SEC504: Hacker Tools, Techniques, and Incident Handling

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usConnect, learn, and share with other cybersecurity professionals
Engage, challenge, and network with fellow CISOs in this exclusive community of security leaders
Become a member for instant access to our free resources.
Sign UpMission-focused cybersecurity training for government, defense, and education
Explore industry-specific programming and customized training solutions
Sponsor a SANS event or research paper
We're here to help.
Contact UsApply your credits to renew your certifications
Attend a live, instructor-led class from a location near you or virtually from anywhere
Course material is for individuals with an understanding of IT or cyber security concepts
Apply what you learn with hands-on exercises and labs
Gain essential cybersecurity skills to quickly detect, respond to, and remediate threats. Learn how to protect critical information and technology assets, whether on-premises or in the cloud.
Overall, my learning experience was vital, and I see practical steps and methods that I can use when I start back work. This course changed my perspective on Cyber Security and I’m thankful for the opportunity to be around leaders in the industry.
Information security is about focusing your defenses on the areas that matter most, particularly as they relate to the unique needs of your organization. In SEC401J: Security Essentials - Network, Endpoint, and Cloud (Japanese), you'll learn foundational knowledge in information security, focusing on network, endpoint, and cloud defenses tailored to organizational needs. The course covers detecting and responding to threats to secure systems effectively and minimize impact.
The SEC401J course teaches you the most effective steps to prevent attacks and detect adversaries, equipping you with actionable techniques you can immediately apply in your workplace. Through practical tips and insights, you'll be better prepared to win the ongoing battle against a broad range of cyber adversaries who seek to infiltrate your environment.
Bryan Simon, a SANS Senior Instructor and author of SEC401, has been involved in cybersecurity since 1991. He’s the president of Xploit Security Inc., and has taught cybersecurity students from organizations like the FBI, NATO, and UN.
Read more about Bryan SimonExplore the course syllabus below to view the full range of topics covered in SEC401J: Security Essentials - Network, Endpoint, and Cloud (Japanese).
This section covers the need for a defensible network architecture, emphasizing timely threat detection, sensitive data protection, and understanding protocol vulnerabilities. It also explores cloud security, AI, and adversarial tactics, equipping students with foundational knowledge in network, cloud, AI, and wireless security.
This section addresses large-scale threats and defense-in-depth strategies, focusing on IAM, authentication, and password security as key components of cloud security. It covers frameworks like CIS, NIST, and MITRE ATT&CK® for network and data protection, and explores mobile device security, including BYOD and MDM.
This section covers identifying vulnerabilities and establishing a vulnerability assessment program, with a focus on modern attack methods and web application security. It also addresses detecting post-compromise actions through effective logging, followed by guidance on incident response planning.
This section explores cryptography as a key security tool, covering essential concepts to protect organizational assets. It then examines prevention and detection technologies, like firewalls, intrusion prevention, and detection systems, focusing on their application at both network and endpoint levels.
This section covers the essentials of Windows security, addressing modern complexities like Active Directory, PKI, BitLocker, and endpoint security. It provides tools for streamlining and automating security tasks across both on-premises and Azure environments, equipping you with a strong foundation in Windows security, automation, and auditing.
This section provides practical guidance on securing Linux systems, catering to both beginners and advanced administrators. It covers Linux security fundamentals, including containerization for cloud computing, and concludes with a review of macOS security, clarifying its capabilities and limitations within a UNIX-based environment.
Responsible for analyzing data from multiple disparate sources to provide cybersecurity and privacy insight. Designs and implements custom algorithms, workflow processes, and layouts for complex, enterprise-scale data sets used for modeling, data mining, and research purposes.
Explore learning pathManages and maintains databases or data systems for efficient storage, querying, and access to organizational data assets and records.
Explore learning pathDelivers technical support to users, helping them resolve issues with client hardware/software according to organizational service processes.
Explore learning pathOversees full lifecycle of information systems from design through evaluation, ensuring alignment with functional and operational goals.
Explore learning pathResponsible for managing a portfolio of technology investments that align with the overall needs of mission and enterprise priorities.
Explore learning pathResponsible for developing, planning, coordinating, and evaluating cybersecurity awareness, training, or education content, methods, and techniques based on instructional needs and requirements.
Explore learning pathResponsible for planning, implementing, and operating network services and systems, including hardware and virtual environments.
Explore learning pathImplements and maintains network services, including hardware and virtual systems, ensuring operational support for infrastructure platforms.
Explore learning pathResponsible for developing and analyzing the integration, testing, operations, and maintenance of systems security. Prepares, performs, and manages the security aspects of implementing and operating a system.
Explore learning pathPlans and executes system tests, analyzing results to verify compliance with technical and operational requirements and expectations.
Explore learning pathDevelops business and IT process architectures, creating baseline and target architectures to meet mission or enterprise goals.
Explore learning pathResponsible for conducting independent comprehensive assessments of management, operational, and technical security controls and control enhancements employed within or inherited by a system to determine their overall effectiveness.
Explore learning pathResponsible for administering databases and data management systems that allow for the secure storage, query, protection, and utilization of data.
Explore learning pathResponsible for testing, implementing, deploying, maintaining, and administering infrastructure hardware and software for cybersecurity.
Explore learning pathTranslates functional needs into technical solutions by consulting with customers and developing system architectures and requirements.
Explore learning pathResponsible for analyzing data collected from various cybersecurity defense tools to mitigate risks.
Explore learning pathAs this is one of the highest-paid jobs in the field, the skills required to master the responsibilities involved are advanced. You must be highly competent in threat detection, threat analysis, and threat protection. This is a vital role in preserving the security and integrity of an organization’s data.
Explore learning pathMonitors cyber defense tools like IDS and logs to analyze network events, identifying and mitigating potential threats to security environments.
Explore learning pathResponsible for providing technical support to customers who need assistance utilizing client-level hardware and software in accordance with established or approved organizational policies and processes.
Explore learning pathAdd a GIAC certification attempt and receive free two practice tests. View pricing in the info icons below.
When purchasing a live instructor-led class, add an additional 4 months of online access after your course. View pricing in the info icons below.
Please try a different combination of filters and search again.
SEC401 gives you a fantastic knowledge base to build on, and I would say it's essential for anyone working in cybersecurity.
Excellent material for security professionals wanting a deeper level of knowledge on how to implement security policies, procedures, and defensive mechanisms in an organization.
SEC401 has been an excellent experience all around. It is content-heavy and rich, and regardless of your technical ability and experience, you will leave with a far better understanding of many aspects of cybersecurity.
Get feedback from the world’s best cybersecurity experts and instructors
Choose how you want to learn - online, on demand, or at our live in-person training events
Get access to our range of industry-leading courses and resources