SEC598: Security Automation for Offense, Defense, and Cloud

Section one lays the foundation for the remainder of the course by explaining overall security automation concepts and how they can be used within different environments and technology stacks. Concepts to be discussed include automation triggers, desired state configuration and security automation.

Here we focus on infrastructure security task automation, exploring scripting, configuration management, and orchestration tools. Participants will learn PowerShell's role in desired state configuration, infrastructure as code strategies, and developing comprehensive incident handling playbooks.

For section three we transition to cloud-native automation, providing in-depth exploration of cloud technologies for security automation. Emphasizes blueprinting, compliance validation, and automated remediation using real-world cloud misconfiguration scenarios.

In section four, we will use the automation techniques we learned in previous sections for offensive security automation activities. This section presents examples on how to automate offensive techniques used by real-world adversaries and goes on to explain how chaining attack techniques can be used to emulate these adversaries.

Section five focuses on defensive security controls and how we use automation to prevent, detect, and respond to security incidents. Students will gain an in-depth understanding of how attacks can be detected and how to enrich incidents to minimize false positives and automatically trigger responses.

The last section involves our culminating competitive event, allowing participants to apply comprehensive course learnings through challenging, hands-on missions designed to validate and refine security automation skills.