One Week Left to Get an 11" iPad Pro with Apple Pencil w/ OnDemand Training


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

ICS515 update: what’s new in the course and why detection and response in ICS is more important than ever

  • Friday, February 28, 2020 at 10:30 AM EST (2020-02-28 15:30:00 UTC)
  • Kai Thomsen

You can now attend the webcast using your mobile device!



Over the last year we have seen a proliferation of targeting ICS environments as well as an increase of Ransomware and commodity malware disrupting ICS operations. With growing geopolitical tensions, the risk for ICS environments getting targeted in offensive cyber operations is increasing. As many tactics and techniques employed by adversaries leverage inherent capabilities in ICS environments that are necessary for operations, monitoring for threats in these environments and knowing how to respond is becoming more important. On the other hand, methodologies and techniques that can be applied for more effective defense have recently been developed, e.g. the Mitre ICS Attack Matrix.

In the webcast Kai will point out some key findings on ICS threats in 2019 and give an overview of the recent additions to the ICS515 course covering newly developed methods enabling defenders to become more effective in focusing their efforts on detecting and responding to adversaries in their ICS environments.

Speaker Bio

Kai Thomsen

Kai has been working in various IT Security roles for more than 15 years. Currently he is the DFIR lead at the premium automaker AUDI AG. Kai also designs and runs Red Team exercises at Audi that integrate IT, business, and physical aspects.

Before Audi he worked for more than 12 years at the engineering company SMS Group where he designed and implemented defensible LANs as well as running DFIR in traditional IT and ICS environments.

Kai holds an MA in Computer Science and English and American Literature.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.