Many industrial organizations have dedicated a lot of effort to implementing secure network architectures to isolate and protect their OT networks. Despite the fact that most OT environments  typically have one or more Active Directories, complex remote access requirements, wireless networks, and an endless number of applications, systems, protocols, and devices that support or require authentication, the management and security of identities in these settings is often very immature. While secure networks are foundational to the security posture of these environments, the next frontier for organizations that want to further secure their industrial networks is the management and control of identity. 

In this session we will explore the management and control of human and machine identities in industrial settings. Attendees will gain insights into managing and integrating with Active Directory, strengthening remote access for employees and contractors, and addressing authentication challenges for industrial devices and protocols. We will also delve into use of PKI and certificates, and the best practices for enhancing identity security, including multi-factor authentication and least privilege access control. Real-world case studies will illustrate common challenges and key success factors. Join us for an informative and engaging session to elevate your organization's identity management and security strategies.

This workshop will demonstrate how to build or migrate towards a resilient ICS network architecture to be able to withstand today's operational requirements, cybersecurity challenges. It explores existing frameworks, such as IEC 62443, used as resources towards your architectural needs while demonstrating a field-tested design and implementation methodology that thoroughly identifies and balances the needs for both operation resilience and effective defense posture which are each measurable and maintainable throughout the lifecycle of the facility.

It highlights the possible consequences for the way of working for ICS staff & suppliers, dependencies on IT architecture, and risks from other networks, the Internet or adversaries. With all the unique and complex systems requiring seemingly complex security requirements, this workshop will provide a methodology on identifying zones, conduits and trust boundaries that can support current and future needs in the selection of effective security controls and countermeasures. It also demonstrates how an access matrix can provide an easy way of quickly determining what system(s) should be able to talk to other parts of the network, and the security measures required to facilitate. 

With the many security control options available, this workshop will outline the cost/benefits and concerns/considerations of the most common. Other possible mitigating measures and alternatives for certain systems or system types will be highlighted as well.

Workshop attendees will be challenged to provide their thoughts on different design choices for specific use cases such as a secure remote access, file transfer, network security monitoring, external dependent systems, response and recovery readiness, and support communication requirements between Cloud, IT and ICS teams. The workshop includes a tabletop exercise with example scenarios attendees will work through with a supplied worked solution.

Being able to perform OT Cyber Security Risk Assessments is becoming more essential with each year. Drivers to perform a risk assessment vary, it might be a regulatory requirement, internal justification for investment or simply to better understand your operational risk. Finding skilled resources to be able to perform a risk assessment and running one in your busy operational environment is extremely challenging. This workshop will include an interactive realistic ICS OT Cyber Security risk assessment to explore and enforce the following:

Rational and a high-level grounding on risk assessmentsHow to effectively prepare the documentation and people for a risk assessment  Executing a risk assessment following the IEC 62443-3-2 Methodology (SUC, zones, using a RAM Matrix, assessing (un)-mitigated risks, etc.)How to be realistic and tactical with control selectionOutline common mistakes and pitfalls that occur

This workshop will provide students with hands-on experience in conducting Open-Source Intelligence (OSINT) specifically for Industrial Control Systems (ICS) and Operational Technology (OT) environments. Unlike traditional OSINT techniques that focus on general corporate or IT infrastructure, this session will dive into identifying critical ICS/OT-related details, such as utility power grids, pipelines, airports, data centers, and industrial service providers. Participants will learn how to analyze publicly available information to map out potential targets, identify remote access methods, fingerprint VPNs, and locate data leaks that may contain sensitive information. Using only online resources attendees will explore real-world techniques to gather intelligence on external IP ranges, cloud storage exposures, vendor partnerships, and industry-specific risks.

 By leveraging sources such as industry mapping websites, vendor press releases, regulatory filings, and RFP documents, students will develop a structured OSINT methodology tailored to ICS/OT environments. The workshop will cover how to correlate power, telecom, and internet infrastructure, investigate AI-generated leaks, and apply OSINT techniques to understand their current OSINT exposure. Attendees will also gain insight into organizing findings into actionable intelligence for vulnerability assessments and penetration tests. Whether you're a security consultant, ICS administrator, or OT defender, this session will equip you with the skills needed to enhance your reconnaissance capabilities in industrial environments.

In this workshop, Jason Dely, Bryan Johns and Jeff Shearer will discuss the topic that is often avoided; “how do you know what to code?”. There are workshops that tell you “How to code” but never address “What to code”? The answer of “What to code” lies inside the machine or process designers head however they don’t have a formal method to describe to the programmer “here’s what I want you to code”. In this two-hour workshop session, you will have the opportunity in hands-on labs to work through “what to program” and then write a program to achieve those requirements. From this process we will also discuss the often-missed topic of Misuse Sequence of Operations cases that should be identified to protect the mechanical systems. This knowledge identifies and mitigates operational vulnerabilities that cause disruption and destruction of physical devices and machines.

Historically, the ICS/OT community has emphasized preventing threat actors from breaching parameter controls and entering the lower levels of the environment. Although these efforts were valiant, they ultimately failed, leading to ever-increasing security breaches. SANS ICS leadership developed the Five Critical Controls to provide asset owners and operators a strategy and focus on implementing controls that would have prevented or significantly reduced the impact of the compromise. Control 1, an ICS-focused Incident Response Plan (IRP), covers system integrity and recovery capabilities. Unfortunately, even in an ICS-focused IRP, the workshop authors have seen that little attention is given to Disaster Recovery (DR) capabilities and how to properly bring an ICS asset back online after a system failure or compromise. 

