Final Week to get a Free GIAC Cert Attempt or $350 Off with OnDemand and vLive Training!

ICS Security Training - Houston

Houston, TX | Mon, Jun 1 - Fri, Jun 5, 2015
This event is over,
but there are more training opportunities.

ICS410: ICS/SCADA Security Essentials

Mon, June 1 - Fri, June 5, 2015

I think I learned the most from the tools that I was exposed to, such as those tools available on the Samurai STFU VM. Having the tools and practicing them will help to keep the knowledge going and top of mind.

Michael Piccalo, Leidos

This is a great course that distinguishes the challenges and integration points for ICS and Traditional IT security posture. The instructors provide in-depth real world knowledge and experience to the material to make it actionable within the attendee's corporate environment.

Rob Oates, GDIT

SANS has joined forces with industry leaders to equip security professionals and control system engineers with the cybersecurity skills they need to defend national critical infrastructure. ICS410: ICS/SCADA Security Essentials provides a foundational set of standardized skills and knowledge for industrial cybersecurity professionals. The course is designed to ensure that the workforce involved in supporting and defending industrial control systems is trained to keep the operational environment safe, secure, and resilient against current and emerging cyber threats.


The course will provide you with:

  • An understanding of industrial control system components, purposes, deployments, significant drivers, and constraints.
  • Hands-on lab learning experiences to control system attack surfaces, methods, and tools
  • Control system approaches to system and network defense architectures and techniques
  • Incident-response skills in a control system environment
  • Governance models and resources for industrial cybersecurity professionals.

When examining the greatest risks and needs in critical infrastructure sectors, the course authors looked carefully at the core security principles necessary for the range of tasks involved in supporting control systems on a daily basis. While other courses are available for higher-level security practitioners who need to develop specific skills such as industrial control system penetration testing, vulnerability analysis, malware analysis, forensics, secure coding, and red team training, most of these courses do not focus on the people who operate, manage, design, implement, monitor, and integrate critical infrastructure production control systems.

With the dynamic nature of industrial control systems, many engineers do not fully understand the features and risks of many devices. In addition, IT support personnel who provide the communications paths and network defenses do not always grasp the systems' operational drivers and constraints. This course is designed to help traditional IT personnel fully understand the design principles underlying control systems and how to support those systems in a manner that ensures availability and integrity. In parallel, the course addresses the need for control system engineers and operators to better understand the important role they play in cybersecurity. This starts by ensuring that a control system is designed and engineered with cybersecurity built into it, and that cybersecurity has the same level of focus as system reliability throughout the system lifecycle.

When these different groups of professionals complete this course, they will have developed an appreciation, understanding, and common language that will enable them to work together to secure their industrial control system environments. The course will help develop cyber-secure-aware engineering practices and real-time control system IT /OT support carried out by professionals who understand the physical effects of actions in the cyber world.


Course Content Overlap Notice:

Please note that some course material for SEC401 may overlap with ICS410. We recommend ICS410 for those interested in security for an ICS/SCADA environment as it is approached from this viewpoint, and SEC401 for those primarily interested in a general information security course.

Course Syllabus

Justin Searle
Mon Jun 1st, 2015
9:00 AM - 5:00 PM

CPE/CMU Credits: 6

  • Overview of ICS
  • Field components
  • Network components
  • Communications
  • ICS Application Overview
  • Industry models
  • ICS drivers and constraints
  • Physical Security & Safety Systems

Justin Searle
Tue Jun 2nd, 2015
8:00 AM - 4:00 PM

CPE/CMU Credits: 6

  • Overview of ICS Attack Surface
  • Attacks on HMIs and User Interfaces
  • Attacks on Control Servers
  • Attacks on Network Communications
  • Attacks on Remote Devices

Justin Searle
Wed Jun 3rd, 2015
9:00 AM - 5:00 PM

CPE/CMU Credits: 6

  • ICS Server and Workstation Technologies
  • ICS Server Operating Systems
  • System and Security Updates
  • Enforcing Security Policy
  • Automation, Auditing, and Forensics
  • System Processes and Services
  • Logs and Log Management
  • ICS System Hardening
  • Databases and Historians

Justin Searle
Thu Jun 4th, 2015
9:00 AM - 5:00 PM

CPE/CMU Credits: 6

  • Network Fundamentals
  • OSI Layers 1 & 2 Ethernet
  • OSI Layers 3 - 4 IP, UDP, and TCP
  • TCP/IP Based ICS Protocols
  • Network Defenses
  • Wireless Network Security
  • Controller and Field Device Security
  • Cryptography Fundamentals

Justin Searle
Fri Jun 5th, 2015
9:00 AM - 5:00 PM