Provided by SANS
Specialism
Certification
GICSP Certification
Qualification level
GICSP Certification
Location
Live/Online
Study type
Distance learning
Duration
View Website
Price
View Website

About the course

SANS has joined forces with industry leaders to equip security professionals and control system engineers with the cybersecurity skills they need to defend national critical infrastructure. ICS410: ICS/SCADA Security Essentials provides a foundational set of standardized skills and knowledge for industrial cybersecurity professionals. The course is designed to ensure that the workforce involved in supporting and defending industrial control systems is trained to keep the operational environment safe, secure, and resilient against current and emerging cyber threats.

 

 

Course Syllabus

ICS410.1: ICS Overview

Overview

Takeaway: Students will develop and reinforce a common language and understanding of Industrial Control System (ICS) cybersecurity as well as the important considerations that come with cyber-to-physical operations within these environments. Each student will receive a programmable logic controller (PLC) device to keep. The PLC contains physical inputs and outputs that will be programmed in class and mapped to an operator interface, or HMI, also created in class. This improved hardware-enabled approach provides the necessary cyber-to-physical knowledge that allows students to better understand important ICS operational drivers and constraints that require specific safety protection, communications needs, system management approaches, and cybersecurity implementations. Essential terms, architectures, methodologies, and devices are all covered to build a common language for students from a variety of different roles.

 

 

CPE/CMU Credits: 6

Topics

Day 1 ICS Overview

  • Global Industrial Cybersecurity Professional (GICSP) Overview
  • Overview of ICS
    • Processes & Roles
    • Industries
  • Purdue Levels 0 and 1
    • Controllers and Field Devices
    • Programming Controllers
    • Exercise: Programming a PLC
  • Purdue Levels 2 and 3
    • HMIs, Historians, Alarm Servers
    • Specialized Applications and Master Servers
  • DCS and SCADA
    • Differences in Location and Latency
    • Exercise: Programming an HMI
  • IT & ICS Differences
    • ICS Life Cycle Challenges
  • Physical and Cyber Security
  • Secure ICS Network Architectures
    • ICS410 Reference Model
    • Design Example
    • Exercise: Architecting a Secure DCS

 

ICS410.2: Field Devices & Controllers

Overview

Takeaway: If you know the adversary's approaches to attacking an ICS environment, you will be better prepared to defend that environment. Numerous attack vectors exist within an ICS environment. Some are similar to traditional IT systems, while others are more specific to ICS. During Day 2, students will develop a better understanding of where these specific attack vectors exist and how to block them, starting at the lowest levels of the control network. Students will look at different technologies and communications used in Perdue Levels 0 and 1, the levels that are the most different from an IT network. Students will capture fieldbus traffic from the PLCs they programmed in day 1 and look at what other fieldbus protocols used in the industry. Later in the day, students will analyze network captures containing other control protocols that traverse Ethernet-only networks and TCP/IP networks, set up a simulated controller, and interact with it through a control protocol.

 

CPE/CMU Credits: 6

Topics

Day 2: Field Devices and Controllers

  • ICS Attack Surface
    • Threat Actors and Reasons for Attack
    • Attack Surface and Inputs
    • Vulnerabilities
    • Threat/Attack Models
  • Purdue Level 0 and 1
    • Purdue Level 0 and 1 Attacks
    • Control Things Platform
    • Exercise: Finding Passwords in EEPROM Dumps
    • Purdue Level 0 and 1 Technologies
    • Purdue Level 0 and 1 Communications
    • Fieldbus Protocol Families
    • Exercise: Exploring Fieldbus Protocols
    • Purdue Level 0 and 1 Defenses
  • Ethernet and TCP/IP
    • Ethernet Concepts
    • TCP/IP Concepts
    • Exercise: Network Capture Analysis
    • ICS Protocols over TCP/IP
    • Wireshark and ICS Protocols
    • Attacks on Networks
    • Exercise: Enumerating Modbus TCP

 

ICS410.3: Supervisory Systems

Overview

Takeaway: Day 3 will take students through the middle layers of control networks. Students will learn about different methods to segment and control the flow of traffic through the control network. Students will explore cryptographic concepts and how they can be applied to communications protocols and on devices that store sensitive data. Students will learn about the risks of using wireless communications in control networks, which wireless technologies are commonly used, and available defenses for each. After a hand-on network forensics exercise where students follow an attacker from phishing campaign to HMI breach, students will look at HMI, historian, and user interface technologies used in the middle to upper levels of the control network, namely Perdue Levels 2 and 3, while performing attacks on HMI web technologies and interfaces susceptible to password brute force attacks.

 

CPE/CMU Credits: 6

Topics

Day 3: Supervisory Systems

  • Enforcement Zone Devices
    • Firewalls and NextGen Firewalls
    • Data Diodes and Unidirectional Gateways
  • Understanding Basic Cryptography
    • Crypto Keys
    • Symmetric and Asymmetric Encryption
    • Hashing and HMACs
    • Digital Signatures
  • Wireless Technologies
    • Satellite and Cellular
    • Mesh Networks and Microwave
    • Bluetooth and Wi-Fi
  • Wireless Attacks and Defenses
    • 3 Eternal Risks of Wireless
    • Sniffing, DoS, Masquerading, Rogue AP
  • Exercise: Network Forensics of an Attack
  • Purdue Level 2 and 3 Attacks
    • Historians and Databases
    • Exercise: Bypassing Auth with SQL Injection
    • HMI and UI Attacks
    • Web-based Attacks
    • Password Defenses
    • Exercise: Password Fuzzing

 

ICS410.4: Workstations and Servers

Overview

Takeaway: Students will learn essential ICS-related server and workstation operating system capabilities, implementation approaches, and system management practices. Students will receive and work with both Windows- and Linux-based virtual machines in order to understand how to monitor and harden these hosts from attack. Students will examine concepts that benefit ICS systems such as system hardening, log management, monitoring, alerting, and audit approaches, then look at some of the more common applications and databases used in ICS environments across multiple industries. Finally, students will explore attacks and defenses on remote access for control systems.

