerabilities, & security awareness tips
      United States
      Canada
      United Kingdom
      Spain
      Belgium
      Denmark
      Norway
      Netherlands
      Australia
      India
      Japan
      Singapore
      Afghanistan
      Aland Islands
      Albania
      Algeria
      American Samoa
      Andorra
      Angola
      Anguilla
      Antarctica
      Antigua and Barbuda
      Argentina
      Armenia
      Aruba
      Austria
      Azerbaijan
      Bahamas
      Bahrain
      Bangladesh
      Barbados
      Belarus
      Belize
      Benin
      Bermuda
      Bhutan
      Bolivia
      Bonaire, Sint Eustatius, and Saba
      Bosnia And Herzegovina
      Botswana
      Bouvet Island
      Brazil
      British Indian Ocean Territory
      Brunei Darussalam
      Bulgaria
      Burkina Faso
      Burundi
      Cambodia
      Cameroon
      Cape Verde
      Cayman Islands
      Central African Republic
      Chad
      Chile
      China
      Christmas Island
      Cocos (Keeling) Islands
      Colombia
      Comoros
      Cook Islands
      Costa Rica
      Croatia (Local Name: Hrvatska)
      Curacao
      Cyprus
      Czech Republic
      Democratic Republic of the Congo
      Djibouti
      Dominica
      Dominican Republic
      East Timor
      East Timor
      Ecuador
      Egypt
      El Salvador
      Equatorial Guinea
      Eritrea
      Estonia
      Ethiopia
      Falkland Islands (Malvinas)
      Faroe Islands
      Fiji
      Finland
      France
      French Guiana
      French Polynesia
      French Southern Territories
      Gabon
      Gambia
      Georgia
      Germany
      Ghana
      Gibraltar
      Greece
      Greenland
      Grenada
      Guadeloupe
      Guam
      Guatemala
      Guernsey
      Guinea
      Guinea-Bissau
      Guyana
      Haiti
      Heard And McDonald Islands
      Honduras
      Hong Kong
      Hungary
      Iceland
      Indonesia
      Iraq
      Ireland
      Isle of Man
      Israel
      Italy
      Jamaica
      Jersey
      Jordan
      Kazakhstan
      Kenya
      Kiribati
      Korea, Republic Of
      Kosovo
      Kuwait
      Kyrgyzstan
      Lao People's Democratic Republic
      Latvia
      Lebanon
      Lesotho
      Liberia
      Liechtenstein
      Lithuania
      Luxembourg
      Macau
      Macedonia
      Madagascar
      Malawi
      Malaysia
      Maldives
      Mali
      Malta
      Marshall Islands
      Martinique
      Mauritania
      Mauritius
      Mayotte
      Mexico
      Micronesia, Federated States Of
      Moldova, Republic Of
      Monaco
      Mongolia
      Montenegro
      Montserrat
      Morocco
      Mozambique
      Myanmar
      Namibia
      Nauru
      Nepal
      Netherlands Antilles
      New Caledonia
      New Zealand
      Nicaragua
      Niger
      Nigeria
      Niue
      Norfolk Island
      Northern Mariana Islands
      Oman
      Pakistan
      Palau
      Palestine
      Panama
      Papua New Guinea
      Paraguay
      Peru
      Philippines
      Pitcairn
      Poland
      Portugal
      Puerto Rico
      Qatar
      Reunion
      Romania
      Russian Federation
      Rwanda
      Saint Bartholemy
      Saint Kitts And Nevis
      Saint Lucia
      Saint Martin
      Saint Vincent And The Grenadines
      Samoa
      San Marino
      Sao Tome And Principe
      Saudi Arabia
      Senegal
      Serbia
      Seychelles
      Sierra Leone
      Sint Maarten
      Slovakia
      Slovenia
      Solomon Islands
      South Africa
      South Georgia and the South Sandwich Islands
      South Sudan
      Sri Lanka
      St. Helena
      St. Pierre And Miquelon
      Suriname
      Svalbard And Jan Mayen Islands
      Swaziland
      Sweden
      Switzerland
      Taiwan
      Tajikistan
      Tanzania
      Thailand
      Togo
      Tokelau
      Tonga
      Trinidad And Tobago
      Tunisia
      Turkey
      Turkmenistan
      Turks And Caicos Islands
      Tuvalu
      Uganda
      Ukraine
      United Arab Emirates
      United States Minor Outlying Islands
      Uruguay
      Uzbekistan
      Vanuatu
      Vatican City
      Venezuela
      Vietnam
      Virgin Islands (British)
      Virgin Islands (U.S.)
      Wallis And Futuna Islands
      Western Sahara
      Yemen
      Yugoslavia
      Zambia
      Zimbabwe

