ICS410: ICS/SCADA Security Essentials

Global Industrial Cyber Security Professional (GICSP)
Global Industrial Cyber Security Professional (GICSP)
  • In Person (6 days)
  • Online
36 CPEs

ICS410: ICS/SCADA Security Essentials provides a foundational set of standardized skills and knowledge for industrial cybersecurity professionals. The course is designed to ensure that the workforce involved in supporting and defending industrial control systems is trained to keep the operational environment safe, secure, and resilient against current and emerging cyber threats.

What You Will Learn

SANS has joined forces with industry leaders to equip security professionals and control system engineers with the cybersecurity skills they need to defend national critical infrastructure. ICS410: ICS/SCADA Security Essentials provides a foundational set of standardized skills and knowledge for industrial cybersecurity professionals. The course is designed to ensure that the workforce involved in supporting and defending industrial control systems is trained to keep the operational environment safe, secure, and resilient against current and emerging cyber threats.

The course will provide you with:

  • An understanding of industrial control system components, purposes, deployments, significant drivers, and constraints.
  • Hands-on lab learning experiences to control system attack surfaces, methods, and tools
  • Control system approaches to system and network defense architectures and techniques
  • Incident-response skills in a control system environment
  • Governance models and resources for industrial cybersecurity professionals.

When examining the greatest risks and needs in critical infrastructure sectors, the course authors looked carefully at the core security principles necessary for the range of tasks involved in supporting control systems on a daily basis. While other courses are available for higher-level security practitioners who need to develop specific skills such as industrial control system penetration testing, vulnerability analysis, malware analysis, forensics, secure coding, and red team training, most of these courses do not focus on the people who operate, manage, design, implement, monitor, and integrate critical infrastructure production control systems.

With the dynamic nature of industrial control systems, many engineers do not fully understand the features and risks of many devices. In addition, IT support personnel who provide the communications paths and network defenses do not always grasp the systems' operational drivers and constraints. This course is designed to help traditional IT personnel fully understand the design principles underlying control systems and how to support those systems in a manner that ensures availability and integrity. In parallel, the course addresses the need for control system engineers and operators to better understand the important role they play in cybersecurity. This starts by ensuring that a control system is designed and engineered with cybersecurity built into it, and that cybersecurity has the same level of focus as system reliability throughout the system lifecycle.

When these different groups of professionals complete this course, they will have developed an appreciation, understanding, and common language that will enable them to work together to secure their industrial control system environments. The course will help develop cyber-secure-aware engineering practices and real-time control system IT /OT support carried out by professionals who understand the physical effects of actions in the cyber world.

You Will Be Able To

  • Better understand various industrial control systems and their purpose, application, function, and dependencies on network IP and industrial communications
  • Work with control network infrastructure design (network architecture concepts, including topology, protocols, and components) and their relation to IEC 62443 and the Purdue Model.
  • Run Windows command line tools to analyze the system looking for high-risk items
  • Run Linux command line tools (ps, ls, netstat, ect) and basic scripting to automate the running of programs to perform continuous monitoring of various tools
  • Work with operating systems (system administration concepts for Unix/Linux and/or Windows operating systems)
  • Better understand the systems' security lifecycle
  • Better understand information assurance principles and tenets (confidentiality, integrity, availability, authentication, non-repudiation)
  • Use your skills in computer network defense (detecting host and network-based intrusions via intrusion detection technologies)
  • Implement incident response and handling methodologies
  • Map different ICS technologies, attacks, and defenses to various cybersecurity standards including NIST Cyber Security Framework, ISA/IEC 62443, ISO/IEC 27001, NIST SP 800-53, Center for Internet Security Critical Security Controls, and COBIT 5

Hands-On Training

  • Programming a PLC
  • Programming an HMI
  • Architecting a Secure DCS
  • Finding Passwords in Embedded Devices
  • Exploring Fieldbus Protocols
  • Network Capture Analysis
  • Enumerating Modbus TCP
  • Network Forensics of an Attack
  • Bypassing Auth with SQL Injection
  • Password Fuzzing
  • Baselining with PowerShell
  • Configuring Host-Based Firewalls
  • Windows Event Logs
  • Finding Remote Access
  • Incident Response Tabletop Exercise

What You Will Receive

  • Electronic Download Package contining ICS cybersecurity related posters, whitepapers, use cases, and cheat sheets
  • A virtual machine of the Control Things Platform, an opensourced, linux-based distribution designed for performing security assessments on ICS systems
  • A virtual machine of Windows 10 for course exercises
  • MP3 audio files of the complete course lecture
  • A hardware PLC for students to use in class and take home with them

Syllabus (36 CPEs)

Download PDF
  • Overview

    Takeaway: Students will develop and reinforce a common language and understanding of Industrial Control System (ICS) cybersecurity as well as the important considerations that come with cyber-to-physical operations within these environments. Each student will receive a programmable logic controller (PLC) device to keep. The PLC contains physical inputs and outputs that will be programmed in class and mapped to an operator interface, or HMI, also created in class. This improved hardware-enabled approach provides the necessary cyber-to-physical knowledge that allows students to better understand important ICS operational drivers and constraints that require specific safety protection, communications needs, system management approaches, and cybersecurity implementations. Essential terms, architectures, methodologies, and devices are all covered to build a common language for students from a variety of different roles.


