SEC541: Cloud Security Threat Detection

The course begins with an investigation of a real-world cloud attack, breaking down the tactics and demonstrating how to monitor cloud management APIs. Students will analyze API logs, implement network monitoring, and develop detection strategies for unauthorized activities in cloud environments.

Students focus on monitoring compute resources including virtual machines, containers, and serverless functions. Participants then analyze the Tesla Kubernetes attack, implement logging for compute environments, and develop detection strategies for abnormal behavior patterns in cloud workloads.

Students learn to implement and leverage cloud-native detection services, discovering the best ways to conduct resource inventory, identify sensitive data in unauthorized locations, and centralize security data for comprehensive threat monitoring across cloud environments.

Students examine Microsoft 365 and Azure-specific detection capabilities. This section concentrates on techniques to investigate Exchange attacks, utilize Kusto Query Language for log analysis, and implement Microsoft Defender and Sentinel for comprehensive threat detection in Microsoft cloud environments.

Students will begin by automating incident response in cloud environments, and then culminate the course by participating in the CloudWars Challenge. Learners come away with strategies to implement automated forensic workflows, and develop skills in a capstone exercise designed to test their ability to detect and respond to cloud-based threats.