IE156: ICS410: ICS/SCADA Security Essentials IE156 Rev.001 CMCT COURSE OUTLINE Page 1 of 6
Training Description: In this five-day intensive training, participants will develop and reinforce a common language and understanding of Industrial Control System (ICS) cybersecurity as well as the important considerations that come with cyber-to-physical operations within these environments. Instructor will demonstrate of PLC sample which contains physical inputs and outputs that will be programmed in class and mapped to an operator interface, or HMI, also created in class. This improved hardware-enabled approach provides the necessary cyber-to-physical knowledge that allows participants to better understand important ICS operational drivers and constraints that require specific safety protection, communications needs, system management approaches, and cybersecurity implementations. Essential terms, architectures, methodologies, and devices are all covered to build a common language for students from a variety of different roles. The course will discuss: An understanding of industrial control system components, purposes, deployments, significant drivers, and constraints. Hands-on lab learning experiences to control system attack surfaces, methods, and tools Control system approaches to system and network defense architectures and techniques Incident-response skills in a control system environment Governance models and resources for industrial cybersecurity professionals Training Objective: By the end of the training, participants will be able to: Run Windows command line tools to analyze the system looking for high-risk items Run Linux command line tools (ps, ls, netstat, ect) and basic scripting to automate the running of programs to perform continuous monitoring of various tools Install VMWare and create virtual machines to create a virtual lab to test and evaluate tools/security of systems Better understand various industrial control systems and their purpose, application, function, and dependencies on network IP and industrial communications Work with operating systems (system administration concepts for Unix/Linux and/or Windows operating systems) Work with network infrastructure design (network architecture concepts, including topology, protocols, and components) Better understand the systems' security lifecycle Better understand information assurance principles and tenets (confidentiality, integrity, availability, authentication, non-repudiation) Use your skills in computer network defense (detecting host and network-based intrusions via intrusion detection technologies) Implement incident response and handling methodologies IE156 Rev.001 CMCT COURSE OUTLINE Page 2 of 6
Training Designed for: This course is intended for the range of individuals who work in, interact with, or can affect industrial control system environments, including asset owners, vendors, integrators, and other third parties. These personnel primarily come from four domains; IT (includes operational technology support), IT security (includes operational technology security), Engineering, Corporate, industry, and professional standards Training Program: DAY ONE: PRE-TEST ICS Overview Global Industrial Cybersecurity Professional (GICSP) Overview Overview of ICS Processes & Roles Industries Field Components Real-Time Operating Systems Programming Controllers Exercise: PLC Programming Supervisory Components Specialized Applications Master Servers Exercise: HMI Programming Types of ICS Systems DCS vs. SCADA IT & ICS Differences ICS Lifecycle Challenges Physical Security ICS Network Architecture Network Models Design Example Exercise: Architecting a Secure DCS DAY TWO: ICS Attack Surface Exercise: Information Leakage Attacks on HMIs and UIs Intro to SamuraiSTFU Exercise: Password Fuzzing Web Attacks Exercise: Authentication Bypass with SQL Injection Attacks on Control Servers IE156 Rev.001 CMCT COURSE OUTLINE Page 3 of 6
Attacks on Network Communications Exercise: Spoofing Modbus Attacks on Remote Devices Exercise: Analyzing Firmware Firmware Attacks DAY THREE: Defending ICS Servers and Workstations Windows in ICS Linux/Unix in ICS Updates and Patching Processes and Services Configuration Hardening Exercise: Bastille Linux Endpoint Defenses Exercise: Firewalls Automation and Auditing Exercise: Powershell Log Management Exercise: Windows Logs Databases and Historians DAY FOUR: Defending ICS Networks and Devices Network Fundamentals Ethernet TCP/IP Protocol Suite ICS Protocols over TCP/IP Exercise: Network Capture Analysis Enforcement Zone Devices Firewalls Unidirectional Gateways Honeypots Wireless in Control Systems Satellite Protocols Mesh Protocols Bluetooth and WiFi Defenses Exercise: Network Capture Forensics Field and Plant Floor Equipment Cryptography Fundamentals DAY FIVE: ICS Security Governance IE156 Rev.001 CMCT COURSE OUTLINE Page 4 of 6
Information Assurance Foundations Data Classification Depth in Defense Security Policies Policy Hierarchy Policy Governance Contingency and Continuity Planning Risk Assessment and Auditing Risk Governance Calculating Risk Exercise: Attack Tree Analysis Password Management Incident Handling Six Steps Table Top Exercise Exercise: Incident Response Resources Course Conclusion POST-TEST and EVALUATION Training Requirement: The ICS410 Industrial Control System Security Essentials course consists of instruction and hands-on exercises. The exercises are designed to allow participants to put knowledge gained throughout the course into practice in an instructor-led environment. Participants will have the opportunity to install, configure, and use the tools and techniques that they have learned. Do not bring a regular production laptop for this training. When installing software, there is always a chance of breaking something else on the system. Participants should assume that all data could be lost. It is critical that participants have administrator access to the operating system and the ability to disable all security software installed. Changes may need to be made to personal firewalls and other host-based software in order for the labs to work. Laptop requirements include the following: 64-bit processor with 64-bit operating system VT or other 64-bit virtualization settings enabled in your BIOS to run 64-bit VMs At least eight (8) GB of RAM At least fifty (50) GB of free hard drive space At least one USB port VMware Player 12, VMware Workstation 12, or VWware Fusion 8 installed BEFORE class. Other virtualization software such as Parallels or VirtualBox may work if the attendee is familiar with its functionality, however VMware should be pre-installed as a backup just in case IE156 Rev.001 CMCT COURSE OUTLINE Page 5 of 6
Access to an account with administrative permissions and the ability to disable all security software on their laptop such as Antivirus and/or firewalls if needed for the class If you are using Linux for your host machine, you will need ExFAT drivers installed for the USB drive Training Methodology: This interactive training course includes the following training methodologies as a percentage of the total tuition hours:- 30% Lectures, Concepts, Role Play 30% Workshops & Work Presentations, Techniques 20% Based on Case Studies & Practical Exercises 20% Videos, Software & General Discussions Pre and Post Test Training Certificate(s): Internationally recognized certificate(s) will be issued to each participant who completed the course. Training Fees: As per the course location - This rate includes participant s manual, hand-outs, buffet lunch, coffee/tea on arrival, morning & afternoon of each day. Training Timings: Daily Timings: 07:45-08:00 Morning Coffee / Tea 08:00-10:00 First Session 10:00-10:20 Recess (Coffee/Tea/Snacks) 10:20-12:20 Second Session 12:20-13:30 Recess (Prayer Break & Lunch) 13:30-15:00 Last Session For training registrations or in-house enquiries, please contact: Aisha Relativo: aisha@cmc-me.com Tel.: +971 2 665 3945 or +971 2 643 6653 Mob.: +971 52 2954615 Training & Career Development Department IE156 Rev.001 CMCT COURSE OUTLINE Page 6 of 6