SANS Secure Canberra 2019

Learn the most effective steps to prevent attacks and detect adversaries with actionable techniques that you can directly apply when you get back to work. Learn tips and tricks from the experts so that you can win the battle against the wide range of cyber adversaries that want to harm your environment.

Is SEC401: Security Essentials Bootcamp Style the right course for you?

STOP and ask yourself the following questions:

1. Do you fully understand why some organizations get compromised and others do not?
2. If there were compromised systems on your network, are you confident that you would be able to find them?
3. Do you know the effectiveness of each security device and are you certain that they are all configured correctly?
4. Are proper security metrics set up and communicated to your executives to drive security decisions?

If you do not know the answers to these questions, SEC401 course will provide the information security training you need in a bootcamp-style format that is reinforced with hands-on labs.

You Will Learn:

• To develop effective security metrics that provide a focused playbook that IT can implement, auditors can validate, and executives can understand
• To analyze and assess the risk to your environment in order to drive the creation of a security roadmap that focuses on the right areas of security
• Practical tips and tricks to focus in on high-priority security problems within your organization and on doing the right things that will lead to security solutions that work
• Why some organizations are winning and some are losing when it comes to security and, most importantly, how to be on the winning side
• The core areas of security and how to create a security program that is anchored on PREVENT-DETECT-RESPOND.

Learn to build a security roadmap that can scale today and into the future.

SEC599 aims to leverage the purple team concept by bringing together red and blue teams for maximum effect. Recognizing that a prevent-only strategy is not sufficient, the course focuses on current attack strategies and how they can be effectively mitigated and detected using a Kill Chain structure. Throughout the course, the purple team principle will be maintained, where attack techniques are first explained in-depth, after which effective security controls are introduced and implemented.

Course authors Erik Van Buggenhout & Stephen Sims (both certified as GIAC Security Experts) are hands-on practitioners who have achieved a deep understanding of how cyber attacks work through penetration testing and incident response. While teaching penetration testing courses, they were often asked “But how do I prevent this type of attack?” With more than 20 labs plus a full-day “Defend-The-Flag” exercise during which students attempt to defend our virtual organization from different waves of attacks against its environment, SEC599 gives students real world examples of how to prevent attacks.

SEC660 starts off by introducing advanced penetration concepts and providing an overview to prepare students for what lies ahead. The focus of day one is on network attacks, an area often left untouched by testers. Topics include accessing, manipulating, and exploiting the network. Attacks are performed against NAC, VLANs, OSPF, 802.1X, CDP, IPv6, VOIP, SSL, ARP, SNMP, and others. Day two starts with a technical module on performing penetration testing against various cryptographic implementations, then turns to PowerShell and post exploitation, escaping Linux restricted environments and Windows restricted desktop environments. Day three jumps into an introduction of Python for penetration testing, Scapy for packet crafting, product security testing, network and application fuzzing, and code coverage techniques. Days four and five are spent exploiting programs on the Linux and Windows operating systems. You will learn to identify privileged programs, redirect the execution of code, reverse-engineer programs to locate vulnerable code, obtain code execution for administrative shell access, and defeat modern operating system controls such as ASLR, canaries, and DEP using ROP and other techniques. Local and remote exploits as well as client-side exploitation techniques are covered. The final course day is devoted to numerous penetration testing challenges that require students to solve complex problems and capture flags.

Among the biggest benefits of SEC660 is the expert-level hands-on guidance provided through the labs and the additional time allotted each evening to reinforce daytime material and master the exercises. 

This in-depth incident response and threat hunting course provides responders and threat hunting teams with advanced skills to hunt down, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and hactivism. Constantly updated, FOR508: Advanced Incident Response and Threat Hunting addresses today’s incidents by providing hands-on incident response and threat hunting tactics and techniques that elite responders and hunters are successfully using to detect, counter, and respond to real-world breach cases.

The course uses a hands-on enterprise intrusion lab – modeled after a real-world targeted APT attack on an enterprise network and based on APT group tactics to target a network – to lead you to challenges and solutions via extensive use of the SIFT Workstation collection of tools.

During the intrusion and threat hunting lab exercises, you will identify where the initial targeted attack occurred and how the adversary is moving laterally through multiple compromised systems. You will also extract and create crucial cyber threat intelligence that can help you properly scope the compromise and detect future breaches.

During a targeted attack, an organization needs the best incident response team in the field. FOR508: Advanced Incident Response and Threat Hunting will train you and your team to respond, detect, scope, and stop intrusions and data breaches.

