ICS418: ICS Security Essentials for Leaders

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

Mandatory System Hardware Requirements

• At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
• Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

Mandatory Host Configuration And Software Requirements

• Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
• Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
• Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

If you have additional questions about the laptop specifications, please contact customer service.

ICS418 training is aimed at leaders of staff who are responsible for securing the day-to-day running of operational technology and industrial control system environments across an organization - this includes distributed control systems (DCS) and supervisory control and data acquisition (SCADA) systems. Leaders of these teams often come from a diverse background with either a focus on leadership skills and minimal understanding of ICS environments, or technical individuals who rise in the ranks to a leader with minimal leadership skill development.

The course was designed to bridge the gap between those two skill sets, "raising the water level for all ships" when it comes to ICS security leaders, including:

• Leaders asked to "Step-Over"
• Traditional information technology (IT) security manager that must create, lead, or refine an ICS Security program
• Practitioner to Leader: "Step-Up"
• Industrial engineer, operator, or ICS security practitioner promoted to a manager position to create, lead, or refine an ICS security program
• Leader Development: "In-Place"
• An existing ICS security manager that is looking to further develop their leadership skills, specific to industrial security

• Access to Cyber42: Industrial Edition for leadership-based skills development with applicable business-oriented decision making
• Editable leadership drills designed for students to build new strategy and program elements and continuing their development long after the course ends

Students with backgrounds in IT, ICS, and/or management will do well with this course.

Students should also have:

• A strong desire to lead people and manage processes to improve ICS security
• Willingness to apply lab exercises and content to their unique industrial organization
• The ability to stretch outside of their comfort zone

With your purchase of this ICS Security course, you’ll receive complimentary OnDemand access to ICS310: ICS Cybersecurity Foundations — an added benefit, not a prerequisite or requirement. This course is a great way to reinforce key concepts or fill gaps in your ICS/OT security knowledge, whether you complete it in full or focus on what’s most relevant to you. Within 14 business days, you’ll receive a non-transferable access code via your SANS account email.

The ICS418 course is part of the Industrial Control Systems Security focus area, which covers necessary skills for defending industrial systems, including critical infrastructure. This course is considered appropriate training for ICS security managers and can be paired with other courses like ICS456: Essentials for NERC Critical Infrastructure Protection.

ICS Security Leadership Essentials are the core skills and strategies for managing and securing Industrial Control Systems. They focus on understanding ICS operations, mitigating risks, aligning teams through effective communication, applying cybersecurity frameworks, and leading incident response efforts to ensure resilience and safety.

ICS security leadership is vital for protecting industrial environments, addressing unique operational challenges, and bridging IT and OT security. Strong leadership enables effective risk mitigation, aligns stakeholders, and ensures compliance with regulatory standards, safeguarding essential services against evolving cyber threats.

• Enhanced Leadership Skills: Gain the expertise to lead ICS cybersecurity efforts, making you a valuable asset in safeguarding critical infrastructure.
• Career Advancement: Demonstrating specialized knowledge in ICS security can open doors to leadership roles in cybersecurity and operational technology (OT) leadership.
• Industry Recognition: Completing a SANS course like ICS418 highlights your commitment to professional growth and positions you as a trusted expert in the field.
• Practical Application: The actionable skills and strategies you learn can be applied immediately, improving your organization's security posture and showcasing your impact.
• Stronger Network: Connect with peers, experts, and leaders in the ICS cybersecurity community, expanding your professional network and opportunities.