      By providing this information, you agree to the processing of your personal data by SANS as described in our Privacy Policy.

      This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

      Tags:
      • Industrial Control Systems Security

      Related Content

      Blog
      Industrial Control Systems Security
      June 20, 2022
      Michael J. Assante ICS Security Lifetime Achievement Award
      2022 Recipient - Jeffrey Shearer The SANS Institute is pleased to announce that Jeffrey Shearer has been named the 2022 recipient of the Michael J. Assante ICS Security Lifetime Achievement Award. Jeff Shearer is the Technical Director and Founder of Gray Man Cyber, where he provides Industrial...
      SANS ICS
      read more
      Blog
      ICS_Summit_Blog_Teaser.jpg
      Industrial Control Systems Security, Digital Forensics and Incident Response
      June 2, 2022
      A Visual Summary of SANS ICS Security Summit 2022
      On June 2nd and 3rd, thousands from around the globe tuned in for the SANS ICS Security Summit. We invited Ashton Rodenhiser of Mind's Eye Creative to create graphic recordings of our Summit presentations. If you missed a talk or are looking to view the SANS ICS Security Summit through a visual...
      370x370-person-placeholder.png
      Emily Blades
      read more
      Blog
      340x340-Blog-8-Reasons_ICS-2022[46].jpg
      Industrial Control Systems Security
      May 5, 2022
      8 Reasons You Don’t Want to Miss SANS ICS Security Summit & Training 2022
      ICS Security Summit & Training kicks off June 1. Register today.
      SANS ICS
      read more
      • Register to Learn
      • Courses
      • Certifications
      • Degree Programs
      • Cyber Ranges
      • Job Tools
      • Security Policy Project
      • Posters & Cheat Sheets
      • White Papers
      • Focus Areas
      • Cyber Defense
      • Cloud Security
      • Cybersecurity Leadership
      • Digital Forensics
      • Industrial Control Systems
      • Offensive Operations
      Subscribe to SANS Newsletters
      Receive curated news, vulnerabilities, & security awareness tips
      United States
      Canada
      United Kingdom
      Spain
      Belgium
      Denmark
      Norway
      Netherlands
      Australia
      India
      Japan
      Singapore
      Afghanistan
      Aland Islands
      Albania
      Algeria
      American Samoa
      Andorra
      Angola
      Anguilla
      Antarctica
      Antigua and Barbuda
      Argentina
      Armenia
      Aruba
      Austria
      Azerbaijan
      Bahamas
      Bahrain
      Bangladesh
      Barbados
      Belarus
      Belize
      Benin
      Bermuda
      Bhutan
      Bolivia
      Bonaire, Sint Eustatius, and Saba
      Bosnia And Herzegovina
      Botswana
      Bouvet Island
      Brazil
      British Indian Ocean Territory
      Brunei Darussalam
      Bulgaria
      Burkina Faso
      Burundi
      Cambodia
      Cameroon
      Cape Verde
      Cayman Islands
      Central African Republic
      Chad
      Chile
      China
      Christmas Island
      Cocos (Keeling) Islands
      Colombia
      Comoros
      Cook Islands
      Costa Rica
      Croatia (Local Name: Hrvatska)
      Curacao
      Cyprus
      Czech Republic
      Democratic Republic of the Congo
      Djibouti
      Dominica
      Dominican Republic
      East Timor
