"Defense is hard, the attacker always wins." That is a statement that is heard too frequently throughout the security industry. In ICS it seems even worse; discussions of vulnerable networks and assets chip away at optimism quickly. The community must do better but there is an inherent defense in the uniqueness of ICS networks that is often underutilized. Active Defense is not about hacking back, quite the opposite, it is about valuing defense and taking an active approach to understanding the network, utilizing threat intelligence, identifying attackers, and triaging the threats - all to make ICS more reliable. This webinar will discuss the new SANS class 515: Active Defense and Response. Find out more about this class and its simple motto: "defense is doable" first-hand from course author Robert M. Lee.