Black Hat USA Training 2008
Caesars Palace Las Vegas • August 2-3, August 4-5
SCADA Defense: Protecting Critical Infrastructure
IOActive
Overview:
Defending infrastructure controls systems (SCADA, PCS, DCS, and ICS) has never been more
important, nor more in the public eye. This course is designed to provide process control
professionals with a fundamental understanding of the steps needed to effectively defend
their critical infrastructure assets. It is an introduction for owners and managers of
critical infrastructure on the tools and methods being employed by modern attackers.
Aside from reviewing the methods and tools, participants will have active classroom
exercises focused on defending systems against simulated attacks. These hands-on exercises
include scenarios where the attendees will perform analysis, and participate in the defense
of a live process that is undergoing both live and simulated attacks. This uniquely designed
atmosphere includes attack pathways and architectural flaws that the attendees have to identify,
diagnose, and protect. Students gain hands-on experience using available tools.
Learning Objectives
- Understand the perimeter from the attacker’s point of view
- Leverage the process environment's static nature to build custom IDS rules
- Manipulate the anonymous control surface present in most control environments
- Implement effective scanning and patch management without crashing the process
- Understand the four stages of a SCADA attack and what each of those stages look like in the logs
Target Audience
NOTE: Proper credentials that recognize each student as holding a control systems or control systems security-related position will be confirmed prior to attendance authorization
- Controls systems managers
- Controls system technology developers
- Security specialists
Prerequisite
At least one year of control system experience.
Course Length: Two days. All course materials, lunch and two coffee breaks will be provided. A Certificate of Completion will be offered. You must provide your own laptop.
Trainer
IOActive is an industry leader in the information security community and has been invited to present computer security research to institutions such as the Navy’s Information Warfare College, the CIA, the FBI, and the Secret Service.
With the majority of IOActive’s customers ranked in the top 30% of the Fortune 500, the company is positioned and well experienced to handle a variety of information security needs. IOActive has a blend of skills that makes it unique in the field of information security.
IOActive's aggregate corporate experience includes developing a SCADA penetration testing program for the Department of Energy, and working on IT disaster recovery and business continuity planning for major providers in a variety of industries including insurance entities, state organizations, healthcare providers, and energy companies. Additionally, IOActive performed the final security review of Windows Vista—one of only three firms asked by Microsoft to do so—and will be involved with the review of Windows 7 and Longhorn Server.
IOActive develops and delivers secure application development programs based upon OWASP 's top ten vulnerabilities, and application and network threat modeling methodologies to major software and telecommunication companies.
IOActive's aggregate personnel experience includes having:
- Worked with Israeli companies
- Worked as military and law enforcement agents
- Operated in international markets including competitive intelligence
- Generated a high success rate in network and application review
IOActive employs only the best-of-breed computer security professionals and its consultants are members and active contributors to local and nationally recognized computer security organizations such as SANS, Agora, CRIME, ISSA, CTIN, WSA, HoneyNet Research Alliance, OWASP, and the University of Washington Information Assurance School. IOActive specializes in infrastructure assessment services, application security services, managed services, incident response services, and education services.
|
Early:
Ends May 1 |
Regular: |
Late: |
Late/Onsite: Begins August 1 |
|
$2000 USD |
$2200 USD |
$2400 USD |
$2700 USD |