    Day 1 ICS Overview

    • Global Industrial Cybersecurity Professional (GICSP) Overview
    • Overview of ICS
      • Processes & Roles
      • Industries
      • Exercise: Learning from Peers
    • Purdue Levels 0 and 1
      • Controllers and Field Devices
      • Programming Controllers
      • Exercise: Programming a PLC
    • Purdue Levels 2 and 3
      • HMIs, Historians, Alarm Servers
      • Specialized Applications and Master Servers
      • Control Rooms and Plants
      • SCADA
      • Exercise: Programming an HMI
    • IT & ICS Differences

      • ICS Life Cycle Challenges
    • Physical and Cyber Security
  • Overview

    Takeaway: If you know the adversary's approaches to attacking an ICS environment, you will be better prepared to defend that environment. Numerous attack vectors exist within an ICS environment. Some are similar to traditional IT systems, while others are more specific to ICS. During Day 2, students will develop a better understanding of where these specific attack vectors exist and more defensible architectures for OT/ICS. Students will look at different technologies and communications used in Perdue Levels 0 and 1, the levels that are the most different from an IT network. Students will capture fieldbus traffic from the PLCs they programmed in day 1 and look at what other fieldbus protocols used in the industry.


    Day 2: Field Devices and Controllers

    • ICS Attack Surface
      • Threat Actors and Reasons for Attack
      • Attack Surface and Inputs
      • Vulnerabilities
      • Threat/Attack Models
      • Information Leakage
      • Exercise: Identifying External Attack Surfaces
    • Secure ICS Network Architectures
      • ICS410 Reference Model
      • Larger ICS Sites
      • Remote Access
      • Regional SCADA
      • Exercise: Architecting a Secure ICS Site
    • Purdue Level 0 and 1
      • Purdue Level 0 and 1 Attacks
      • Control Things Platform
      • Exercise: Passwords in EEPROM Dumps
      • Purdue Level 0 and 1 Technologies
      • Fieldbus Protocol Families
      • Exercise: Exploring Fieldbus Protocols
      • Purdue Level 0 and 1 Defenses
      • Safety Instrumented Systems (SIS)
  • Overview

    Takeaway: Day 3 will take students through the communication protocols often found throughout control networks. Students will analyze network captures containing other control protocols that traverse Ethernet-only networks and TCP/IP networks, set up a simulated controller, and interact with it through a control protocol. Students will learn about different methods to segment and control the flow of traffic through the control network. Students will explore cryptographic concepts and how they can be applied to communications protocols and on devices that store sensitive data. Students will learn about the risks of using wireless communications in control networks, which wireless technologies are commonly used, and available defenses for each.


    Day 3: Supervisory Systems

    • Ethernet and TCP/IP
      • Ethernet Concepts
      • TCP/IP Concepts
      • Exercise: Network Capture Analysis
      • ICS Protocols over TCP/IP
      • Wireshark and ICS Protocols
      • Attacks on Networks
      • Exercise: Enumerating Modbus TCP
    • Enforcement Zone Devices
      • Firewalls and NextGen Firewalls
      • Modern Data Diodes
      • NIDS/NIPS and Netflow
      • USB Scanning and Honeypots
    • Understanding Basic Cryptography
      • Crypto Keys
      • Encryption, Hashing, and Signatures
      • Exercise: Manual Cryptography
    • Wireless Technologies
      • Satellite and Cellular
      • Mesh Networks and Microwave
      • Bluetooth and Wi-Fi
    • Wireless Attacks and Defenses

      • 3 Eternal Risks of Wireless
      • Sniffing, DoS, Masquerading, Rogue AP
  • Overview

    Takeaway: Students will learn essential ICS-related server and workstation operating system capabilities, implementation approaches, and system management practices. After a hand-on network forensics exercise where students follow an attacker from phishing campaign to HMI breach, students will look at HMI, historian, and user interface technologies used in the middle to upper levels of the control network, namely Perdue Levels 2 and 3, while performing attacks on HMI web technologies and interfaces susceptible to password brute force attacks. In the afternoon, Students will learn about how to create baselines and secure Windows-based workstation and servers.


    Day 4: Workstations and Servers

    • Supervisory Servers
      • Supervisory Attacks
      • Historians and Databases
      • Exercise: Bypassing Auth with SQL Injection
    • User Interfaces
      • HMI and UI Attacks
      • Web-based Attacks
      • Password Defenses
      • Exercise: Password Fuzzing
    • Defending Microsoft Windows
      • Windows Services
      • Windows Security Policies and GPOs
      • Host Firewalls
      • Exercise: Baselining with PowerShell
    • Patching ICS Systems
      • Patch Decision Tree
      • Vendors, CERTS, and Security Bulletins
  • Overview

    Takeaway: Day 5 will further explore baselines and hardening, but his time on Linux-based workstations and servers. Students will examine concepts that benefit ICS systems such as system hardening, log management, monitoring, alerting, and audit approaches, then look at some of the more common applications and databases used in ICS environments across multiple industries. Finally, students will learn about the various models, methodologies, and industry-specific regulations that are used to govern what must be done to protect critical ICS systems. Key business processes that consider risk assessments, disaster recovery, business impact analysis, and contingency planning will be examined from the perspective of ICS environments.


