ICS310: ICS Cybersecurity Foundations

Key Takeaways

[music] My name is Tim Conway. I am one of the course authors of ICS 310. And as we have multiple authors of this 1-day course, we have Jeff Sheer who is coming from a system integrator and kind of a implementation side. Rob Mley who is coming from sort of a product and a intelligence side and then myself. I'm coming more from an asset owner and operator perspective. >> [music] >> We put together this on demand course together as three different instructors, three different authors, really trying to tie different perspectives across. As we bring new people into this industry, we know everybody's coming from different backgrounds and different experience. So, we tried to build a course that presented that as well. So, SANS IC 310 was really a creative thing for SANS cuz we made it as a one-day course and try to price it as aggressively as possible. That way we could really serve as an entry point into the community and we get a lot of people that want to come take one of the advanced courses but really need the fundamentals and they need it in an approachable way. So we've also bundled it in with every single course in ICS you take just for free. I've had very seasoned people come to the class and said hey I wished I would have taken your class a long time ago because you've boiled down [music] the information with the important essentials of foundational things that I thought I understand but didn't. I've had very beginning people come to the class and they said, "Boy, you gave me an awesome on-ramp to be able to start from the start. What is a motor? What is a pump? How do I control it? And how is it applied to [music] everything from boiler controls to heat loops? All that kind of stuff." So, we give you kind of that fast-paced [music] but digestible nuggets so that now you can jump into a full class and you're ready. ICS 310. Not only do we want them to put something into action at work, we want them to be able to put something into action when they take that course and then come into 410 or 5:15 as a prerequisite. When they take 310, we want them to understand and sort of interact differently at our summits because now they've sort of built a language that they can talk to others during networking and sort of get a better understanding or seek better guidance and ask better questions. I've taken this course and I want to understand this better. But there are absolutely things in ICS 310 [music] from a case study perspective. If this is what happened to this industry, what would that look like if that attack happened to me? What would our response look like? What would the impact look like? [music] As I understand these environments, what can I do? And the five critical controls that is immediately actionable working with your leadership and what are we doing on incident response? What are we doing on architectures? What are we doing on network visibility? Where do we sit from a vulnerability management perspective? And how are we handling remote access? looking at those things, they can start a program on every single one of them. >> ICS310 is unique because it's so accessible to everybody and it's also a shorter course form, but it's also unique because you get Jeff, Tim, and I all giving you the different angles and views of government, private industry, integrator, folks that have operated as an asset owner and operator. So, it's just a lot of knowledge to speed you up as quickly as possible. So in 310 we provide something of high value that is a relics virtual machine and that is for research [music] education in a lab environment for industrial control systems. That virtual machine has a number of tools [music] for packet capture and traffic analysis. And so we give them packet captures that they can learn from and how to use those tools. But it also has programmable logic controller local software [music] and simulations so they can practice doing some coding and seeing what happens in a process environment. And then there's a number of other things they can use that virtual machine for in their normal daily job life. >> So ICS is traditional in so much [music] as that it does fulfill the SANS promise. You're going to be able to take our information and actually apply that when you get back to your office [music] in a meaningful way. And that is what we promise from IC 310. [music] If you'd like to learn more about the ICS 310 course, I would welcome you to go to sans.org/ic3. org/ICS310 and you can learn everything you need to know about the foundations of industrial control systems.