ICS410: ICS/SCADA Security Essentials

Develop a common understanding of ICS cybersecurity with emphasis on cyber-to-physical operations. Students receive programmable logic controller (PLC) devices to keep, allowing practical exploration of the cyber-physical interface. This section covers essential terminology, architectures, methodologies, and devices used across different industrial sectors.

Learn defensive approaches by understanding adversarial tactics against ICS environments. Examine attack vectors specific to industrial systems, particularly at Purdue Levels 0 and 1. Investigate technologies and communications that distinguish control systems from IT networks, with hands-on experience capturing fieldbus traffic from PLCs.

Analyze network communication protocols and examine network captures of control protocols traversing Ethernet and TCP/IP networks. Learn segmentation methods and traffic flow control for industrial networks. Explore cryptographic concepts for protecting communications and sensitive data, plus wireless technologies used in control systems.

Explore essential server and workstation operating systems for ICS environments. Perform network forensics to track attackers from phishing to HMI breach. Examine technologies at Purdue Levels 2 and 3, including HMI and historian systems. Learn to create baselines and secure Windows-based workstations and servers in industrial environments.

Explore system hardening for Linux-based industrial systems, examining log management and audit approaches. Learn about common applications used across multiple industrial sectors. Study governance models and industry-specific regulations for critical infrastructure protection, focusing on risk assessment, disaster recovery, and contingency planning.

Apply knowledge gained throughout the course in a capture-the-flag exercise based on incident response. Identify indicators of compromise, determine appropriate containment actions, and adapt to changing adversary tactics as they progress through an ICS/OT network. Leave with industry-specific resources and be well prepared to pursue the GICSP.