This workshop aims to demystify (and further develop in an engineering-centric way) the often single sentence of an IRP stating “recovery affected systems.” It will help asset owners and operators develop a workable strategy for systematic recovery, reconstitution, and operational resumption. The workshop will  work through a moc scenario of a refinery utilities operation and discuss the steps involved in developing a DR plan, including: 

Specifying disaster criteriaIdentifying cyber-specific loss scenarios that cause those disastersSpecifying  recovery team responsibilities starting from the activation phase followed by recovery and reconstitutionIdentifying automation and control system function recovery priorityPerforming a dependency analysis of recovery priority  Documenting reconstitution steps to correct for any data deviation that has been introduced during recoveryDeveloping assurance and handover qualifications for process restart 

Students will be able to leverage the discussed scenario and handouts to improve upon their own IRP and DR plans or have the capability to begin developing those documents if they don’t exist upon returning to work.  

Are you prepared to take charge during a cyber crisis that threatens the backbone of the electrical industry? In this high-stakes interactive exercise, you’ll step into the role of a Crisis Management Team (Fusion Team) and navigate the complexities of a simulated cyberattack targeting a major power enterprise.

As the scenario unfolds, you’ll be challenged to make swift, strategic decisions to mitigate disruptions to critical infrastructure, protect operational technology (OT) and information technology (IT) systems, and ensure grid reliability under pressure.

This exercise is designed to test your response to today’s most sophisticated cyber threats, reinforcing the importance of a well-rehearsed incident response plan and the leadership skills required for success in the electrical sector.

Led by experienced facilitators with deep industry expertise, this simulation provides a hands-on opportunity to identify gaps in your crisis strategy, enhance cross-functional collaboration, and benchmark best practices with industry peers. Are you ready to power through the chaos? Buckle up—this crisis moves fast!

• Executives & Senior Management

• Support function leaders including IT, Cyber, HR, Finance, Legal, Marketing, etc.

• Technical Subject Matter Experts

USB Human Interface Device (HID) attacks continue to be a significant security challenge due to their ability to bypass standard defenses by impersonating trusted peripherals. While commercial tools like the USB Rubber Ducky have made these attacks well-known,  the barrier to entry has dropped dramatically with the availability of $4 microcontrollers.

This hands-on workshop will introduce attendees to the fundamentals of keyboard emulation attacks, how to program an RP2040-based microcontroller, and how to leverage it for both offensive security demonstrations and more benign automation tasks such as building a simple "mouse jiggler" to prevent system idle states.

Participants will walk away with a functional HID attack device they can use for security research, along with actionable insights on mitigating these threats in ICS environments.

In today’s increasingly complex operational technology (OT) and industrial control systems (ICS) environments, the ability to effectively monitor, troubleshoot, and detect anomalies is paramount to ensuring both productivity and security. Using in-room OT equipment, this workshop will explore the transformative potential of log aggregation across OT and ICS systems, showing how consolidating log data into a centralized platform creates a powerful “single pane of glass” that can streamline both operational troubleshooting and cybersecurity event detection.

By bringing together critical data from a wide array of OT and ICS components—ranging from SCADA systems and Network switches to PLCs and sensors—production engineers and managers will learn how to leverage a unified logging infrastructure to quickly diagnose production issues in real time. By leveraging logs from security tools in parallel, this approach enhances security visibility, enabling teams to detect anomalies or potential threats in their systems before they can escalate into significant issues.

For security event detection techniques, the workshop will demonstrate basic techniques using open-source tools as well as advanced techniques using Behavioral Alerting Sets for Control Systems (BAS/CS) an alerting framework created by the Johns Hopkins University Applied Physics Laboratory.  The workshop is designed to be implemented by existing commercial and open-source solutions to improve the detection of advanced cyberspace adversaries.

Executive audiences (c-suite, board of directors, and government leadership) are well suited to have conversations on OT cyber risks such as the threats facing our global infrastructure. To have these conversations it’s important to align on language, outcomes, and resourcing needs. This workshop will be an interactive (I.e. come armed with questions) session starting with an understanding of what’s changed, where we’re going, and using the SANS ICS 5 critical controls to speak to an executive audience. Participants will leave better empowered to answer the age old question “are we under spending or over spending on cybersecurity.” 

Discover how Idaho National Laboratory's integrated approach to cyber resilience is transforming the landscape of control system security. This workshop unveils the powerful synergy between three critical frameworks:

Critical Function Assurance (CFA): Understanding WHY - Identify and prioritize the functions that are essential to your organization's mission

Cyber-Informed Engineering (CIE): Defining WHAT - Architect systems with built-in cyber resilience from the ground up

Consequence-driven Cyber-informed Engineering (CCE): Implementing HOW - Apply methodical approaches to protect against and mitigate high-consequence cyber attacks

Join us to learn how these complementary methodologies work together to create robust, resilient control systems that can withstand evolving cyber threats. Whether you're an engineer, security professional, or system architect, you'll gain practical insights into implementing these frameworks in your organization.

Head over to Epcot, explore the park, then meet up at Isle de France at 7:30pm where you’ll be able to connect with Summit speakers, SANS instructors, and your

fellow attendees. There will be dessert, stunning waterfront views, and a private spot to watch the fireworks show.

**Epcot tickets will be provided to registered summit attendees