Aberdeen Cyber Security for Control Systems

(CS)²AI Online™ Seminar: Part I: OT Monitoring & SOC | Part II: Incident Response for OT

As industrial environments become increasingly connected, the need for specialized skills in Operational Technology (OT) security has never been higher. Standard IT practices are no longer enough to protect real-time automation and SCADA systems. Many of you in the OT Cybersecurity industry are likely building out your OT monitoring solutions, either staffing up and building your own SOC or deciding to outsource your OT monitoring and SOC functions to a credible managed service provider (MSP). Knowing what to do to prepare for a cyber incident that impacts operational systems is another timely topic given the increase in connectivity between IT and OT systems and cloud adoption within the OT industry.
Join us on January 21 at 1:00 PM ET for a comprehensive 60-minute webinar featuring a panel of three industry-leading experts that will provide an exclusive first look at two new OT Cybersecurity training courses developed for instrumenting OT systems for monitoring, building out an effective OT SOC, and how to prepare your organization to respond to an incident affecting your operational control systems.
The first 30 mins will focus on the topic of OT Monitoring and SOC, and Pollet, Visser, and Singer will use the first 20 mins to outline the highlights of this new 1-day training course coming to Level Zero and to a browser near you so anyone can take the course anytime, anywhere, on any device on-demand. The last 10 minutes will be left open for discussions and Q&A.
The second half of the webinar will shift into the topic of Incident Response for OT systems. The three panelists will provide some highlights from this new 3-day deep dive training course for the first 20 minutes and leave the remaining 10 minutes for open discussions and Q&A.

What You Will Learn:
Part 1 - OT Monitoring & SOC: Building on foundational OT knowledge and testing methodologies, participants learn how to implement continuous monitoring, threat detection, and incident response capabilities for industrial control systems. This 1-day course covers OT-specific SIEM deployment, custom signature development for industrial protocols, security event correlation across IT/OT boundaries, and staffing models for 24/7 OT security monitoring operations.
Part 2 - Incident Response for OT: Traditional IT playbooks can be catastrophic in an Industrial Control System (ICS) environment. When physical safety and operational uptime are the priorities, "unplugging" is rarely an option. Developed by three OT cybersecurity pioneers, this intensive 3-day course moves beyond data protection to focus on physical safety and operational resilience. You will learn to manage the full IR lifecycle—from preparation to post-incident hardening—while maintaining mission-critical systems under fire.
Expert Insight: Direct access to our panel for Q&A and open discussion.
Webinar Agenda (60 Minutes)
Part I: Seeing the Threat – OT Monitoring & SOC (30 Mins)

• Course Overview (20 mins): Our experts will highlight concepts from this new course on topics including how to instrument your OT system for monitoring, how to setup an OT-specific SOC, the role asset discovery plays in incident detection and response, identifying anomalies in SCADA/ICS protocols, and how to use automation to build maturity into your SOC systems, policies, and procedures.
• Open Q&A (10 mins): Engage directly with the panelists regarding monitoring challenges and toolsets.

Part II: Stopping the Threat – Incident Response for OT (30 Mins)

• Course Overview (20 mins): A deep dive into the unique constraints of OT Incident Response, including preparation, alert triage, determining whether patterns of alerts are due to normal operations or when to escalate and trigger the IR plan, containment strategies, safety considerations when responding to a cyber incident on the plant floor, communicating effectively with operations for a safe return to business as usual, safe recovery protocols, hardening OT systems post incident, and extracting key knowledge from lessons learned
• Open Q&A (10 mins): Discussion on building playbooks and coordinating between IT and OT teams during a crisis.