SEC598: SANS October Singapore 2024

What You Will Learn
The machines aren't taking over. You are!

Mastering automation workflows is a force multiplier for security teams. As the scope of work increases in both volume and complexity across today's modern enterprise, security teams find themselves in an uphill battle to prevent, detect, emulate, and respond to threats against their organization.

To combat this ongoing issue, world-class security teams have learned to unleash the power of automation. Highly skilled security and automation engineers are able to implement solutions that allow their teams to shift their daily focus away from high-volume, low priority tasks to business critical, high-priority initiatives.

Over the span of this course, you will interact with a real-world fictitious organization, GLOBEX, where you'll interact with over 15 lab exercises and a capstone centered on security automation use cases that you can take back and implement within your own organization.
You Will Be Able To

• Translate repeatable activities into automated tasks
• Automate prevention, detection, and response capabilities for specific attack techniques used by real-world adversaries and red teamers
• Improve the effectiveness of your SOC by uncovering opportunities for efficiencies across tier 1 and tier 2 responsibilities
• Leverage technologies such as Terraform, Ansible, Chef, Puppet, and SOAR tools to automate secure configurations, set a desired-state configuration, deploy infrastructure as code in different environments, and detect and respond to security incidents
• Implement cloud security automation in AWS and Azure
• Create a continuous, automation-enhanced approach to purple teaming

Skills Learned

• Understand the security issues that most organizations are facing today.
• Translate security issues into smaller problems, define automated solutions for those specific problems, and then fully chain features that can be used to tackle multiple issues in an automated manner.
• Use tools like Terraform, Ansible, CHEF Puppet, and many more to locally automate secure configurations, set a desired-state configuration, deploy infrastructure as code in different environments, and detect and respond to security incidents in an automated manner.
• Evaluate real-world scenarios within a combination of on-premise and cloud environments using a reference framework that can be immediately used and implemented in your organization.

What You Will Receive

• Access to the in-class Virtual Training Lab for over 30 in-depth labs.
• A course USB with many tools used for all in-house labs.
• Virtual machines full of penetration testing tools and specimens specially calibrated and tested to work with all our labs and optimized for use in your own penetration tests.
• Access to recorded course audio to help hammer home important network penetration testing lessons.

Additional Resources

• Purple Concepts: Bridging The Gap, Poster
• Mastering Adversary Emulation with Caldera: A Practical Guide, Webcast