SANS ICS515 v2018

SANS ICS515 v2018

60.4 GB

ICS515: ICS Active Defense and Incident Response will help you deconstruct industrial control system (ICS) cyber attacks, leverage an active defense to identify and counter threats to your ICS, and use incident response procedures to maintain the safety and reliability of operations.

The course will empower students to understand their networked ICS environment, monitor it for threats, perform incident response against identified threats, and learn from interactions with the adversary to enhance network security. This process of monitoring, responding to, and learning from threats internal to the network is known as active defense, which is needed to counter advanced adversaries targeting ICS, as has been seen with malware such as STUXNET, HAVEX, CRASHOVERRIDE, and TRISIS. Students can expect to come out of this course with the ability to deconstruct targeted ICS attacks and fight these adversaries and others.

The course uses a hands-on approach and real-world malware to break down cyber attacks on ICS from start to finish. Students will gain a practical and technical understanding of leveraging active defense concepts such as using threat intelligence, performing network security monitoring, and utilizing threat analysis and incident response to ensure the safety and reliability of operations. The strategic and technical skills presented in this course serve as a basis for ICS organizations looking to show that defense is do-able.

You Will Learn:

How to perform ICS incident response focusing on security operations and prioritizing the safety and reliability of operations.
How ICS threat intelligence is generated and how to use what is available in the community to support ICS environments. The analysis skills you learn will enable you to critically analyze and apply information from ICS threat intelligence reports on a regular basis.
How to identify ICS assets and their network topologies and how to monitor ICS hotspots for abnormalities and threats. The course will introduce and reinforce methodologies such as ICS network security monitoring and approaches to reducing the control system threat landscape.
How to analyze ICS threats and extract the most important information needed to quickly scope the environment and understand the nature of the threat.
How to operate through an attack and gain the information necessary to instruct teams and decision-makers on whether operations must shut down or it is safe to respond to the threat and continue operations.
How to use multiple security disciplines in tandem to leverage an active defense and safeguard an ICS, all reinforced with hands-on labs and technical concepts.

You Will Be Able To

Analyze ICS-specific threats and take proper courses of action to defend the industrial control systems
Establish collection, detection, and response strategies for your ICS networks
Use proper procedures during ICS incident response

This Course Will Prepare You To

Examine ICS networks and identify the assets and their data flows in order to understand the network baseline information needed to identify advanced threats
Use active defense concepts such as threat intelligence consumption, network security monitoring, malware analysis, and incident response to safeguard the ICS
Build your own Programmable Logic Controller using a CYBATIworks Kit, which you can keep after the class ends
Gain hands-on experience with samples of Havex, BlackEnergy2, and Stuxnet by engaging in labs and de-constructing these threats and others
Leverage technical tools such as Shodan, Security Onion, TCPDump, Wireshark, Snort, Bro, SGUIL, ELSA, Volatility, Redline, FTK Imager, PDF analyzers, malware sandboxes, and more
Create indicators of compromise (IOCs) in OpenIOC and YARA and gain an understanding of sharing standards such as STIX and TAXII
Take advantage of models such as the Sliding Scale of Cybersecurity, the Active Cyber Defense Cycle, and the ICS Cyber Kill Chain to extract information from threats and use it to encourage the long-term success of ICS network security

Hands-On Training

Build a Programmable Logic Controller (PLC) using a CYBATIworks Kit
Identify information available about assets online through Shodan
Complete an analysis of competing hypotheses
Ingest threat intelligence reports
Identify and leverage new active defense skills to guide incident responders to the Human Machine Interface (HMI) affected by an advanced persistent threat (APT) on the lab network
Identify which system is affected by APT malware identified in the network and assemble a sample of the threat that can be analyzed
From the infected HMI and samples of the APT malware identified, analyze the malware, extract information, and develop YARA rules to complete the active defense
Address two different hands-on, real-world scenarios, one involving data collected from an intrusion into SANS Cyber City, and the other involving data collected from a Distributed Control System (DCS) infected with malware