In addition to Workshops and Briefings, Black Hat is host to world-class Trainings on a variety of hot-button topics. Case in point is this year's selection of Trainings on SCADA industrial control systems. ICS systems monitor and control everything from site security to wastewater treatment to far-flung environmental sensors, and are as poorly understood as they are diverse. Black Hat 2013's selection of SCADA/ICS Trainings can help remedy this.
First up, Tom Parker and Jonathan Pollet will present a two day primer on security supervisory control and data acquisition (SCADA) systems in their Training: Attacking, Defending and Building SCADA Systems. During the first day of the Training, they will cover SCADA-specific fundamentals, and information security doctrine specific to SCADA applications. Day Two switches gears into attacking industrial control systems, conducting vulnerability research on ICS devices and how to engage live systems. The class concludes with applying your new skills by securing SCADA applications and embedded ICS devices.
Next, ICS for Pentesters - Finding and Exploiting Industrial Control Systems on Enterprise Networks will introduce you to the basics of ICS systems and the components often used by the Fortune 1000, with a focus on pentests and red-team assessments. It'll cover both software and hardware, with human machine interface, programmable logic controllers, and other components covered in detail. Expect a deep dive into common vulnerabilities and configurations, techniques for discovering ICS on enterprise networks, and plenty of classroom time in a custom ICS lab environment. The class will wrap with work on live PLCs and simulated penetration tests meant to compromise a real ICS.
Pentesting Smart Grid and SCADA with SamuraiSTFU is a more advanced track, and offers hands-on training in pentest techniques for embedded electronic field devices, network protocols, RF communications, and controlling servers of ICS and Smart Grid systems. The course uses the formal penetration testing methodology created by the National Energy Sector Cybersecurity Organization Resource (NESCOR), and makes use of SamuraiSTFU, a Linux distro geared toward ICS pentesting. Real-world relevance will be emphasized, with a focus on systems and techniques relevant to the energy industry's "smart grid."
Finally, Real World Security: Attack, Defend & Repel will be a two-day simulation that will test your existing skills in a real-life scenario while also teaching you new ones. The course will split attendees into attack and defense teams, then swap roles the next day. Active defense techniques, active incident response, intrusion detection/prevention, log analysis, reverse engineering, vulnerability identification/scanning, and pentesting will all be touched upon. What's more, you'll have to operate under the restrictions of your virtual company's "boss," who'll assign you a specific goal to achieve by the final scenario. It's Team Fortress 2 meets hacker training, and a rare opportunity to learn both sides of the house.
That's just the start of the Black Hat USA 2013 Trainings -- check out the full listing for more. In the meantime, perhaps we can train you to check for our latest update on Twitter, Facebook, and LinkedIn:
Twitter
Facebook
LinkedIn