 

 

CPE/CMU Credits: 6

Topics

Day 4: Workstations and Servers

    • Patching ICS Systems
      • Patch Decision Tree
      • Vendors, CERTS, and Security Bulletins
    • Defending Microsoft Windows
      • Windows Services
      • Windows Security Policies and GPOs
      • Exercise: Baselining with PowerShell
    • Defending Unix and Linux
      • Differences with Windows
      • Daemons, SystemV, and SystemD
      • Lynis and Bastille
    • Endpoint Security Software
      • Antivirus and Whitelisting
      • Application Sandboxing and Containers
      • Exercise: Configuring Host-Based Firewalls
    • Event Logging and Analysis
      • Windows Event Logs and Audit Policies
      • Syslog and Logrotate
      • Exercise: Windows Event Logs
    • Remote Access Attacks
      • Attacks on Remote Access
      • Honeypots
      • Exercise: Finding Remote Access

 

ICS410.5: ICS Security Governance

Overview

Takeaway: Students will learn about the various models, methodologies, and industry-specific regulations that are used to govern what must be done to protect critical ICS systems. Key business processes that consider risk assessments, disaster recovery, business impact analysis, and contingency planning will be examined from the perspective of ICS environments. On this final course day, students will work together on an incident response exercise that places them squarely in an ICS environment that is under attack. This exercise ties together key aspects of what has been learned throughout the course and presents students with a scenario to review with their peers. Specific incident-response roles and responsibilities are considered, and actions available to defenders throughout the incident response cycle are explored. Students will leave with a variety of resources for multiple industries and will be well prepared to pursue the GICSP, an important ICS-focused professional certification.

CPE/CMU Credits: 6

Topics

Day 5: ICS Security Governance

  • Building an ICS Cyber Security Program
    • Starting the Process
    • Frameworks: ISA/IEC 62443, ISO/IEC 27001, NIST CSF
    • Using the NIST CSF
  • Creating ICS Cyber Security Policy
    • Policies, Standards, Guidance, and Procedures
    • Culture and Enforcement
    • Examples and Sources
  • Disaster Recovery
    • DR and BCP Programs
    • Modification for Cyber Security Incidents
  • Measuring Cyber Security Risk
    • Quantitative vs Qualitative
    • Traditional Models
    • Minimizing Subjectivity
  • Incident Response
    • Six Step Process
  • Exercise: Incident Response Tabletop Exercise
  • Final Thoughts and Next Steps
    • Other ICS Courses by SANS
    • Other SANS Curriculums and Courses
    • Netwars

 

Who Should Attend

The course is designed for the range of individuals who work in, interact with, or can affect industrial control system environments, including asset owners, vendors, integrators, and other third parties. These personnel primarily come from four domains:

  • IT (includes operational technology support)
  • IT security (includes operational technology security)
  • Engineering
  • Corporate, industry, and professional standards

 

Prerequisites

Course participants need to have a basic understanding of networking and system administration, TCP/IP, networking design/architecture, vulnerability assessment, and risk methodologies. ICS410 covers many of the core areas of security and assumes a basic understanding of technology, networks, and security. For those who are brand new to the field and have no background knowledge, SEC301: Intro to Information Security would be the recommended starting point. While SEC301 is not a prerequisite, it provides introductory knowledge that will help maximize a student's experience with ICS410.

 

What You Will Receive

  • A USB drive with ICS cybersecurity related posters, whitepapers, use cases, and cheat sheets
  • A virtual machine of the Control Things Platform, an opensourced, linux-based distribution designed for performing security assessments on ICS systems
  • A virtual machine of Windows 10 for course exercises
  • MP3 audio files of the complete course lecture
  • A hardware PLC for students to use in class and take home with them

 

You Will Be Able To

  • Better understand various industrial control systems and their purpose, application, function, and dependencies on network IP and industrial communications
  • Work with control network infrastructure design (network architecture concepts, including topology, protocols, and components) and their relation to IEC 62443 and the Purdue Model.
  • Run Windows command line tools to analyze the system looking for high-risk items
  • Run Linux command line tools (ps, ls, netstat, ect) and basic scripting to automate the running of programs to perform continuous monitoring of various tools
  • Work with operating systems (system administration concepts for Unix/Linux and/or Windows operating systems)
  • Better understand the systems' security lifecycle
  • Better understand information assurance principles and tenets (confidentiality, integrity, availability, authentication, non-repudiation)
  • Use your skills in computer network defense (detecting host and network-based intrusions via intrusion detection technologies)
  • Implement incident response and handling methodologies
  • Map different ICS technologies, attacks, and defenses to various cybersecurity standards including NIST Cyber Security Framework, ISA/IEC 62443, ISO/IEC 27001, NIST SP 800-53, Center for Internet Security Critical Security Controls, and COBIT 5

 

Hands-on Training

  • Programming a PLC
  • Programming an HMI
  • Architecting a Secure DCS
  • Finding Passwords in Embedded Devices
  • Exploring Fieldbus Protocols
  • Network Capture Analysis
  • Enumerating Modbus TCP
  • Network Forensics of an Attack
  • Bypassing Auth with SQL Injection
  • Password Fuzzing
  • Baselining with PowerShell
  • Configuring Host-Based Firewalls
  • Windows Event Logs
  • Finding Remote Access
  • Incident Response Tabletop Exercise

 

 

Contact the course provider: