SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
NEW
ICS613: ICS/OT Penetration Testing & Assessments
ICS613Industrial Control Systems Security
- 5 Days (Instructor-Led)
- 30 Hours
Course authored by:
Jason Dely, Tyler Webb & Don C. Weber
Course authored by:Jason Dely, Tyler Webb & Don C. Weber
- 30 CPEs
Apply your credits to renew your certifications
- In-Person or Virtual
Attend a live, instructor-led class from a location near you or virtually from anywhere
- Advanced Skill Level
Course material is geared for cyber security professionals with hands-on experience
- 27 Hands-On Lab(s)
Apply what you learn with hands-on exercises and labs
Security professionals gain critical skills to conduct safe, effective penetration tests and assessments in ICS/OT environments without compromising operational integrity.
Featured Quote
The content from the labs in this section of the book, for me, had the biggest takeaways and were great sources of practical and actionable information for real in-world ICS testing.
Course Overview
Industrial Control Systems (ICS) and Operational Technology (OT) are increasingly targeted by adversaries, yet traditional penetration testing approaches often focus on the wrong outcomes and can cause unintended disruptions with severe consequences – including production outages, injury to personnel, loss of life, and environmental hazards.
ICS613: ICS/OT Penetration Testing & Assessments trains engineering, operations, and security professionals with the mindset, methodologies, and techniques to safely and appropriately conduct ICS penetration tests and security assessments, identify practical mitigations, and effectively communicate results to stakeholders and leadership to improve the operational resilience of ICS environments. As a specialized ICS pentesting course, ICS613 equips students to approach assessments with precision and safety in mind.
What You'll Learn
- Plan and execute safe, effective, and valuable penetration tests and security assessments, using both passive and active techniques to assess ICS operational resilience
- Tailor ICS penetration tests and security assessments to organizational and operational security objectives
- Identify realistic ICS attack scenarios targeting Crown Jewel Assets (CJA)
- Communicate with stakeholders to define expectations, goals, and outcomes for ICS security assessments, and deliver accurate, actionable reports that support these outcomes
- Understand the benefits of a top-down/bottom-up approach to active testing, and align penetration test methodologies to the ICS Cyber Kill chain
- Evaluate tools and techniques for effectiveness and safety before applying them to ICS devices and networks
- Identify relevant targets and select applicable adversary TTPs for developing effective attack scenarios in ICS penetration tests and security assessments, regardless of industry sector
Business Takeaways
- Reduce risk of unplanned outages during security testing
- Enhance protection of operational crown jewel assets
- Improve communication between IT security and OT teams
- Demonstrate compliance with sector-specific regulations
- Gain practical risk mitigation strategies for industrial systems
- Increase operational resilience against cyber threats
- Implement cost-effective security recommendations
Meet Your Authors
- Slide 1 of 3
Jason Dely
Certified InstructorJason Dely brings over 20 years of experience and a diverse industrial control system background to SANS and the industrial control system (ICS) community.
Read more about Jason Dely - Slide 2 of 3
Tyler Webb
Associate InstructorTyler Webb, Dragos Principal Penetration Tester and ICS613 co-author, teaches real-world OT penetration testing, giving students adversary and operational insight to strengthen assessments and turn findings into lasting security improvements.
Read more about Tyler Webb - Slide 3 of 3
Don C. Weber
Principal InstructorA visionary OT security leader, SANS Principal Instructor, and USMC veteran, Don co-authored ICS613 and teaches ICS410. He translates years of frontline experience into safer, practical methods to empower defenders protecting critical infrastructure.
Read more about Don C. Weber
Slide 1 of 0
(1/0)
Course Syllabus
Explore the course syllabus below to view the full range of topics covered in ICS613: ICS Penetration Testing and Assessments.
Section 1Bench and Lab Testing
This section introduces the types of ICS/OT assessments, the risks and the three tenets of ICS/OT assessments. The section also introduces the three types of bench and lab testing for ICS/OT assessments, covering a high-level process of devices bench testing including hardware, firmware, administration and communication analysis.
Topics covered
- Types of ICS/OT assessments
- Introduction to the bench testing assessment
- Bench and lab testing case studies, methodology and tool preparation
- Analyze device functionality, configuration and interfaces
- Hardware and firmware analysis including tools
Labs
- Build and program student kit
- Custom tool development
- Firmware analysis
- Analyze unknown protocols
Section 2Preparing for ICS/OT Assessments
This section introduces passive and active security assessments for ICS/OT environments, covering how to define goals, choose an approach, apply threat intelligence and prepares students to plan, execute, and deliver safe and effective ICS/OT security assessments while emphasizing stakeholder collaboration.
Topics covered
- Define assessment goals and outcomes and testing terminology
- Align with ICS/OT Cyber Kill Chain, Crown Jewel Analysis and threat intelligence
- Outline phased assessment methodology
- Collaborate with stakeholders
- Structure actionable test reports and balance mitigation options
Labs
- Understand the operation of ICS613 student kit LNG process
- Understand the preparation for ICS/OT assessment through the Crown Jewel Analysis process
Section 3Top-Down Active Methodology
This section introduces a top-down penetration methodology aligned with the ICS/OT Cyber Kill Chain. Students learn to execute engagement objectives in simulated production environments using "living off the land" techniques while focusing on privilege escalation and OT boundary pivoting.
Topics covered
- Follow assumed breach scenarios
- Master process enumeration
- Identify effective targets
Labs
- Exploit certificate services
- Abuse credential reuse
- Transfer tools using native binaries
- Hijack operator sessions
- Bypass endpoint hardening controls
Section 4Security and Vulnerability Assessment
This section introduces passive security assessments for ICS/OT environments, covering nonintrusive techniques to collect and analyze the environment that align with industry standards. Students will learn ICS/OT specific knowledge and skills to analyze perimeters, network communications, hosts and active directory.
Topics covered
- ICS/OT standard and frameworks alignment
- Common perimeter architectures and exploitable vectors
- ICS/OT vulnerability discovery and management
- Network analysis techniques
- Server and workstation analysis
Labs
- Exploit operator workstation services
- Advance ICS/OT network analysis
- Validate tools and techniques
Section 5Bottom-Up Operations Assessment and Capstone
This section covers a bottom-up approach to ICS/OT attack identification aligned with the ICS/OT Cyber Kill Chain. Students learn to develop realistic attack scenarios with expected physical consequences, and demonstrate attacks in controlled environments, while emphasizing stakeholder collaboration.
Topics covered
- Various control system models and architectures
- Assess realistic attack scenarios and operational impacts
- Consequences and impacts to physical equipment
- Apply adversarial methods on targeting and TTPs
- Evaluate weaknesses and readiness of attack
Labs
- Enumeration EWS and DCS architectures
- Identify and exploit operational vulnerabilities
- Develop and execute adversarial attack scenarios and methods
- Capstone
Things You Need To Know
Relevant Job Roles
Industrial Control Systems and Operational Technologies
SCyWF: Industrial Control Systems And Operational TechnologiesThis role conducts cybersecurity tasks for Industrial Control Systems and Operational Technologies (ICS/OT). Find the SANS courses that map to the Industrial Control Systems and Operational Technologies SCyWF Work Role.
Explore learning pathICS/OT Security Pen Tester
Industrial Control SystemsDiscovers system vulnerabilities and works with asset owners and operators to mitigate discoveries and prevent exploitation from adversaries.
Explore learning pathICS Security Analyst Training, Salary, and Career Path
Industrial Control SystemsAcquires and manages resources, supports, and performs key industrial security protection while adhering to safety and engineering goals.
Explore learning pathCourse Schedule and Pricing
Looking for Group Purchasing Options?Contact Us
Location & instructorDate & TimeCourse priceRegistration Options
- Date & TimeFetching schedule..Course price$9,230 USD*Prices exclude applicable local taxesRegistration Options
- Date & TimeFetching schedule..Course priceA$14,045 AUD*Prices exclude applicable local taxesRegistration Options
- Date & TimeFetching schedule..Course price€8,630 EUR*Prices exclude applicable local taxesRegistration Options
- Date & TimeFetching schedule..Course price$9,230 USD*Prices exclude applicable local taxesRegistration Options
- Date & TimeFetching schedule..Course price$9,230 USD*Prices exclude applicable local taxesRegistration Options
- Date & TimeFetching schedule..Course price$9,230 USD*Prices exclude applicable local taxesRegistration Options
- Date & TimeFetching schedule..Course priceS$11,985 SGD*Prices exclude applicable local taxesRegistration Options
- Date & TimeFetching schedule..Course price€8,630 EUR*Prices exclude applicable local taxesRegistration Options
- Date & TimeFetching schedule..Course price$9,230 USD*Prices exclude applicable local taxesRegistration Options
Showing 9 of 9
Learn Alongside Leading Cybersecurity Professionals From Around The World
- Slide 1 of 4Great course and a lot of great content discussion with tons of applicable, real-life thoughts, processes, examples, and in-depth descriptions.
- Slide 2 of 4This course is immensely educational.
- Slide 3 of 4The content from the labs in this section of the book, for me, had the biggest takeaways and were great sources of practical and actionable information for real in-world ICS testing.
- Slide 4 of 4The sections referring to real-world events really solidified the fact that you need to be careful when dealing with anything OT-related.
Slide 1 of 0
(1/0)
Benefits of Learning with SANS
Get feedback from the world’s best cybersecurity experts and instructors
Choose how you want to learn - online, on demand, or at our live in-person training events
Get access to our range of industry-leading courses and resources