MGT551: SANS Security Leadership 2022

Provided by

What You Will Learn

Information technology is so tightly woven into the fabric of modern business that cyber risk has become business risk. SOC teams are facing more pressure than ever before to help manage this risk by identifying and responding to threats across a diverse set of infrastructures, business processes, and users. Furthermore, SOC managers are in the unique position of having to bridge the gap between business processes and the highly technical work that goes on in the SOC. Managers must show alignment to the business and demonstrate real value - a challenge when the threats are constantly changing and sometimes unseen. How do we know our security teams are aligned to the unique threats facing our organization? How do we get consistent results and prove that we can identify and respond to threats in time to minimize business impact? And how can we build an empowering, learning environment where analysts can be creative and solve problems while focusing on the mission at hand?

MGT551 bridges this gap by giving students the technical means to build an effective defense and the management tools to build an effective team. From section one of this training, students will learn how to design their defenses around their unique organizational requirements and risk profile. They will learn how to combine SOC staff, processes, and technology in a way that promotes measurable results and covers all manner of infrastructure and business processes. Most importantly, they will learn how to keep the SOC growing, evolving, and improving over time.

Throughout this course, students can expect to learn key factors for success in managing a Security Operations Center (SOC), including:
  • Collecting the most important logs and network data
  • Building, training, and empowering a diverse team
  • Creating playbooks and managing detection use cases
  • Using threat intelligence to focus your budget and detection efforts
  • Threat hunting and active defense strategies
  • Efficient alert triage and investigation workflow
  • Incident response planning and execution
  • Choosing metrics and long-term strategy to improve the SOC
  • Team member training, retention, and prevention of burnout
  • SOC assessment through capacity planning, purple team testing, and adversary emulation
NOTICE TO STUDENTS
  • MGT551 has expanded from 2 days to 5 days. Days 1 & 2 remain largely the same with Days 3-5 being additional content.
  • We are often asked how SEC450 and MGT551 are different. Here are the primary differences:
LAB INFORMATION

While this course is focused on management and leadership, it is by no means limited to non-technical processes and theory. Throughout the five days of instruction, students will work on fifteen hands-on exercises covering everything from playbook implementation to use case database creation, attack and detection capability prioritization and visualization, and purple team planning, threat hunting, and reporting. Plus, students will have the opportunity to participate in a brand new iteration of Cyber42 Cybersecurity Leadership Simulation built specifically for MGT551! Attendees will leave with a framework for understanding where their SOC should be focusing its efforts, how to track and organize defensive capabilities, and how to drive, verify, and communicate SOC improvements.

WHAT YOU WILL RECEIVE
  • Custom distribution of the Linux Virtual Machine containing free open-source SOC tools
  • MP3 audio files of the complete course lecture
  • Printed and Electronic Courseware
  • A digital download package that includes the above and more
ADDITIONAL RESOURCES
  • Operational Cybersecurity Executive Triad
  • Rekt Casino Hack Assessment Operational Series: Security Operations Center Ill-equipped and Unprepared Part 3 of 4
  • Rekt Casino Hack Assessment Operational Series: Putting It All Together Part 4 of 4
  • Guide to Security Operations poster
WHAT TO TAKE NEXT
  • MGT516: Managing Security Vulnerabilities: Enterprise & Cloud
  • SEC566: Implementing and Auditing the Critical Security Controls

Related article

At GIAC, we believe that hands-on testing is the future of cybersecurity certification. With five certification exams featuring CyberLive , and thr...