Top 5 ICS Incident Response Tabletops and How to Run Them

How is your ICS cyber incident response preparedness? Resilience against Ransomware that could impact safety and operations? Ability to detect APTs (Advanced Persistent Threats) using modern attack methodologies against your critical infrastructure? Regular Incident Response (IR) tabletop exercises are part of a mature ICS Security Program and works to identify strong and weak points in ICS defense efforts. The scenarios designed to test ICS defense capabilities and cyber preparedness are critical.

In this webcast, Dean Parsons will discuss 5 tabletop scenarios based on recent attack campaigns seen across multiple ICS sectors. You will be walked through each tabletop scenario and illustrate key takeaways for practical ICS defense, while highlighting several critical ICS assets that could be commonly targeted and should be highly monitored and protected. The scenarios range from: Living off the ICS land, Ransomware impacting IT and ICS operations, to physical-cyber two-stage attacks.

About SANS Certified Instructor Dean Parsons:

Dean brings over 20 years of technical and management experience to the classroom. He has worked in both Information Technology and Industrial Control System (ICS) Cyber Defense in critical infrastructure sectors such as telecommunications, and electricity generation, transmission, distribution, and oil & gas refineries, storage, and distribution. Dean is an ambassador for defending industrial systems and an advocate for the safety, reliability, and cyber protection of critical infrastructure. His mission as an instructor is to empower each of his students, and he earnestly preaches that “Defense is Do-able!” Over the course of his career, Dean’s accomplishments include establishing entire ICS security programs for critical infrastructure sectors, successfully containing and eradicating malware and ransomware infections in electricity generation and manufacturing control networks, performing malware analysis triage and ICS digital forensics, building converged IT/OT incident response and threat hunt teams, and conducting ICS assessments in electric substations, oil and gas refineries, manufacturing, and telecommunications networks. A SANS Certified Instructor, Dean teaches ICS515: ICS Active Defense and Incident Response and is a co-author of the upcoming new SANS Course ICS418: ICS Security Essentials for Managers. Dean is a member of the SANS GIAC Advisory Board and holds many cybersecurity professional certifications including the GICSP, GRID, GSLC, and GCIA, as well as the CISSP®. He is a proud native of Newfoundland and holds a BS in computer science from Memorial University of Newfoundland.