Digital Bond

For Secure & Robust ICS

  • Home
  • Consulting
  • S4x18
    • S4x18 Call For Presentations
    • S4x18 Sponsor Packages
  • Dale Peterson
  • Hire Dale To Speak
  • Contact Us

ICSsec Training Options Abound

March 13, 2014 by Dale Peterson 7 Comments

SCADAsec TrainingBack in ~2004 I started teaching a 3-day course on SCADA Security for Infosec Institute. Back then the term ICS didn’t exist, and the INL/DHS courses were the only other options. I left the class after about 18 months with the realization training is hard work and not something I enjoyed. The class was passed to and greatly improved by a number of instructors,  and it still exists.

A lot has changed in the ICSsec training options in 10 years. Now the market is full of high quality choices and may even reaching a point of too many courses with a shakeout coming. Here is an incomplete list and some of my impressions based on talking with students and instructors that might help you pick a course.

The Originals and Classics

Red Tiger Security

Jonathan Pollet and the team at Red Tiger were the first to produce what I would call an ICS hacking course. They cover what an ICS is and defending an ICS, but they excel at how to assess and attack an ICS. There labs have grown over the years in size and complexity (and resilience to students; rampant crashing is a problem when you put together an ICS lab).

They traditionally sell out the class in conjunction with Black Hat and SANS events, and the classes are also available directly from Red Tiger. The main course is 5-days, but they also offer an abbreviated 2-day course.

All will benefit from this course, but it is the class to go to if you want to learn how to identify vulnerabilities ICS systems, components and protocols and go into it with some technical security skills.

SCADAHacker

Joel Langill, aka the SCADAHacker, took over the Infosec Institute course for a couple of years before branching out to create his own course. He came from the ICS world where he worked decades for large oil companies and large vendors (his Honeywell knowledge is top notch).

Joel offers a one-week and two-week course as well as an occasional shorter course taught in conjunction with a conference. He recently moved to Europe and is offering courses there as well as in the US.

@digitalbond twitter followers probably know that Joel and I disagree quite often on the seriousness of insecure by design and what the ICS community needs to prioritize. I would classify Joel as Mr. Compensating Control. Compensating controls are very important, and students receive practical information on how ICS are deployed and operate, and how to secure them with what is available from vendors today.

Joel defines his training as focused on defense. I would recommend this class to someone in Operations who does not understand IT or security as well as someone in IT who wants to understand ICS and the ICS culture.

INL / DHS

DHS and other government agencies funded the development, and continue to fund the operation, of a variety of INL taught ICSsec courses. The biggest advantage these courses have is the price … they are free.

They have a one day beginner and intermediate course that is typically taught around a conference. These courses are being taught less often and either need to be updated or retired.

INL’s flagship training option is the week long Red/Blue Training Course in Idaho Falls, formally known as ICS Cybersecurity 301. Attendees rave about this course, particularly the 10 hour Red Team / Blue Team exercise that takes place on a lab system that cost more than $1 million. The Blue Team (defense) is much larger and students are assigned to roles such as Operator, Engineer, IT, CIO, etc. The only negative I hear about this course is the location.

I recommend the Red/Blue training for anyone in an asset owner or vendor organization that needs to understand why ICSsec is important and difficult. It is even better if you can send multiple people from your organization so they have a common experience.

Note: by law the National Labs are not allowed to compete with private industry. They clearly are competing in training, but this has been going on for years now and is unlikely to change.

Big New Training Options

SANS / GIAC GICSP

For years SANS has offered ICSsec courses from Red Tiger, CYBATI, UtiliSec and others around their SANS SCADA Security Summit. The market must have appeared large enough for SANS (don’t let the non-profit status fool you; they are hard-nosed business types) as they brought Michael Assante in as the Project Lead for ICS, developed a ICS410: ICS/SCADA Security Essentials, and created a corresponding certification (GICSP: Global ICS Security Professional).

SANS has huge mindshare in the IT Security market, so it is almost assured that a large number of IT Security professionals will attend this course and get the certification. They may be IT Security professionals who want to get into ICSsec or people in the IT Group of a large company that has an ICS.

