Ending Soon! Get an iPad Air with Smart Keyboard, Surface Go, or $300 Off thru Dec 11 with OnDemand or vLive Training!


To attend this webcast, login to your SANS Account or create your Account.

An Inside Look at the Newly Updated ICS515 Course

  • Thursday, February 15th, 2018 at 10:30 AM EST (15:30:00 UTC)
  • Robert M. Lee
This webcast has been archived. You can view the webcast presentation and download the slides by logging into your SANS Portal Account or creating an Account. Click the Register Now button after you have logged in to view the Webcast.

You can now attend the webcast using your mobile device!


Industrial IoT (IIoT) - What are the biggest threats and how are you dealing with them? Take the SANS Industrial IoT Survey and enter to win a $400 Amazon gift card.

Monitoring for, investigating, and responding to industrial security threats requires a combination of numerous skill sets and an understanding of the impact these threats can have as well as real-world examples of what threats have done before. The SANS ICS515 - ICS Active Defense and Incident Response course is the only course in the world that combines threat intelligence, monitoring and investigations, and incident response procedures to give defenders the appropriate skills and knowledge needed to defend their organizations from targeted cyber threats. This class has run now for three years absorbing feedback and best practices throughout the community as well as new case-studies related to threats such as CRASHOVERRIDE and TRISIS. Now, the course is undergoing it's first major change which further solidifies the knowledge gained over the past years as well as an entirely new hands-on lab scenario that takes students through a multi-control system lab range with 24+ hands on labs throughout the five day course.

Prospective ICS515 students should attend this webcast to learn about what changes have been made to the course and what they can expect to take away from the course. It is a hands-on real-world use-cases focused class with practical and applicable guidance for taking any industrial environment and moving it from a defensible ICS to a defended one. Come learn about the class, the updates, and what to expect.

Speaker Bio

Robert M. Lee

Robert M. Lee, a SANS certified instructor and author of the "ICS Active Defense and Incident Response" and "Cyber Threat Intelligence" courses, is the founder and CEO of Dragos, a critical infrastructure cybersecurity company, where he focuses on control system traffic analysis, incident response and threat intelligence research. He has performed defense, intelligence and attack missions in various government organizations, including the establishment of a first-of-its-kind ICS/SCADA cyber threat intelligence and intrusion analysis mission. Author of SCADA and Me and a nonresident National Cyber Security Fellow at New America, focusing on critical infrastructure cybersecurity policy issues, Robert was named EnergySec's 2015 Energy Sector Security Professional of the Year.

Need Help? Visit our FAQ page or email webcast-support@sans.org.

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.