SEC511: SANS Dublin May 2023
Provided by SANS
What You Will Learn
Analyze Threats. Detect Anomalies. Stop Intrusions.
We continue to underestimate the tenacity of our adversaries! Organizations are investing a significant amount of time as well as financial and human resources trying to combat cyber threats and prevent cyber attacks. Despite this tremendous effort, organizations are still getting compromised. The traditional perimeter-focused, prevention-dominant approach to security architecture has failed to prevent intrusions. No network is impenetrable, a reality that business executives and security professionals alike have to accept. Prevention is crucial, and we can't lose sight of it as the primary goal. However, a new proactive approach to security is needed to enhance the capabilities of organizations to detect threats that will inevitably slip through their defenses.
SEC511: Continuous Monitoring and Security Operations will teach you how to strengthen your skills to undertake that proactive approach.
The underlying challenge for organizations victimized by an attack is timely incident detection. Industry data suggest that most security breaches typically go undiscovered for an average of seven months. Attackers simply have to find one way into most organizations, because they know that the lack of visibility and internal security controls will then allow them to methodically carry out their mission and achieve their goals.
The Defensible Security Architecture, Network Security Monitoring (NSM)/Continuous Diagnostics and Mitigation (CDM)/Continuous Security Monitoring (CSM) taught in this course will best position your organization or Security Operations Center (SOC) to analyze threats and detect anomalies that could indicate cybercriminal behavior. The payoff for this new proactive approach would be early detection of an intrusion, or successfully thwarting the efforts of attackers altogether.
SANS is uniquely qualified to offer this course. Course authors Eric Conrad (GSE #13) and Seth Misenar (GSE #28) hold the distinguished GIAC Security Expert Certification, and both are experienced, real-world, practitioners who apply the concepts and techniques they teach in this course on a daily basis. SEC511 will take you on quite a journey. We start by exploring traditional security architecture to assess its current state and the attacks against it. Next, we discuss and discover modern security design that represents a new proactive approach to such architecture that can be easily understood and defended. We then transition to how to actually build the network and endpoint security, and then carefully navigate our way through automation, NSM/CDM/CSM. For timely detection of potential intrusions, the network and systems must be proactively and continuously monitored for any changes in the security posture that might increase the likelihood that attackers will succeed.
Your SEC511 journey will conclude with one last hill to climb! The final day features a defend-the-flag competition that challenges you to apply the skills and techniques learned in the course to detect and defend the modern security architecture that has been designed. The competition has been designed to be fun, engaging, comprehensive, and challenging. You will not be disappointed!
With your training journey now complete and your skills enhanced and honed, it is time to go back to work and deliver on the SANS promise that you will be able to apply what you learn in this course the day you return to the office.
BUSINESS TAKEAWAYS:
This course will help your organization:
SEC511 employs several different hands-on tactics that go well beyond simple lecture and instructor-led discussions, here is a sampling:
A more recent development is the SEC511 Portal/Electronic Workbook available within the class virtual environment. The portal provides students with electronic versions of the workbook labs.
Shall we play a game?
The NetWars game engine now permeates every single course day! Since the launch of SEC511, students have consistently found the NetWars-based Final Capstone to be great fun. Who would have guessed that a game would be fun, right? Students' praise did not stop at "fun" - they also found the game to be a tremendously successful way to further their learning. Taking this cue, we have now incorporated a game-style environment into every day, not just day six.
What Will You Receive
Analyze Threats. Detect Anomalies. Stop Intrusions.
We continue to underestimate the tenacity of our adversaries! Organizations are investing a significant amount of time as well as financial and human resources trying to combat cyber threats and prevent cyber attacks. Despite this tremendous effort, organizations are still getting compromised. The traditional perimeter-focused, prevention-dominant approach to security architecture has failed to prevent intrusions. No network is impenetrable, a reality that business executives and security professionals alike have to accept. Prevention is crucial, and we can't lose sight of it as the primary goal. However, a new proactive approach to security is needed to enhance the capabilities of organizations to detect threats that will inevitably slip through their defenses.
SEC511: Continuous Monitoring and Security Operations will teach you how to strengthen your skills to undertake that proactive approach.
