This Course is available in the following format:
Critical Infrastructure and Control System Cybersecurity Training Course Description
Critical Infrastructure and Control System Cybersecurity Training is designed for security professionals and control system engineers in order provide them with advanced cybersecurity skills and knowledge in order to protect the Industrial Control System (ICS) and keep their industrial operation environment secure against cyber threats. TONEX as a leader in security industry for more than 15 years is now announcing the ICS Cybersecurity training which helps you to protect your ICS based on special publication of National Institute of Science and Technology (NIST) for control systems based on Supervisory Control and Data Acquisition (SCADA), Distributed Control System (DCS) or the other control system configurations.
• If you are familiar with some aspects of this Critical Infrastructure and Control System Cybersecurity Training course, we can omit or shorten their discussion.
• We can adjust the emphasis placed on the various topics or build the Critical Infrastructure and Control System Cybersecurity Training course around the mix of technologies of interest to you (including technologies other than those included in this outline).
• If your background is nontechnical, we can exclude the more technical topics, include the topics that may be of special interest to you (e.g., as a manager or policy-maker), and present the Critical Infrastructure and Control System Cybersecurity Training course in manner understandable to lay audiences.
Audience / Target Group:
The target audience for this Critical Infrastructure and Control System Cybersecurity Training course:
• ICS Incident Response Team Leads and Members who want to learn how to respond to advanced threats safely in the • ICS with a focus on combined and continued security
• ICS and Operations Technology Security Personnel who want to learn how to leverage an ICS active defense to include network security monitoring and threat intelligence
• IT Security Professionals who want to expand their knowledge into the ICS field with an understanding of ICS protocols, threats, and priorities
• Security Operations Center (SOC) Team Leads and Analysts who want to learn how to monitor OT networks and ICS assets in an ICS SOC or dual IT/OT SOC
• ICS Red Team and Penetration Testers who want to learn the latest in defense tactics to identify how they can better perform, and how they can better highlight areas for improvement in ICS networks
• Active Defenders who want to challenge themselves to identify and respond to advanced targeted threats
What You Will Learn:
Upon completing this Critical Infrastructure and Control System Cybersecurity Training course, learners will be able to meet these objectives:
• Perform ICS incident response focusing on security operations and prioritizing the safety and reliability of operations.
• How ICS threat intelligence is generated and how to use what is available in the community to support ICS environments. The analysis skills you learn will enable you to critically analyze and apply information from ICS threat intelligence reports on a regular basis.
• How to identify ICS assets and their network topologies and how to monitor ICS hotspots for abnormalities and threats. Methodologies such as ICS network security monitoring and approaches to reducing the control system threat landscape will be introduced and reinforced.
• How to analyze ICS malware and extract the most important information needed to quickly scope the environment and understand the nature of the threat.
• How to operate through an attack and gain the information necessary to instruct teams and decision-makers on when operations must shut down, or if it is safe to respond to the threat and continue operations.
• How to use multiple security disciplines in conjunction with each other to leverage an active defense and safeguard the ICS, all reinforced with hands-on labs and technical concepts.
Critical Infrastructure and Control System Cybersecurity Training – Course Syllabus:
• Case Study: Havex
• Introduction to ICS Active Defense and Incident Response
• Intelligence Life Cycle and Threat Intelligence
• ICS Information Attack Surface
• External ICS Threat Intelligence
• Internal ICS Threat Intelligence
• Sharing and Consuming ICS Threat Intelligence
Asset Identification and Network Security Monitoring
• Case Study: BlackEnergy2
• ICS Asset and Network Visibility
• Identifying and Reducing the Threat Landscape
• ICS Network Security Monitoring – Collection
• ICS Network Security Monitoring – Detection
• ICS Network Security Monitoring – Analysis
• Case Study: Stuxnet
• Incident Response and Digital Forensics Overview
• Preparing an ICS Incident Response Team
• Evidence Acquisition
• Sources of Forensic Data in ICS Networks
• Time-Critical Analysis
• Maintaining and Restoring Operations
Threat and Environment Manipulation
• Case Study: German Steelworks
• ICS Threat and Environment Manipulation Goals and Considerations
• Establishing a Safe Working Environment
• Analyzing Acquired Evidence
• Memory Forensics
• Malware Analysis Methodologies
• Case Study: BlackEnergy2 Automated Analysis
• Indicators of Compromise
• Environment Manipulation
Active Defense and Incident Response Challenge
• Identify the assets and map the ICS networks
• Perform ICS network security monitoring to identify the abnormalities
• Execute ICS incident response procedures into the SANS Cyber City data files
• Analyze the malicious capability and determine if the threat is an insider threat or a targeted external threat
• Identify the software and information present on the DCS
• Leverage ICS active defense concepts to identify the real-world malware
• Determine the impact on operations and remediation needs