cloud-attacks-detections-sec541

SEC541: Cloud Security Attacker Techniques, Monitoring, and Threat Detection now spans across 5 comprehensive sections. The course remains focused on providing in-depth case studies of cloud attacks, equipping learners with the ability to employ cloud services for investigating suspicious activities within their cloud infrastructure, and imparting the necessary skills to security analysts and detection engineers for creating a top-tier detection and response program. With this expansion, students can expect an even more extensive and immersive learning experience that will prepare them to tackle complex cloud security challenges with confidence.

As part of the expanded 5-section course, we have introduced a dedicated section that delves into the unique aspects of the Azure environment. Here, you will learn how to investigate data collected from Microsoft 365 Exchange and Azure Active Directory using cutting-edge techniques. You will also become proficient in using the Azure CLI, as well as leveraging powerful tools like Microsoft Defender for Cloud and Sentinel. Additionally, you will learn about the Kusto Query Language, which is a powerful tool for analyzing large datasets in Azure. To further enhance your skills, you will also gain hands-on experience building automated response actions to accelerate investigations and strengthen your security posture. By the end of this section, you will be well-equipped to handle any security challenge with confidence.

SEC541 starts each section with a case study walkthrough of an attack campaign against a cloud infrastructure. We break down how it happened, what made it successful, and what could have been done to catch the attackers in the act.

"I enjoyed understanding the real life use cases for each of the topics and how it linked with a known attack (Capital One)." - Shakiya Linley, JP Morgan Chase

After dissecting the attacks, we learn how to leverage cloud-native and cloud-integrated capabilities to detect, threat hunt, or investigate similar attacks in a realistic environment, and build our arsenal of analytics, detections, and best practices. "Using the labs was easy with well documented instructions. I like the fact that I could easily copy and paste the commands. This helps me to get through the lab fast but I also know that I can come back later after the course and take the time to review each command." - Ludek Suk, Accenture

The class culminates with a CloudWars challenge: a capture-the-flag style event where individuals or teams are faced with challenges from throughout the week. 

The winning team will get to take home theSEC541 challenge coin! 

SYLLABUS SUMMARY:

• Section 1: Detecting adversarial activity in your cloud environment through management plane and network logging & analysis.
• Section 2: Dig deeper into your applications and compute systems running within the cloud environment.
• Section 3: Understanding your deployed cloud environment to easily identify deviation from organizational policy and potential malice.
• Section 4: Deep dive into Azure's ecosystem and the unique threats that can occur.
• Section 5: Learn to automate response actions in your cloud environment and put your new skills to the test in a Capture the Flag event.

SKILLS LEARNED:

• Research attacks and threats to cloud infrastructure and how they could affect you
• Break down a threat into detectable components
• Effectively use AWS and Azure core logging services to detect suspicious behaviors
• Make use of cloud native API logging as the newest defense mechanism in cloud services
• Move beyond the cloud-provided Graphic User Interfaces to perform complex analysis
• Perform network analysis with cloud-provided network logging
• Understand how application logs can be collected and analyzed inside the cloud environment
• Effectively put into practice the AWS and Azure security specific services
• Integrate container, operating system, and deployed application logging into cloud logging services for more cohesive analysis
• Centralize log data from across your enterprise for better analysis
• Perform inventory of cloud resources and sensitive data using scripts and cloud native tooling
• Analyzing Microsoft 365 activity to uncover threats
• Ability to leverage cloud native architecture to automate response actions to attacks

BUSINESS TAKEAWAYS:

• Decrease the average time an attacker is in your environment
• Demonstrate how to automate analytics, thus reducing time
• Help your organization properly set up logging and configuration
• Decreases risk of costly attacks by understanding and leveraging cloud specific security services
• Lessen the impact of breaches that do happen
• Learn how to fly the plane, not just the ability to read the manual

SEC541 is available In Person, Live Online, or OnDemand

Learn more about the course and registration options at sans.org/sec541.