Learn real-world skills from real-world cyber security practitioners. View upcoming Live Online Events.


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

SANS @MIC Talk - Incident Response in ICS in times of Lockdown

  • Wednesday, May 13, 2020 at 3:30 PM EDT (2020-05-13 19:30:00 UTC)
  • Kai Thomsen

You can now attend the webcast using your mobile device!



Standard ICS Incident Response assumes local forensic data acquisition in the ICS environment and a multi-team approach internal and external responders and subject matter experts. During the current pandemic, we have to find alternatives to this approach that might well lead to an overall more resilient IR in the long run.

Speaker Bio

Kai Thomsen

Kai has been working in various IT Security roles for more than 15 years. Currently he is the DFIR lead at the premium automaker AUDI AG. Kai also designs and runs Red Team exercises at Audi that integrate IT, business, and physical aspects.

Before Audi he worked for more than 12 years at the engineering company SMS Group where he designed and implemented defensible LANs as well as running DFIR in traditional IT and ICS environments.

Kai holds an MA in Computer Science and English and American Literature.

Need Help? Visit our FAQ page or email webcast-support@sans.org.

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.