Web - Based Training available on the CISA Virtual Learning Portal
We offer several online training courses via the CISA Training Virtual Learning Portal (VLP). Topics include:
Operational Security (OPSEC) for Control Systems (100W) - 1 hour
Differences in Deployments of ICS (210W-1) – 1.5 hours
Influence of Common IT Components on ICS (210W-2) – 1.5 hours
Common ICS Components (210W-3) – 1.5 hours
Cybersecurity within IT & ICS Domains (210W-4) – 1.5 hours
Cybersecurity Risk (210W-5) – 1.5 hours
Current Trends (Threat) (210W-6) – 1.5 hours
Current Trends (Vulnerabilities) (210W-7) – 1.5 hours
Determining the Impacts of a Cybersecurity Incident (210W-8) – 1.5 hours
Attack Methodologies in IT & ICS (210W-9) – 1.5 hours
Mapping IT Defense-in-Depth Security Solutions to ICS (210W-10) – 1.5 hours
Access the CISA VLP for more information and to register for and complete the courses. There are no tuition costs for these courses.
Instructor Led Training
Introduction to Control Systems Cybersecurity (101) - 8 hrs
Intermediate Cybersecurity for Industrial Control Systems (201) - 8 hrs
Intermediate Cybersecurity for Industrial Control Systems (202) - 8 hrs
ICS Cybersecurity (301V)
ICS Cybersecurity (301L) - 2 days
ICS Evaluation (401) - 5 days
CISA program training events consist of 'regional' training courses and workshops at venues in various locations in addition to the 5-day training events held in Idaho Falls, Idaho. Refer to the CISA calendar for a schedule of these training options. Note that all CISA training courses are presented with no tuition cost to the attendee.
Scheduled training is on the CISA Calendar
Note: Training personnel do not possess proprietary interest in any product, instrument, device, service or material discussed in these courses or in any course materials.
Introduction to Control Systems Cybersecurity (101)
This course introduces students to the basics of Industrial Control Systems (ICS) cybersecurity. This includes a comparative analysis of IT and ICS architectures, understanding risk in terms of consequence, security vulnerabilities within ICS environments, and effective cyber risk mitigation strategies for the Control System domain.
After attending this course, you will be able to:
- Describe ICS deployments, components, and information flow
- Differentiate cybersecurity within IT and ICS domains
- Explain a cyber exploit in an ICS architecture
- Recognize sector dependencies
- Identify cybersecurity resources available within CISA
A Certificate of Completion will be provided at the conclusion of the course. This course is IACET accredited, awarding attendees Continuing Education Units (CEUs) upon completion.
This course is presented at regional venues in various locations throughout the year. If the course has an open enrollment, it will be posted to the CISA calendar. There is no tuition cost to the attendee for this training.
Intermediate Cybersecurity for Industrial Control Systems (201) Part 1
This course builds on the concepts learned in the Introduction to ICS Cybersecurity (101) course. This course provides technical instruction on the protection of Industrial Control Systems using offensive and defensive methods. Attendees will recognize how cyber attacks are launched, why they work, and mitigation strategies to increase the cybersecurity posture of their Control System networks. In addition, this course acts as a prerequisite for the next course, Intermediate Cybersecurity for Industrial Control Systems (202), which offers hands-on application of concepts presented.
After attending this course, you will be able to:
- Describe ladder logic
- Describe network discovery
- Discuss the three main stages of an attack
- Create a baseline using CSET
- Describe defense-in-depth strategies
A Certificate of Completion will be provided at the conclusion of the course. This course is IACET accredited, awarding attendees Continuing Education Units (CEUs) upon completion.
This course is presented at regional venues in various locations throughout the year. If the course has an open enrollment, it will be posted to the CISA calendar. There is no tuition cost to the attendee for this training.
Intermediate Cybersecurity for Industrial Control Systems (202) Part 2
This hands-on course is structured to help students recognize how attacks against Process Control Systems can be launched, why they work, and provides mitigation strategies to increase the cyber security posture of their Control Systems networks.