GATHER YOUR INCIDENT RESPONSE TEAM –

IT’S TIME TO GO HUNTING

FOR508 Incident Response and Threat Hunting Course Topics

• Advanced use of a wide range of best-of-breed open-source tools in the SIFT Workstation to perform incident response and digital forensics.
• Hunting and responding to advanced adversaries such as nation-state actors, organized crime, and hacktivists.
• Threat hunting techniques that will aid in quicker identification of breaches.
• Rapid incident response analysis and breach assessment.
• Incident response and intrusion forensics methodology. 
• Remote and enterprise incident response system analysis.
• Windows live incident response.
• Memory analysis during incident response and threat hunting.
• Detailed instruction on Windows enterprise credentials and how they are compromised.
• Internal lateral movement analysis and detection.
• Rapid and deep-dive timeline creation and analysis.
• Volume shadow copy exploitation for hunting threats and incident response.
• Detection of anti-forensics and adversary hiding techniques.
• Discovery of unknown malware on a system.
• Adversary threat intelligence development, indicators of compromise, and usage.
• Cyber-kill chain strategies.
• Step-by-step tactics and procedures to respond to and investigate intrusion cases

This course covers the tools, technology, and processes required to integrate network evidence sources into your investigations, with a focus on efficiency and effectiveness. You will leave this week with a well-stocked toolbox and the knowledge to use it on your first day back on the job. We will cover the full spectrum of network evidence, including high-level NetFlow analysis, low-level pcap exploration, ancillary network log examination, and more. We cover how to leverage existing infrastructure devices that may contain months or years of valuable evidence as well as how to place new collection platforms while an incident is already under way.

Whether you are a consultant responding to a client’s site, a law enforcement professional assisting victims of cybercrime and seeking prosecution of those responsible, an on-staff forensic practitioner, or a member of the growing ranks of “threat hunters”, this course offers hands-on experience with real-world scenarios that will help take your work to the next level. Previous SANS SEC curriculum students and other network defenders will benefit from the FOR572 perspective on security operations as they take on more incident response and investigative responsibilities. SANS Forensic alumni from 408 and 508 can take their existing knowledge and apply it directly to the network-based attacks that occur daily. In FOR572, we solve the same caliber of real-world problems without the use of disk or memory images.

The hands-on labs in this class cover a wide range of tools and platforms, including the venerable tcpdump and Wireshark for packet capture and analysis; NetworkMiner for artifact extraction; and open-source tools including nfdump, tcpxtract, tcpflow, and more. Newly added tools in the course include the SOF-ELK platform – a VMware appliance pre-configured with the ELK stack. This “big data” platform includes the Elasticsearch storage and search database, the Logstash ingest and parse utility, and the Kibana graphical dashboard interface. Together with the custom SOF-ELK configuration files, the platform gives forensicators a ready-to-use platform for log and NetFlow analysis. For full-packet analysis and hunting at scale, the Moloch platform is also used. Through all of the in-class labs, your shell scripting abilities will also be used to make easy work of ripping through hundreds and thousands of data records.

FOR572 is truly an advanced course – we hit the ground running on day one. Bring your entire bag of skills: forensic techniques and methodologies, networking (from the wire all the way up to user-facing services), Linux shell utilities, and everything in between. They will all benefit you throughout the course material as you FIGHT CRIME. UNRAVEL INCIDENTS…ONE BYTE (OR PACKET) AT A TIME.

Advanced Network Forensics: Threat Hunting, Analysis and Incident Response Course Topics:

• Foundational network forensics tools: tcpdump and Wireshark refresher
• Packet capture applications and data
• Unique considerations for network-focused forensic processes
  • Network evidence types and sources
  • Network architectural challenges and opportunities for investigators
  • Investigation OPSEC and footprint considerations
• Network protocol analysis
  • Domain Name Service
  • Hypertext Transfer Protocol
  • File Transfer Protocol
  • Microsoft protocols
  • Simple Mail Transfer Protocol
• Commercial network forensic tools
• Automated tools and libraries
• NetFlow
  • Introduction
  • Collection approaches
  • Open-source NetFlow tools
• Wireless networking
  • Capturing wireless traffic
  • Modes of wireless operation
  • Useful forensic artifacts from wireless traffic
  • Common attack methods and detection
• Log data to supplement network examinations
  • Syslog
  • Microsoft Windows Eventing
  • HTTP server logs
  • Firewalls, Intrusion Detection Systems (IDSes), and Network Security Monitoring (NSM) Platforms
  • Log collection, aggregation, and analysis
  • Web proxy server examination
• Encryption
  • Introduction
  • Man-in-the-middle
  • Secure HTTP/Secure Sockets Layer
• Deep packet work
  • Network protocol reverse engineering
  • Payload reconstruction

Laptop Requirements: A laptop capable of running a VMware virtual machine, with a DVD drive and connecting to an Ethernet network is required.

CORE NetWars Tournament participants receive 6 CPEs

CORE NetWars Tournament is a computer and network security challenge designed to test a participant’s experience and skills in a safe environment. It is accessible to a broad level of player skill ranges and is split into separate levels so that advanced players may quickly move through earlier levels to the level of their expertise.

NetWars Levels:

• Level 1 – Played on local Linux image without root
• Level 2 – Played on local Linux image with root
• Level 3 – Attack a DMZ
• Level 4 – Pivot to intranet
• Level 5 – Master of your domain… castle versus castle

Topics Include:

• Vulnerability Assessment
• Packet Analysis
• Penetration Testing
• System Hardening
• Malware Analysis

Digital Forensics and Incident Response

Who Should Attend:

• Security Professionals
• System Administrators
• Network Administrators
• Ethical Hackers
• Penetration Testers
• Incident Handlers
• Forensic Analysts
• Security auditors
• Vulnerability assessment personnel
• Security Operations Center (SOC) staff members