Attacks against industrial control systems (ICS) are on the rise. In order to effectively respond to this emerging threat, organizations should be aware about the challenges of performing digital forensics and incident response (DFIR) for ICS. Mandiant developed the “Digital Forensics for ICS” course to give ICS security personnel the fundamental skills needed to identify and understand threats targeting ICS devices that use embedded operating systems such as VxWorks and Windows CE. This is a technical course designed to provide hands-on experience with investigating targeted attacks and the analysis steps required to triage compromised ICS systems. Note: This course will not cover Standard Windows and Linux, as tools such as RedLine and Volatility exist and many training classes exist for those. We will include references to using RedLine etc on HMIs and Engineering Workstations as part of the class for completeness (overall DFIR strategy). For example, Stuxnet affected Engineering Workstations and PLCs…so we would mention both, but mainly focus on the PLC/embedded systems forensics part. Slides, handouts, digital forensic files, and any DFIR tools provided in a VM on a USB drive for each student Course Prerequisites Laptop with VMWare Player and 10GB of free space Prior digital forensics experience is helpful but not required. Familiarity with PLCs and their software tools is suggested.