Active Defense and Incident Response Training

Active Defense and Incident Response Training

Course Delivery

This Course is available in the following format:

Request this course in a different delivery format

GSA Schedule 70 Saving for Government Customers

Course Overview:

Active Defense and Incident Response Training Course Description

This Active Defense and Incident Response Training course on ICS Active Defense and Incident Response will empower students to understand their networked industrial control system environment, monitor it for threats, perform incident response against identified threats, and learn from interactions with the adversary to enhance network security. This process of monitoring, responding to, and learning from threats internal to the network is known as active defense. An active defense is the approach needed to counter advanced adversaries targeting ICS, as has been seen with malware such as Stuxnet, Havex, and BlackEnergy2. Students can expect to come out of this Active Defense and Incident Response Training course with the ability to deconstruct targeted ICS attacks and fight these adversaries and others. The Active Defense and Incident Response Training course uses a hands-on approach and real-world malware to break down cyber attacks on ICS from start to finish. Students will gain a practical and technical understanding of leveraging active defense concepts such as using threat intelligence, performing network security monitoring, and utilizing malware analysis and incident response to ensure the safety and reliability of operations. The strategy and technical skills presented in this course serve as a basis for ICS organizations looking to show that defense is do-able.

Customize It:

• If you are familiar with some aspects of this course, we can omit or shorten their discussion.
• We can adjust the emphasis placed on the various topics or build the course around the mix of technologies of interest to you (including technologies other than those included in this outline).
• If your background is nontechnical, we can exclude the more technical topics, include the topics that may be of special interest to you (e.g., as a manager or policy-maker), and present the course in manner understandable to lay audiences.

Related Courses:

Assessing and Exploiting Control Systems Training
RMF Training | Introduction to Risk Management Framework

Audience / Target Group:

The target audience for this Active Defense and Incident Response Training course:

• ICS Incident Response Team Leads and Members who want to learn how to respond to advanced threats safely in the • ICS with a focus on combined and continued security
• ICS and Operations Technology Security Personnel who want to learn how to leverage an ICS active defense to include network security monitoring and threat intelligence
• IT Security Professionals who want to expand their knowledge into the ICS field with an understanding of ICS protocols, threats, and priorities
• Security Operations Center (SOC) Team Leads and Analysts who want to learn how to monitor OT networks and ICS assets in an ICS SOC or dual IT/OT SOC
• ICS Red Team and Penetration Testers who want to learn the latest in defense tactics to identify how they can better perform, and how they can better highlight areas for improvement in ICS networks
• Active Defenders who want to challenge themselves to identify and respond to advanced targeted threats

Active Defense and Incident Response Training – Course Syllabus:

Threat Intelligence

• Case Study: Havex
• Introduction to ICS Active Defense and Incident Response
• Intelligence Life Cycle and Threat Intelligence
• ICS Information Attack Surface
• External ICS Threat Intelligence
• Internal ICS Threat Intelligence
• Sharing and Consuming ICS Threat Intelligence

Asset Identification and Network Security Monitoring

• Case Study: BlackEnergy2
• ICS Asset and Network Visibility
• Identifying and Reducing the Threat Landscape
• ICS Network Security Monitoring – Collection
• ICS Network Security Monitoring – Detection
• ICS Network Security Monitoring – Analysis

Incident Response

• Case Study: Stuxnet
• Incident Response and Digital Forensics Overview
• Preparing an ICS Incident Response Team
• Evidence Acquisition
• Sources of Forensic Data in ICS Networks
• Time-Critical Analysis
• Maintaining and Restoring Operations

Threat and Environment Manipulation

• Case Study: German Steelworks
• ICS Threat and Environment Manipulation Goals and Considerations
• Establishing a Safe Working Environment
• Analyzing Acquired Evidence
• Memory Forensics
• Malware Analysis Methodologies
• Case Study: BlackEnergy2 Automated Analysis
• Indicators of Compromise
• Environment Manipulation

Active Defense and Incident Response Challenge
Scenario One

• Identify the assets and map the ICS networks
• Perform ICS network security monitoring to identify the abnormalities
• Execute ICS incident response procedures into the SANS Cyber City data files
• Analyze the malicious capability and determine if the threat is an insider threat or a targeted external threat
Scenario Two
• Identify the software and information present on the DCS
• Leverage ICS active defense concepts to identify the real-world malware
• Determine the impact on operations and remediation needs

Whether you are looking for general information or have a specific question, we want to help!

Request More Information

Print Friendly, PDF & Email