Overview
The IISP accredited ICS Practitioners Security Course is designed to provide ICS practitioners with an understanding of the cyber security challenges facing their environments. This knowledge is vital when managing the day to day running of all aspects of security risk for those environments.
The course will show how to protect ICS environments and best identify and support their organisations’ cyber security and risk mitigation/reduction strategies for their ICS environments.
Siker have worked in partnership with the National Cyber Security Centre (NCSC), the Centre for the Protection of National Infrastructure (CPNI) in the UK and leading Critical National Infrastructure (CNI) organisations.
If you are a...Practitioner involved with ICS procurement/implementation/audit/maintenance or part of an ICS environment supply chain and/or people who need full awareness of the security risks to these environments, including:
- Site/Asset User or Operator
- Site/Asset IT/ICS Support engineer
- Site/Asset Physical security/Facilities Management professional
...then this course is for you.
It provides the attendee with the knowledge to fully understand the security risks facing your ICS environments including the Supply Chain. In addition, it discusses how to forward plan to help mitigate and reduce these risks as well as identifying and responding to a cyber incident.
To provide you with a safe place to practice post course, every learner will be given 4 weeks access to hands-on ICS labs.
Prerequisites
There are no pre-requisites for this course and no technology is required. A handbook of supporting material is provided.
Learning Outcomes
The course consists of 2 days (12 CPE credits) of classroom training. Day one covers the current and emerging ICS risk landscape and Day two covers operational security, risk reduction planning and Cyber Incident Management.
By the end of the course, you will be familiar with:
- How to identify what current and emerging threats your ICS environments face
- Where your ICS environments may be vulnerable
- What actions you need to take to secure those environments and help reduce the risk
- How to prepare for and handle a cyber security incident in those environments
Course Outline
Post Course ICS Labs
Post course, learners will be given a voucher code to access the CYRIN Cyber Range and have 1 month access to the following labs.
CYRIN ICS201 Lab - ICS OT Man in the Middle Attack
Would you know if a device on your Operational Technology (OT) network was compromised on its way from the factory to you? Or if a contractor inadvertently installed some malware that didn't activate until months later? This scenario presents just such an attack on the OT network—one of the existing devices on the network is intercepting and modifying SCADA traffic. It could be producing false measurements or be sending commands to an unsuspecting device on behalf of the SCADA Server!
CYRIN ICS202 Lab - ICS IT/OT Phishing Attack
It only takes one user clicking on a phishing e-mail to launch a devastating attack. Successful phishing attempts give an attacker access to your IT network resources, and possibly your OT network as well. This scenario presents just such an attack—one of the users on the IT side of the network has inadvertently opened a malicious e-mail attachment. What are the consequences to the IT and OT networks, and how can this be contained and neutralised?
CYRIN ICS203 Lab - ICS OT Application-Level DoS Attack
Denial of Service (DoS) attack can cripple your business operations or do even worse to your physical infrastructure. How will you find and stop such an attack? How will your personnel perform when the system is in a degraded state? This scenario presents just such an attack on the OT network—a DoS attack at the application layer, aimed at disrupting normal operations.
CYRIN ICS204 Lab - ICS OT Network-Level DoS Attack
A Denial of Service (DoS) attack can cripple your business operations or do even worse to your physical infrastructure. How will you find and stop such an attack? How will your personnel perform when the system is in a degraded state? This scenario presents just such an attack on the OT network—a DoS attack at the network layer, flooding your systems with bogus data and slowing operations to a crawl.
Course Outline
Module 1: Background (what is an ICS, what are the threats and vulnerabilities):
- ICS description and terminology
- ICS Vs IT. Differences and similarities
- Threats to ICS
- ICS vulnerabilities
- Known ICS security incidents
Module 2: Securing ICS (what can be done to secure an ICS):
- Secure architecture and design
- Securing existing and legacy systems
- Security risk management
- Operational security
- Vendor management
- Building security into procurement processes
Module 3: Security Incident Management (what to do when the worst happens and roles and responsibilities):
- Security incident identification
- Security incident response
- Security incident recovery
- Planning and preparation
Module 4: Cyber Incident Exercise
- Cyber interactive exercise
QA is proud to be the UK Siker Cyber partner.
Special Notices
Complimentary post course ICS labs are provided, exclusive to QA in the UK, by CYRIN.
Cyber Security learning paths
Want to boost your career in cyber security? Click on the roles below to see QA's learning pathways, specially designed to give you the skills to succeed.
= Required
= Certification
ICS & OT Security learning paths
Want to boost your career in ICS & OT Security? View QA's learning pathways below, specially designed to give you the skills to succeed.
= Required
= Certification
Frequently asked questions
See all of our FAQsHow can I create an account on myQA.com?
There are a number of ways to create an account. If you are a self-funder, simply select the "Create account" option on the login page.
If you have been booked onto a course by your company, you will receive a confirmation email. From this email, select "Sign into myQA" and you will be taken to the "Create account" page. Complete all of the details and select "Create account".
If you have the booking number you can also go here and select the "I have a booking number" option. Enter the booking reference and your surname. If the details match, you will be taken to the "Create account" page from where you can enter your details and confirm your account.
Find more answers to frequently asked questions in our FAQs: Bookings & Cancellations page.
How do QA’s virtual classroom courses work?
Our virtual classroom courses allow you to access award-winning classroom training, without leaving your home or office. Our learning professionals are specially trained on how to interact with remote attendees and our remote labs ensure all participants can take part in hands-on exercises wherever they are.
We use the WebEx video conferencing platform by Cisco. Before you book, check that you meet the WebEx system requirements and run a test meeting (more details in the link below) to ensure the software is compatible with your firewall settings. If it doesn’t work, try adjusting your settings or contact your IT department about permitting the website.
Learn more about our Virtual Classrooms.
How do QA’s online courses work?
QA online courses, also commonly known as distance learning courses or elearning courses, take the form of interactive software designed for individual learning, but you will also have access to full support from our subject-matter experts for the duration of your course. When you book a QA online learning course you will receive immediate access to it through our e-learning platform and you can start to learn straight away, from any compatible device. Access to the online learning platform is valid for one year from the booking date.
All courses are built around case studies and presented in an engaging format, which includes storytelling elements, video, audio and humour. Every case study is supported by sample documents and a collection of Knowledge Nuggets that provide more in-depth detail on the wider processes.
Learn more about QA’s online courses.
When will I receive my joining instructions?
Joining instructions for QA courses are sent two weeks prior to the course start date, or immediately if the booking is confirmed within this timeframe. For course bookings made via QA but delivered by a third-party supplier, joining instructions are sent to attendees prior to the training course, but timescales vary depending on each supplier’s terms. Read more FAQs.
When will I receive my certificate?
Certificates of Achievement are issued at the end the course, either as a hard copy or via email. Read more here.