      East Timor
      Ecuador
      Egypt
      El Salvador
      Equatorial Guinea
      Eritrea
      Estonia
      Ethiopia
      Falkland Islands (Malvinas)
      Faroe Islands
      Fiji
      Finland
      France
      French Guiana
      French Polynesia
      French Southern Territories
      Gabon
      Gambia
      Georgia
      Germany
      Ghana
      Gibraltar
      Greece
      Greenland
      Grenada
      Guadeloupe
      Guam
      Guatemala
      Guernsey
      Guinea
      Guinea-Bissau
      Guyana
      Haiti
      Heard And McDonald Islands
      Honduras
      Hong Kong
      Hungary
      Iceland
      Indonesia
      Iraq
      Ireland
      Isle of Man
      Israel
      Italy
      Jamaica
      Jersey
      Jordan
      Kazakhstan
      Kenya
      Kiribati
      Korea, Republic Of
      Kosovo
      Kuwait
      Kyrgyzstan
      Lao People's Democratic Republic
      Latvia
      Lebanon
      Lesotho
      Liberia
      Liechtenstein
      Lithuania
      Luxembourg
      Macau
      Macedonia
      Madagascar
      Malawi
      Malaysia
      Maldives
      Mali
      Malta
      Marshall Islands
      Martinique
      Mauritania
      Mauritius
      Mayotte
      Mexico
      Micronesia, Federated States Of
      Moldova, Republic Of
      Monaco
      Mongolia
      Montenegro
      Montserrat
      Morocco
      Mozambique
      Myanmar
      Namibia
      Nauru
      Nepal
      Netherlands Antilles
      New Caledonia
      New Zealand
      Nicaragua
      Niger
      Nigeria
      Niue
      Norfolk Island
      Northern Mariana Islands
      Oman
      Pakistan
      Palau
      Palestine
      Panama
      Papua New Guinea
      Paraguay
      Peru
      Philippines
      Pitcairn
      Poland
      Portugal
      Puerto Rico
      Qatar
      Reunion
      Romania
      Russian Federation
      Rwanda
      Saint Bartholemy
      Saint Kitts And Nevis
      Saint Lucia
      Saint Martin
      Saint Vincent And The Grenadines
      Samoa
      San Marino
      Sao Tome And Principe
      Saudi Arabia
      Senegal
      Serbia
      Seychelles
      Sierra Leone
      Sint Maarten
      Slovakia
      Slovenia
      Solomon Islands
      South Africa
      South Georgia and the South Sandwich Islands
      South Sudan
      Sri Lanka
      St. Helena
      St. Pierre And Miquelon
      Suriname
      Svalbard And Jan Mayen Islands
      Swaziland
      Sweden
      Switzerland
      Taiwan
      Tajikistan
      Tanzania
      Thailand
      Togo
      Tokelau
      Tonga
      Trinidad And Tobago
      Tunisia
      Turkey
      Turkmenistan
      Turks And Caicos Islands
      Tuvalu
      Uganda
      Ukraine
      United Arab Emirates
      United States Minor Outlying Islands
      Uruguay
      Uzbekistan
      Vanuatu
      Vatican City
      Venezuela
      Vietnam
      Virgin Islands (British)
      Virgin Islands (U.S.)
      Wallis And Futuna Islands
      Western Sahara
      Yemen
      Yugoslavia
      Zambia
      Zimbabwe

      By providing this information, you agree to the processing of your personal data by SANS as described in our Privacy Policy.

      This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
      • © 2023 SANS™ Institute
      • Privacy Policy
      • Contact
      • Careers
      • Twitter
      • Facebook
      • Youtube
      • LinkedIn