SEC504: Hacker Tools, Techniques, and Incident Handling
SEC504Offensive Operations
Blueprint Podcast
Arm yourself with the most valuable and actionable content for advancing cyber defense skills. Hear from some truly interesting people changing the game in the blue teaming field, and ultimately learn actionable ways to take your cyber defense skills to the next level.
Josh Johnson: PowerShell for the Blue Team | 19
PowerShell may seem intimidating, but it can be one of the most amazing and useful tools at your disposal...if you know how to use it. In this episode, we have Josh Johnson giving you a masterful crash course in:The importance of PowerShellHow PowerShell works, and how to set yourself up to use itBlue team use cases for log analysis, incident response and moreHow to stopping attackers from leveraging PowerShellSome of the amazing automation and playbook opportunities you may be missing out on.Lots of actionable content for defenders here, don't miss in this episode!
Podcastblueprint
- 2021-05-11
- John Hubbard
AJ Yawn: Cloud, Compliance and Automating Security | 21
Compliance and audit checks can be painful, and that's before you introduce additional cloud services and technology. In this episode featuring AJ Yawn we discuss some incredibly useful and actionable cloud security concepts and tools that can help your team boost visibility and reduce user permissions to help prevent breaches before they happen. In addition, we discuss what a good compliance audit should be, and how to turn audits from painful to incredibly valuable. Resources mentioned in this episode: AWS CloudTrail: https://aws.amazon.com/cloudtrail AWS Well-Architected Framework: https://aws.amazon.com/architecture/well-architected AWS Config: https://aws.amazon.com/config AWS Organizations: https://aws.amazon.com/organizations AWS Service Control Policies (SCP): https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
Podcastblueprint
- 2021-05-25
- John Hubbard
Mick Douglas & Flynn Weeks: Simplifying your Logging Strategy with the What2Log Project | 17
A common question from many defenders is "Which logs are the most important?" In this episode, Mick Douglas and Flynn Weeks join us to describe their What2Log project, which aims to simplify this problem for all of us!
Podcastblueprint
- 2021-04-27
- John Hubbard
Jamie Williams: Adversary Emulation | 20
There are numerous ways to test your SOC's detection and prevention capabilities, but not all are created equal. Each has their own strengths and weaknesses, and can be done on a different time scale. This week, we focus on arguably one of the most important - adversary emulation. In this episode we speak with Jamie Williams from the MITRE ATT&CK team about why adversary emulation is important, how it works, how you can get started regardless of the size of your team, and how to track and run an adversary emulation test.
Podcastblueprint
- 2021-05-18
- John Hubbard
John Hubbard: Your Top Cyber Defense Questions Answered from Seasons 1 + 2 | 24
It's a special mailbag episode from John Hubbard! After two full seasons, John asks listeners what questions they have for him. In answering, he touches on the current XDR trend, how other teams can support SOC activities, defining security mindset, and more.
Podcastblueprint
- 2022-06-30
- John Hubbard
Strategy 3: Build a SOC Structure to Match Your Organizational Needs | 41
In this episode we discuss how to decide on the right org structure and capabilities of your SOC. This includes questions like tiered vs. tierless models, which capabilities the SOC should focus on, centralized vs. distributed SOCs, outsourcing of duties and staff augmentation considerations, and also where the SOC might sit in the larger chart of your organization. Every SOC needs to be tailored to best meet the mission, and chapter 3 - "Build a SOC Structure to Match Your Organizational Needs" will help you get there.This special season of the Blueprint Podcast is taking a deep dive into MITRE’s 11 Strategies of a World-Class Cyber Security Operations Center. Each episode John will break down a chapter of the book with the book’s authors Kathryn Knerler, Ingrid Parker, and Carson Zimmerman.
Podcastblueprint
- 2023-05-22
- John Hubbard
Brandon Evans: Cloud Security - Threats and Opportunities | 37
Ever wonder how a cloud and application security expert views risks of cloud workloads? Well, wonder no more because on this episode we have Brandon Evans - SANS Certified Instructor and lead author of SEC510: Public Cloud Security. We cover the why and how of moving their applications to the cloud, the key considerations for a successful cloud security posture, and how building your infrastructure with a cloud-native mindset can and should lead to an improved security posture. BONUS: Be sure to stay tuned to the end of the episode for a very special announcement from Brandon on the new SANS Cloud Ace podcast. Coming to all podcast directories on September 28.
Podcastblueprint
- 2022-09-13
- John Hubbard
Anton Chuvakin: The Current State and Future of Security Operations | 16
In today's episode, John is joined by Anton Chuvakin to discuss current and future security operations technology, which tools are the most important and which are becoming less important over time, the rules of automation in the SOC and how Anton would setup a modern Security Operations Center for a Cloud native organization.
Podcastblueprint
- 2021-04-20
- John Hubbard
Privacy Laws: The Future Driver of Cyber Security | 04
Mary Chaney shares what types of cyber laws we should be concerned about. She discusses her thoughts on privacy laws and how that will drive cyber security, and what she's doing to get more diverse representation in the industry at all levels.
Podcastblueprint
- 2020-06-30
- John Hubbard
Bonus Episode: What does it take to author a cybersecurity book?
Have you ever wondered what it takes to write and publish an information security book? In this special bonus episode following season 4, John discusses with Kathryn, Ingrid, and Carson the challenges and rewards of self-publishing, and the kind of effort that goes into producing a book like "11 Strategies of a World-Class Cybersecurity Operations Center".
Podcastblueprint
- 2023-08-03
- John Hubbard
Mark Orlando: Building a Stronger Blue Team | 29
There are many technical factors that contribute to the success of a security operations team, but you need more than just tech skills for mounting a solid defense. In this episode of Blueprint we bring back previous guest Mark Orlando to talk about his BlackHat 2022 presentation with Dr. Daniel Shore (PhD in workplace psychology). We discuss team dynamics, how the mapping of multi-team systems can improve the flow of your incident response activities, and much more.
Podcastblueprint
- 2022-07-19
- John Hubbard
Introducing Blueprint
Blueprint brings you the latest in cyber defense and security operations from top blue team leaders. Blueprint is brought to you by the SANS Institute and is hosted by SANS Certified Instructor John Hubbard.
Podcastblueprint
- 2020-06-09
- John Hubbard