This course provides a brief review of Industrial Control Systems security. This includes a comparative analysis of IT and control system architectures, security vulnerabilities, and mitigation strategies unique to the Control System domain. Because this course is hands-on, students will get a deeper understanding of how the various tools work. Accompanying this course is a sample Process Control network that demonstrates exploits used for unauthorized control of the equipment and mitigation solutions. This network is also used during the course for the hands-on exercises that will help the students develop Control Systems cybersecurity skills they can apply in their work environment.
Note that this course is not a deep dive into training on specific tools, Control System protocols, Control System vulnerability details or exploits against Control System devices.
This course is split into five sessions: (1) Industrial Control System Overview, (2) Network Discovery and Mapping, (3) Exploitation and Using Metasploit, (4) Network Attacks and Exploits, (5) Network Defense, Detection, and Analysis
After attending this course, you will be able to:
- Identify risks in ICSs
- Demonstrate a process control exploitation
- Use passive discovery tools
- Use active discovery tools
- Describe Metasploit
- Use the Metasploit Framework
- Discuss basic web hacking techniques
- Describe password security
- Discuss wireless attacks and exploits
- Describe packet analysis
- Define intrusion detection and prevention systems
A Certificate of Completion will be provided at the conclusion of the course. This course is IACET accredited, awarding attendees Continuing Education Units (CEUs) upon completion.
This course is presented at regional venues in various locations throughout the year. If the course has an open enrollment, it will be posted to the CISA calendar. There is no tuition cost to the attendee for this training.
ICS Cybersecurity (301V/301L)
IMPORTANT CHANGES TO THE 301 COURSE: In an effort to make the 301 course more accessible to industry professionals, it has been divided into two offerings; 301V and 301L. The 301V is a self-paced online course that is accessed through the CISA Virtual Learning Portal (VLP). The 301V contains approximately 12 hours of instructional material and is a prerequisite to the 301L. The 301L is a two-day instructor-led hands-on lab that is taught at a training facility in Idaho Falls, Idaho, USA. Day two of this course is dedicated to a Red Team versus Blue Team exercise. More information on each course can be found below.
ICS Cybersecurity (301V)
This course provides an online virtual training based on understanding, protecting, and securing Industrial Control Systems (ICS) from cyber-attacks. In order to understand how to defend IT and OT systems, trainees will learn about common cyber vulnerabilities and the importance of understanding the environment they are tasked to protect. Learning the weaknesses of systems will enable trainees to identify mitigation strategies, policies, and programs that will provide the defense-in-depth needed to ensure a more secure ICS environment.
The online course consists of pre-recorded videos compiled into five main learning sessions:
- Session 1: Overview of Industrial Control Systems including an attack demonstration
- Session 2: Network Discovery and Mapping
- Session 3: Network Defense, Detection, and Analysis
- Session 4: The Exploitation Process
- Session 5: Network Attacks and Exploits
Note that this course is not a deep dive into training on specific tools, Control System protocols, Control System vulnerability details, or exploits against Control System devices. The 301V designation is simply a course number and has no reference to a “300 level” college course.
This course serves as a primer and is a mandatory prerequisite course to the in-person 301L class. A comprehensive exam with questions from each section will test the learners understanding of the principles taught. A passing score of at least 80% is required to be considered as an attendee in the 301L class. Although completion of the 301V course, along with a passing score on the associated assessment, is required to attend the in-person 301L it does not guarantee attendance. Acceptance to the 301L is subject to review by CISA and INL.
The 301V course is IACET accredited and attendees will be awarded Continuing Education Units (CEUs) and receive a certificate upon completion of the sessions and a passing score of 80% or above on the end of course exam.
Prerequisites:
- Trainees should have practical knowledge and experience with ICS networks, software, and components. They should have a practical understanding of IT network basics such as User Datagram Protocol (UDP) and Transmission Control Protocol (TCP), as well as Media Access Control (MAC) and Internal Protocol (IP) addressing.
Refer to the CISA calendar for a schedule of this training option.There is no tuition cost to the attendee for this training.
