Ilan Shaya

The ICS security course

Written over a year and a half, sold to governments, taught on real controllers.

Ilan Shaya shaking hands with a DNP executive in Japan, certificates on the wall behind them
Handing the course over to DNP in Japan.

Three versions

  • Three weeks, Singapore. The full version, bought by the Ministry of Home Affairs and taught since 2015 in the national cyber lab. All three modules, the hands-on labs and the training kits.
  • Two weeks, Japan. A version developed for a Japanese government body and taught to DNP, which then trained 84 cyber police officers from every police prefecture in Japan. It concentrates on detection, response and practical defense.
  • One week, enterprises. A focused version for OT and security teams in companies and corporations: the essentials of ICS, the threat map and the controls that matter, adapted to the client's environment.

Syllabus, by topic

Module 1: Introduction to industrial control systems

  • How ICS evolved and why it needs defending; ICS architecture and its components
  • Kinds of PLC, HMI and historian; controller operating modes
  • The HMI–PLC relationship and controller programming (Allen-Bradley programming lab)
  • Historians and databases: role, architecture and trends (HMI-to-historian lab)
  • Communications and protocols: Modbus, PCCC, TCP/IP (Modbus capture and analysis lab)
  • Policy and standards: NIST, NERC CIP, ISA99

Module 2: Cyber threats to control systems

  • The threat landscape; how IT threats differ from ICS threats; sources of vulnerability
  • Attack vectors in automation systems and industrial protocols
  • SCADA, HMI and historian vulnerabilities and how to defend them
  • Awareness, and physical and logical protection of the ICS environment

Module 3: Response, prevention and detection

  • A seven-step incident-response plan; simulation exercise
  • Secure ICS architecture; defensive tools (firewalls, diodes, IDS)
  • Prevention: configuration management, hardening, application whitelisting, patch management
  • Risk management, asset management, backup and restore
  • Detection: IDS (Suricata lab), SIEM
  • Defense and investigation mechanisms; a security checklist

Labs, for example

  • Building an HMI–PLC–historian automation project with a security configuration
  • Capturing and analysing Modbus; connecting an HMI to a historian
  • Hardening systems and configuring defensive tools (firewalls, diodes)
  • Standing up an IDS (Suricata) and a SIEM; attacking and defending real controllers

Where it has been taught

Ilan Shaya teaching at a whiteboard in the Singapore cyber lab
The national cyber lab, Singapore.
Officers in the Japan lab watching an exercise on the whiteboard
The training lab, Japan.
A whiteboard exercise in the Japan lab
A whiteboard exercise: segmenting the plant network.
The course group in Japan with Ilan Shaya
The course group, Japan.
An operator in a Ghana control room; an instructor points at SCADA single-line diagrams on a video wall
SCADA training in a substation control room, Ghana.
Ilan Shaya lecturing on ICS security
A lecture on ICS security.