How many ICS engineers will chose this course is an open question. SANS does not have as positive reputation with the Operations organizations. The course and cert has been panned on lists such as SCADASEC, but this is only anecdotal evidence. The course and cert was created by a talented and experienced group of ICS security types. I’m sure the course content is strong and will improve over time. Justin Searle, Paul Henry and Eric Cole are some of the instructors.

I feel safe in recommending the course in general, but I’m not sure what specific profile will benefit most from it. If you take the course; you might as well get the certification. Just don’t expect the certification to get much respect beyond the fact you took a 5-day course, at least from me.

ISA

The fact that SANS and ISA are stepping up their ICS security training is evidence the market is there. Where SANS has mindshare within IT Security, ISA has mindshare with engineers and operations in manufacturing and other vertical sectors.

The ISA99 standards committee continues to publish ICS (or IACS in their terminology) security standards, and they are offering a set of courses around these standards and general ICSsec information.

  • Industrial Automation Cybersecurity: Principles and Applications (4.5 days)
  • Industrial Networking and Security (5 days)
  • Introduction to Industrial Automation Security and the ANSI/ISA-62443 Standards (1 day)
  • Using the ANSI/ISA99 (IEC 62443) Standards to Secure Your Industrial Control System (2 days)

The last course will include a certification if you pass the test.

Obviously ISA is best positioned to teach the standards they develop. They also have a lot of talented ICSsec professionals that work on the ISA99 standards and teach these courses. The content and instructor is likely to be strong.

In comparison to SANS, ISA marketing is weak, and training is just one of many things they do. Also, the courses don’t make sense. Do I take the 4.5 day IACS: Principles and Applications or the 5 day Industrial Networking and Security? The one-day or two-day course on IEC 62443?

I know Bryan Singer teaches some of these classes, and he certainly knows the material and is an enthusiastic teacher. If ISA is well recognized in your sector then these courses are recommended, particularly the two focused on the IEC standards.

Cimation

Cimation is about to launch a set of four ICSsec courses taught by Clint Bodungen, formerly of CIDG. Cimation has been actively hiring ICSsec talent the last two years for a variety of service offerings.

Too early to recommend, but more evidence that companies believe in the ICSsec training market.

The Others

Please do not take offense if you are in this section or not on the list. The main point of this article is there are a lot of quality ICSsec training options available.

  • Justin Searle of UtiliSec (although he may be moving more to SANS training)
  • Matthew Luallen of CYBATI
  • Tom Parker of FusionX
  • Don Weber of InGuardians

 

 

 

Filed Under: Training Tagged With: ICSsec Training, SCADAsec Training

Subscribe to the S4 Events YouTube Channel

S4x18 Stats: 447 people from 25 countries
Thanks to all Attendees, Speakers & Sponsors

Follow S4 Events on Facebook

Tools & Talks

DNS Squatting and You

DNS Squatting and You

February 24, 2016 By Reid W 3 Comments

Basecamp for Serial Converters

Basecamp for Serial Converters

October 30, 2015 By Reid W 3 Comments

escar Asia

escar Asia

September 9, 2015 By Dale Peterson 1 Comment

Unsolicited Response Podcast: Cyber Insurance

Unsolicited Response Podcast: Cyber Insurance

August 27, 2015 By Dale Peterson 3 Comments

S4 Events Newsletter

Subscribe to our newsletter on leading / bleeding edge ICS cyber security information and S4 Events.

* indicates required
Email Format

Dale's Tweets

About Us

Digital Bond was founded in 1998 and performed our first control system security assessment in the year 2000. Over the last sixteen years we have helped many asset owners and vendors improve the security and reliability of their ICS, and our S4 events are an opportunity for technical experts and thought leaders to connect and move the ICS community forward.

Recent Comments

  • Chris on Koyo/Automation Direct Vulnerabilities
  • Brandon Workentin on The ICS Security Stories We Tell And Love
  • Joe Weiss on Insanely Crowded ICS Anomaly Detection Market
  • Stuart Bailey on Unsolicited Response Podcast Is Back … With John Matherly of Shodan
  • Chris Orr on Insanely Crowded ICS Anomaly Detection Market

Search….

Follow @digitalbond

Copyright © 2018 Digital Bond. - All Rights Reserved ·