ICS Cybersecurity Lab (301L) - 2 days
This is the companion and follow-on course to the 301V. This course provides hands-on training on understanding, protecting, and securing Industrial Control Systems (ICS) from cyber-attacks and includes a Red versus Blue team exercise conducted within an actual Control Systems environment. Attendees will get an instructor-led hands-on experience with opensource operating systems and security tools such as Kali Linux and Security Onion. In addition, the training provides the opportunity to network and collaborate with other colleagues involved in operating and protecting Control System networks.
Note that this course is not a deep dive into training on specific tools, Control System protocols, Control System vulnerability details or exploits against Control System devices. The 301L designation is simply a course number and has no reference to a “300 level” course.
This course consists of hands-on activities correlated with the five sessions covered in the 301V, followed by a Red Team versus Blue Team exercise and a brief discussion of the lessons learned.
- Day 1 – Includes a welcome, a brief review of cybersecurity for Industrial Control Systems, and a process control attack demonstration. Hands-on activities in the morning focus on network discovery and mapping, followed by network defense, detection, and analysis. Hands on activities in the afternoon focus on exploitation using Metasploit, and network attacks. Trainees will be divided into Red and Blue teams in preparation for the exercise.
- Day 2 – Includes a 7-hour hands-on exercise where trainees are either attacking (Red Team) or defending (Blue Team) IT and OT networks. The Blue Team is tasked with providing the cyber defense for a corporate environment, while maintaining operation of a batch mixing plant, and monitoring an electrical distribution substation SCADA system. After the exercise, there will be a brief round-table discussion of lessons learned.
Prerequisites:
- Trainees must have previously participated in the virtual 301V,and passed the assessment test with an 80% or better.
- Trainees should have practical knowledge and experience with ICS networks, software, and components. They should have a practical understanding of IT network basics such as User Datagram Protocol (UDP) and Transmission Control Protocol (TCP), as well as Media Access Control (MAC) and Internal Protocol (IP) addressing.
This course is presented at a facility in Idaho Falls, Idaho, USA configured specifically for the aspects of the course.
The 301L course is IACET accredited and attendees will be awarded Continuing Education Units (CEUs) and receive a certificate upon completion.
Refer to the CISA calendar for a schedule of this training option. There is no tuition cost to the attendee for this training.
ICS Evaluation (401) - 5 days
This instructor-led 5-day course provides hands-on training on how to analyze, evaluate, and document the cybersecurity posture of an organization’s Industrial Control Systems (ICS) for the purpose of identifying recommended changes. Specifically, the course will utilize a multi-step repeatable process, within a simulated ICS environment, that teaches how to analyze cybersecurity weaknesses and threats, evaluate and map findings, document potential mitigations, and provide ongoing resolutions to strengthen the cybersecurity posture.
This course is also intended to increase awareness of how a threat related to the Industrial Control System translates into a threat to business operations, either directly through the ICS or indirectly via network connections. Attendees will come to more fully appreciate that most businesses have numerous support processes and systems controlled by, or otherwise dependent on, an Industrial Control System.
At the completion of this course attendees will have the basic skills necessary to conduct a self-evaluation of their organization’s ICS, develop mitigation strategies for vulnerabilities, and a tool to create new or update existing cybersecurity plans. Attendees will leave with a template that can be used for evaluating the cybersecurity posture at their workplace.
At the end of this course, attendees will be able to:
- Discuss components of an ICS evaluation
- Identify assets within ICS networks
- Determine ICS connectivity
- Evaluate network monitoring capabilities
- Discuss the use of Wireless in ICS environments
- Determine ICS dependencies
- Evaluate risk using OSINT and OPSEC methods
- Evaluate adversarial risk
- Assess supply risk
- Evaluate risk management and mitigation approaches
Prerequisites:
- Attendees of this course need to have previously attended a session of the 301 course.
A certificate of completion will be provided at the conclusion of the course. This course is IACET accredited, awarding attendees Continuing Education Units (CEUs) upon completion.
This course may be presented virtually or at regional venues in various locations throughout the year. Refer to the CISA calendar for a schedule of this training option. There is no tuition cost to the attendee for this training.