ICS310: ICS Cybersecurity Foundations™

Overview

The ICS310™ course has been developed as a foundational course for those new to the ICS/OT field. In this section we cover who this course is intended for, where the course fits in a broader ICS cybersecurity practitioner training program, how the course was developed across multiple author perspectives, and where we see the course as a fit for those students taking any of the other SANS ICS Security higher level courses.

Topics

• Meet the author team
• Foundational Industrial Control System (ICS) course topic areas
  • ICS and automation topics
  • ICS trends and case study lessons learned
  • Guidance and approaches for system defenders
• SANS and ICS history
• Where does ICS 310 fit across the broader curriculum
• Content focus areas
• Lab and exercise

Overview

In Section two, we will establish an understanding of the basic building blocks of industrial control systems, how and why they are used, as well as cover some essential concepts in the design and maintenance of these environments. We'll build on this knowledge of the foundational components that make up our ICS/OT environments, highlighting how these systems are interconnected and interdependent, creating systems of systems that necessitate careful design considerations and operational practices to ensure safe, reliable, resilient systems.

Exercises

• Ladder Logic Investigation

Topics

• Brief History of Automation
• What are the basic building blocks of an automation system
• Human Brain, Sensory and Muscle Reference
• What are the main components found in ICS
• What is digital -vs- analog
  • Types of Digital Inputs
  • Types of Digital Outputs
  • Types of Analog Inputs
  • Types of Analog Outputs
• Product development lifecycle
• What is a system of systems

Overview

Section three layers in learning objectives that have a cybersecurity focus, along with discussions on the drivers and constraints facing both offensive and defensive teams dedicated to achieving goals and objectives throughout ICS/OT environments. This section addresses the cybersecurity-specific considerations across critical infrastructure and key resource sectors, as well as differentiation across IT and OT systems, terminology, and trends.

Topics

• Critical Infrastructure sectors
• IT and OT focus areas
• Common terms
• IT/OT trends

Overview

Some of the most meaningful learning opportunities available are those that are shared or experienced, and in section four the course will utilize case studies and world events to highlight specific lessons learned that can be implemented within your operational environments. While the case studies covered may not be specifically from within your sector of interest, there are most likely common devices, protocols, threat vectors, or response approaches that are directly applicable to you. What can be learned from real-world attacks and case studies will aid system defenders in prioritizing actions that matter.

Exercises

• Wireshark Analysis Basics

Topics

• Case Studies
• Colonial Pipeline
• Ukraine 2015
• Ukraine 2016
• World events

Overview

For those working in ICS/OT environments there are often references to regulation, standards, or guidelines for a particular country, sector, or technology. Section five introduces the topic of security guidelines and standards that you will commonly encounter across industrial control systems, anywhere, any sector, in any geography. While there are full 5- and 6-day dedicated courses or a suite of courses for some of the standards that exist, this section simply highlights the different types of standards for familiarity and reference.

Topics

• Security Guidelines and Standards commonly encountered within the ICS / OT community
• Top three
  • IEC62443
  • NIST 800-82
  • NERC CIP
• European Union regulation NIS2
• Industry approach

Overview

With so many options to pursue across standards, regulations, guidelines, and industry recommendations, often organizations and leadership are looking for a clear path of what to do. Section six addresses this question and provides guidance on the ICS five critical controls. The authors of this course considered existing controls frameworks and asked, "If we wrote the critical controls (like the SANS 20 critical controls for IT) for OT, what would they be?" This section considers the prioritization, implementation, and customization of the critical controls for your organization and provides background on the selection of these controls as the minimum preventive and detective controls that are threat informed, have been identified based on attacks that have been seen, and consider the capabilities available to system defenders.

Exercises

• Network Visualization

Topics

• The Five Critical ICS Security Controls
  • ICS Incident Response
  • Defensible Architecture
  • ICS Network Visibility and Monitoring
  • Secure Remote Access
  • Risk Based Vulnerability Management
• Leadership Role
• Resources and contact information