ICS202 - ICS Incident Response Fundamentals

There are no pre-requisites for this course. In addition, a course exercise handbook and ICS Continuity Plan template is provided.

Who Should Attend?

• Anyone new to cyber security in an ICS Incident Response environment
• Non-ICS staff who need to understand ICS terminology and how it differs from their current roles

If you are a professional working in an ICS environment including:

• Site/Asset Operators
• Procurement/Contract staff
• Supply chain staff
• Site/Asset IT Support engineers
• Site/Asset Physical Security/Facilities Manager staff

We want staff who may be called in to help resolve a cyber incident to understand what it is they are walking into. This will help calm the panic and provide a swifter response to the incident which, in turn, leads to a quicker return to normal operations. This includes:

• Being able to articulate the difference between an Incident and an Event and be able to identify both.
• Understand the 6-stage process for Incident Response
• Identify the key roles that make up a standard Incident Response Team
• Understand the legal and regulatory aspects of cyber incident response
• Handle different types of incidents

Module 1: Introduction to the Incident Handling Process

• What is an Incident and an Event and how do they differ?
• What is Incident Response?
• The challenges of ICS Incident Response
• The IR lifecycle

Module 2: Preparation

• Obtaining Leadership support
• ICS IR Plans
• Who gets involved?
• What makes the CSIRT?
• Jump Kit and Grab Bag

Module 3: Identification

• Classification Levels
• Managing the Information Flow
• Evidence

Module 4: Containment

• What is Containment?
• Short-term Containment
• Long-term Containment
• Investigations

Module 5: Eradication

• The main aims of eradication
• Remove or restore?
• Improvement after

Module 6: Recovery

• Recovery Objectives
• Validation
• Post-Incident Monitoring

Module 7: Lessons Learned

• The Report
• Management Considerations
• Bringing it all together