The underlying challenge for organizations victimized by an attack is timely incident detection. Industry data suggest that most security breaches typically go undiscovered for an average of seven months. Attackers simply have to find one way into most organizations, because they know that the lack of visibility and internal security controls will then allow them to methodically carry out their mission and achieve their goals.
The Defensible Security Architecture, Network Security Monitoring (NSM)/Continuous Diagnostics and Mitigation (CDM)/Continuous Security Monitoring (CSM) taught in this course will best position your organization or Security Operations Center (SOC) to analyze threats and detect anomalies that could indicate cybercriminal behavior. The payoff for this new proactive approach would be early detection of an intrusion, or successfully thwarting the efforts of attackers altogether.
SANS is uniquely qualified to offer this course. Course authors Eric Conrad (GSE #13) and Seth Misenar (GSE #28) hold the distinguished GIAC Security Expert Certification, and both are experienced, real-world, practitioners who apply the concepts and techniques they teach in this course on a daily basis. SEC511 will take you on quite a journey. We start by exploring traditional security architecture to assess its current state and the attacks against it. Next, we discuss and discover modern security design that represents a new proactive approach to such architecture that can be easily understood and defended. We then transition to how to actually build the network and endpoint security, and then carefully navigate our way through automation, NSM/CDM/CSM. For timely detection of potential intrusions, the network and systems must be proactively and continuously monitored for any changes in the security posture that might increase the likelihood that attackers will succeed.
Your SEC511 journey will conclude with one last hill to climb! The final day features a defend-the-flag competition that challenges you to apply the skills and techniques learned in the course to detect and defend the modern security architecture that has been designed. The competition has been designed to be fun, engaging, comprehensive, and challenging. You will not be disappointed!
With your training journey now complete and your skills enhanced and honed, it is time to go back to work and deliver on the SANS promise that you will be able to apply what you learn in this course the day you return to the office.
BUSINESS TAKEAWAYS:
This course will help your organization:
- Design a defensible security architecture
- Implement meaningful changes to your organization's security architectures
- Maximize the capabilities of your current information security architecture
- Understand the current state of security architecture and continuous monitoring
- Make sense of data to rapidly enable the detection of potential intrusions or unauthorized actions
- Analyze a security architecture for deficiencies
- Apply the principles learned in the course to design a defensible security architecture
- Understand the importance of a detection-dominant security architecture and Security Operations Centers (SOC)
- Identify the key components of Network Security Monitoring (NSM)/Continuous Diagnostics and Mitigation (CDM)/Continuous Monitoring (CM)
- Determine appropriate security monitoring needs for organizations of all sizes
- Implement robust Network Security Monitoring/Continuous Security Monitoring
- Determine requisite monitoring capabilities for a SOC environment
SEC511 employs several different hands-on tactics that go well beyond simple lecture and instructor-led discussions, here is a sampling:
- Egress Analysis with Elastic Stack
- Passively decrypting TLS
- DNS over HTTPS (DoH)
- PCAP carving with Zeek
- Honey Tokens
- Application Control via AppLocker
- Sysmon Merlin Analysis
- Daily Immersive Cyber Challenges (NetWars game engine)
- NetWars-based Final Capstone
A more recent development is the SEC511 Portal/Electronic Workbook available within the class virtual environment. The portal provides students with electronic versions of the workbook labs.
Shall we play a game?
The NetWars game engine now permeates every single course day! Since the launch of SEC511, students have consistently found the NetWars-based Final Capstone to be great fun. Who would have guessed that a game would be fun, right? Students' praise did not stop at "fun" - they also found the game to be a tremendously successful way to further their learning. Taking this cue, we have now incorporated a game-style environment into every day, not just day six.
What Will You Receive
- Access to custom cloud-hosted challenges to further understanding
- MP3 audio files of the complete course lecture
- Licensed Windows 10 virtual machine
- A Linux VM loaded with tons of extra logs, PCAPs, and other resources
- A Digital Download Package that includes the above and more
Enquire
| Start date | Location / delivery | |
|---|---|---|
| 15 May 2023 | Dublin | Book now |
Related article
Challenge Yourself with CyberLive
At GIAC, we believe that hands-on testing is the future of cybersecurity certification. With five certification exams featuring CyberLive , and thr...