Special Notices

For the Live Online course, it can run either as a 4-day course 9am-5pm or as 8 half-days 1pm-5 pm over a two week period.

Overview

This is not your traditional SCADA/ICS/IIoT security course!

How many courses send you home with a $500 kit including your own PLC and a set of hardware/RF hacking tools?!? This course teaches hands-on penetration testing techniques used to test individual components of a control system, including embedded electronic field devices, network protocols, RF communications, Human Machine Interfaces (HMIs), and various forms of master servers and their ICS applications.

Skills you will learn in this course will applydirectly to systems such as the Smart Grid, PLCs, RTUs, smart meters, building management, manufacturing, Home Area Networks (HAN), smart appliances, SCADA, substation automation, synchrophasors, and even IoT.


Course Author

Justin Searle specializing in ICS security architecture design and penetration testing. He led the Smart Grid Security Architecture group in the creation of NIST Interagency Report 7628 and has played key roles in the Advanced Security Acceleration Project for the Smart Grid (ASAP-SG), National Electric Sector Cybersecurity Organization Resources (NESCOR), and Smart Grid Interoperability Panel (SGIP).

Justin has taught courses in hacking techniques, forensics, networking, and intrusion detection for multiple universities, corporations, and security
conferences. He is currently a Senior Instructor for the SANS Institute and a faculty member at IANS. In addition to electric power industry conferences, Justin leads prominent open source projects including the Control Thing Platform, Samurai Web Testing Framework (SamuraiWTF), Samurai Security Testing Framework for Utilities (SamuraiSTFU). He has an MBA in International Technology and is a CISSP and SANS GIAC certified Incident Handler (GCIH), Intrusion Analyst (GCIA), Web Application Penetration


Takeaways

The following items (or rough equivalents depending on availability) are provided to each student to use in class and to keep after course completion:

  • Programmable Logic Controller (PLC)
  • Software to program the PLC to keep (non-expiring)
  • Software to program an HMI for the PLC (non-expiring)
  • RTL-SDR (Software Defined Radio)
  • Great Scott Gadgets Yardstick sub-GHz Radio
  • Great Scott Gadgets GreatFET
  • Breadboard with SPI and I2C EEPROMs
  • TivaC Launchpad (ARM m4) for Firmware exercises
  • Latest version of the ControlThings Platform on USB

Prerequisites

It is assumed that attendees will have no knowledge of ICS, Smart Grid, SCADA, or critical infrastructure. This course is designed for intermediate level security professionals, be they engineers, technicians, analysts, managers, or penetration testers.

Learning Outcomes

  • Attendees will be able to explain the steps and methodology used in performing penetration tests on Industrial Control Systems and Industrial Internet of Things.
  • Attendees will be able to use the free and open source tools in ControlThings Platform to discover and identify vulnerabilities in web applications.
  • Attendees will be able to exploit several hardware, network, serial, user interface, RF, and server-side vulnerabilities.

Course Outline

This course is structured around the formal penetration testing methodology created by UtiliSec for the United States Department of Energy.
Using this methodology and ControlThings Pentest Platform (previously SamuraiSTFU), an open source Linux distribution for pentesting energy sector systems and other critical infrastructure, we will perform hands-on penetration testing tasks on user interfaces (on master servers and field device maintenance interfaces), control system protocols (modbus, DNP3, IEC 60870-5-104), proprietary RF communications (433MHz, 869MHz, 915MHz), and embedded circuit attacks (memory dumping, bus snooping, JTAG, and firmware analysis).
We will tie these techniques and exercises back to control system devices that can be tested using these techniques. The course exercises will be performed on a mixture of real world and simulated devices to give students the most realistic experience as possible in a portable classroom setting. Advances in modern control systems such as the energy sector’s Smart Grid has brought great benefits for asset owners/operators and customers alike, however these benefits have often come at a cost from a security perspective. With increased functionality and additional inter-system communication, modern control systems bring a greater risk of compromise that vendors, asset owners/operators, and society in general must accept to realize the desired benefits.
To minimize this risk, penetration testing in conjunction with other security assessment types must be performed to minimize vulnerabilities before
attackers can exploit critical infrastructures that exist in all countries around the world. Ultimately, this is the goal of this course, to help you know how, when, and where this can be done safely in your control systems.
Recommended Reading before the Course:
For those with little or no ICS experience, these Wikipedia articles provide a brief introduction to the concepts and history of control systems that will be helpful to know for class:
a. http://bit.ly/2WzuVZu (Large YouTube Playlist of Basic ICS Concepts)

Cyber Security Learning Paths

Want to boost your career in Cyber Security? Click on the roles below to see QA‘s learning pathways, specially designed to give you the skills to succeed.

= Required
= Certification
Cyber Management
Cyber Tech
Privacy
AppSec
Security Auditor
Intrusion Analyst
CompTIA Security Includes Security+, CySA+ and CASP
Industrial Control Systems & Operational Technology Technical
Industrial Control Systems & Operational Technology Management