Build crucial cyber security skills through interactive training during SANS Cyber Security Mountain 2021. Save $150 thru 6/30.


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

Responding to Incidents in Industrial Control Systems (ICS): Identifying Threats, Reactions and Developing the IR Process

  • Friday, May 29, 2020 at 1:00 PM EDT (2020-05-29 17:00:00 UTC)
  • Don C. Weber, Eric Knapp, Matt Wiseman


  • Honeywell International

You can now attend the webcast using your mobile device!



Threats, attacks and incidents are not decreasing, and in fact, industrial control systems (ICS) have become increasingly vulnerable. Recent SANS research shows that more incidents are being detected in OT environments, allowing attackers to slip in and do damage.

How can effective and proven incident response processes identify, mitigate and remediate threats in the ICS environment? In this new webcast with SANS instructor Don C. Weber and representatives Eric Knapp and Matt Wiseman from Honeywell, we will identify ICS threats, look at how incidents can be managed, and provide recommendation for setting up an effective IR program to reduce risk exposure. Attendees will learn how to best apply proven IR programs and techniques.

Be among the first to receive the associated whitepaper written by Don C. Weber.

Speaker Bios

Don C. Weber

Don C. Weber, a SANS ICS instructor and founding member of the GIAC Ethics Council, has devoted himself to information security since 2002. He has extensive experience in security management, physical and information technology penetration testing, web assessments, wireless assessments, architecture review, incident response and digital forensics, product research, code review and security tool development. He is currently focusing on assisting organizations secure their business and ICS environments through program reviews, security assessments, penetration testing and training.

Eric Knapp

Eric D. Knapp (@ericdknapp) is a Sr. Fellow at Honeywell Connected Enterprise, where he drives advancements in industrial cybersecurity as the leader of the Global Research, Analysis, and Defense team. Eric is a recognized expert in industrial control systems cybersecurity. He is the author of “Industrial Network Security: Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems,” and the co-author of “Applied Cyber Security for Smart Grids.” Eric has over 20 years of experience in OT cybersecurity, and holds multiple patents in the areas of risk management, asset protection, and secure data transfer.  Eric’s research and development efforts are the result of his never-ending quest to improve the field of industrial cybersecurity.

Matt Wiseman

Matt Wiseman is the Global Leader of SMX (Secure Media Exchange) Product Marketing at Honeywell. During his three years at the company, Matt has been a part of the Honeywell Process Solutions New Product Introduction team and the Honeywell Industrial Cybersecurity organization. Matt has earned a variety of cyber-related certifications from the Department of Homeland Security, a GISF, and is a member of the GIAC Advisory Board.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.