Get the Skills you need from Home with SANS OnDemand


To attend this webcast, login to your SANS Account or create your Account.

ICS Active Defense Primer

  • Tuesday, April 17th, 2018 at 3:30 PM EDT (19:30:00 UTC)
  • Kai Thomsen
This webcast has been archived. You can view the webcast presentation and download the slides by logging into your SANS Portal Account or creating an Account. Click the Register Now button after you have logged in to view the Webcast.

You can now attend the webcast using your mobile device!


As targeted threats against ICS environments are becoming more prevalent, it has become more important than ever for organizations and companies responsible for critical infrastructure to increase their defensive posture. Kai Thomsen, DFIR lead at the premium automaker AUDI AG and ICS515 instructor, will introduce four different concepts that make up active defense in a 2-part webcast.

  • Threat Intelligence
  • Asset Identification and Network Security Monitoring
  • Incident Response
  • Threat and Environment Manipulation and how they can be applied in ICS environments.

Stay tuned for part 2, where Kai will focus on Threat Intelligence and Network Security Monitoring and how these are leveraged to get more effective in defending ICS environments.

Speaker Bio

Kai Thomsen

Kai has been working in various IT Security roles for more than 15 years. Currently he is the DFIR lead at the premium automaker AUDI AG. Kai also designs and runs Red Team exercises at Audi that integrate IT, business, and physical aspects.

Before Audi he worked for more than 12 years at the engineering company SMS Group where he designed and implemented defensible LANs as well as running DFIR in traditional IT and ICS environments.

Kai holds an MA in Computer Science and English and American Literature.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.