    Day 5: ICS Security Governance

    • Defending Unix and Linux
      • Differences with Windows
      • Daemons, SystemV, and SystemD
      • Lynis and Bastille
      • Exercise: Hardening Linux
    • Endpoint Protection and SIEMS
      • Application Runtime and Execution Control
      • Configuration Integrity and Containers
      • Logs in Windows and Linux
      • Exercise: Windows Event Logs
    • Building an ICS Cyber Security Program
      • Starting the Process
      • Frameworks: ISA/IEC 62443, ISO/IEC 27001, NIST CSF
      • Using the NIST CSF
    • Creating ICS Cyber Security Policy
      • Policies, Standards, Guidance, and Procedures
      • Culture and Enforcement
      • Examples and Sources
      • Exercise: ICS Security Policy Review
    • Measuring Cyber Security Risk
      • Risk Approaches and Calculations
      • DR and BC Planning
    • Incident Response
      • Six Step Process
      • Table Top Exercises
    • Final Thoughts and Next Steps
  • Overview

    Takeaway: Students will work through a group-based, table-top exercise (TTX) that includes hands-on components. Students must use the knowledge they gained throughout the week to identify indicators of compromise (IoCs), determine actions that should be taken to limit the attacker's ability to compromise additional assets, and react to changes in the attacker's tactics, techniques, and procedures (TTPs) as they progress deeper into the OT/OCS network. Students will leave with a variety of resources for multiple industries and will be well prepared to pursue the GICSP, an important ICS-focused professional certification

Global Industrial Cyber Security Professional

The GICSP bridges together IT, engineering and cyber security to achieve security for industrial control systems from design through retirement. This unique vendor-neutral, practitioner focused industrial control system certification is a collaborative effort between GIAC and representatives from a global industry consortium involving organizations that design, deploy, operate and/or maintain industrial automation and control system infrastructure. GICSP will assess a base level of knowledge and understanding across a diverse set of professionals who engineer or support control systems and share responsibility for the security of these environments.

  • Industrial control system components, purposes, deployments, significant drivers, and constraints
  • Control system attack surfaces, methods, and tools
  • Control system approaches to system and network defense architectures and techniques
  • Incident-response skills in a control system environment
  • Governance models and resources for industrial cybersecurity professionals
More Certification Details


Course participants need to have a basic understanding of networking and system administration, TCP/IP, networking design/architecture, vulnerability assessment, and risk methodologies. ICS410 covers many of the core areas of security and assumes a basic understanding of technology, networks, and security. For those who are brand new to the field and have no background knowledge, SEC301: Intro to Information Security would be the recommended starting point. While SEC301 is not a prerequisite, it provides introductory knowledge that will help maximize a student's experience with ICS410.

Laptop Requirements

Important! Bring your own system configured according to these instructions!

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

The ICS410 Industrial Control System Security Essentials course consists of instruction and hands-on exercises. The exercises are designed to allow students to put knowledge gained throughout the course into practice in an instructor-led environment. Students will have the opportunity to install, configure, and use the tools and techniques that they have learned.

NOTE: Do not bring a regular production laptop for this class! When installing software, there is always a chance of breaking something else on the system. Students should assume that all data could be lost.

NOTE: It is critical that students have administrator access to the operating system and the ability to disable all security software installed. Changes may need to be made to personal firewalls and other host-based software in order for the labs to work.

Laptop requirements include the following:

  • 64-bit processor with 64-bit operating system
  • VT or other 64-bit virtualization settings enabled in your BIOS to run 64-bit VMs
  • At least eight (8) GB of RAM
  • At least seventy (70) GB of free hard drive space
  • At least one USB port
  • VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+
  • Access to an account with administrative permissions and the ability to disable all security software on their laptop such as Antivirus and/or firewalls if needed for the class

Note: Apple systems using the M1 processor cannot perform the necessary virtualization at this time and cannot be used for this course.

Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

Author Statement

"This course provides students with the essentials for conducting cybersecurity work in industrial control system environments. After spending years working with industry, we believe there is a gap in the skill sets of industrial control system personnel, whether it be cybersecurity skills for engineers or engineering principles for cybersecurity experts. In addition, both information technology and operational technology roles have converged in today's industrial control system environments, so there is a greater need than ever for a common understanding between the various groups who support or rely on these systems. Students in ICS410 will learn the language, the underlying theory, and the basic tools for industrial control system security in settings across a wide range of industry sectors and applications." - Justin Searle

"Conceptualizing safety within ICS/SCADA is easier to understand with the numerous examples Justin provides. His ability to visually show where the gotchas will appear gave me techniques to repair our SCADA network." - Attilio Pramarini, RTD

Register for ICS410