SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

What if you could develop custom PLC security tools in days instead of weeks-without writing most of the code yourself?
This talk demonstrates a practical methodology for rapidly building ICS reconnaissance tools using AI-assisted "vibe coding" combined with readily available vendor documentation. The approach treats PLC configuration exports and manufacturer help files as primary inputs, letting an LLM handle protocol implementation while the security professional provides domain expertise and hardware validation.
Being able to perform OT Cyber Security Risk Assessments is becoming more essential with each passing year. Drivers to perform a risk assessment vary, it might be a regulatory requirement, internal justification for investment or simply to better understand your operational risk. Finding skilled resources to be able to perform a risk assessment and running one in your busy operational environment can be extremely challenging.
This presentation will explore how to prepare, execute and report out an effective OT Cyber Security Risk Assessment following the IEC 62443-3-2 Methodology; best practices and examples will be provided from completed risk assessments.
Registration: All students who register for a 4–6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
About ICS NetWars: Focused on factory machinery operations, this experience brings players onto the factory floor, exposing them to the challenges of detecting and defending physical equipment and manufacturing components from cyberattacks.
Registration: All students who register for a 4–6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
About ICS NetWars: Focused on factory machinery operations, this experience brings players onto the factory floor, exposing them to the challenges of detecting and defending physical equipment and manufacturing components from cyberattacks.