SEC504: Hacker Tools, Techniques, and Incident Handling
SEC504Offensive Operations
Cybersecurity Webinars and Workshops
Unlock industry insights and hands-on learning with upcoming SANS webcasts and workshops. View archived webcasts here.
2024 SANS ICS Water Cybersecurity Survey Insights: Strengthening the Security of Water and Wastewater Utilities
Join Our Webcast on Enhancing Water and Wastewater Utility Security This webcast will dive into the key findings of a critical survey assessing the safety and security challenges in the water and wastewater utility sector. With a focus on Industrial Control Systems (ICS), SCADA, and Distributed Control Systems (DCS) used in water treatment and distribution, we’ll explore emerging trends, highlight survey results, and share best practices to strengthen security measures. Don’t miss this opportunity to gain valuable insights tailored to the unique needs of water and wastewater organizations.
WebinarIndustrial Control Systems Security
- 23 Jan 2025
- 13:00 UTC
- Dean Parsons
Take the First Step in ICS/OT Security with ICS310
Discover how the new ICS310: ICS Cybersecurity Foundations course is transforming the way professionals enter the critical field of ICS/OT cybersecurity. The world relies on critical infrastructure for all aspects of daily life, and sectors across the board have integrated Industrial Control Systems (ICS) and Operational Technology (OT) into their key operations. This evolution has created a pressing need for a uniquely skilled, diverse workforce equipped with expertise in engineering, operations, IT/OT, and cybersecurity.
WebinarIndustrial Control Systems Security
- 24 Jan 2025
- 15:00 UTC
- Robert M. Lee, Tim Conway & Jeffrey Shearer
SANS CTI Summit Solutions Track 2025 | Day 1
As cyber threats grow in sophistication and scale, organizations must rely on actionable, contextualized Cyber Threat Intelligence (CTI) to secure operations, mitigate risks, and meet evolving business or mission objectives. Yet, CTI professionals face significant challenges, from filtering actionable insights from overwhelming volumes of data to countering rapidly evolving threat tactics like AI-driven attacks and fileless malware. Limited skilled resources, siloed systems, and the increasing sophistication of threat actors further compound the complexities of building effective CTI programs. The CTI Summit Solutions Track 2025 will address these pressing issues. Through expert-led sessions and real-world case studies, the summit will explore solutions for overcoming common obstacles, such as integrating CTI into existing security infrastructures, ensuring timely dissemination of intelligence, and fostering collaboration through standardized frameworks. Presentations will also highlight strategies for bridging the skills gap, aligning CTI outputs with business objectives, and combating adversaries’ use of advanced automation. Whether you are a CISO, SOC manager, threat hunter, or analyst, this summit offers the tools, knowledge, and strategies to turn CTI challenges into opportunities for a stronger, more adaptive cybersecurity posture. Join us for part one of this virtual event to learn how cutting-edge solutions and collaborative approaches transform CTI into a critical enabler of cyber resilience.
WebinarDigital Forensics and Incident Response
- 27 Jan 2025
- 10:30 UTC
- Douglas McKee
SANS CTI Summit Solutions Track 2025 | Day 2
As cyber threats grow in sophistication and scale, organizations must rely on actionable, contextualized Cyber Threat Intelligence (CTI) to secure operations, mitigate risks, and meet evolving business or mission objectives. Yet, CTI professionals face significant challenges, from filtering actionable insights from overwhelming volumes of data to countering rapidly evolving threat tactics like AI-driven attacks and fileless malware. Limited skilled resources, siloed systems, and the increasing sophistication of threat actors further compound the complexities of building effective CTI programs.The CTI Summit Solutions Track 2025 will address these pressing issues. Through expert-led sessions and real-world case studies, the summit will explore solutions for overcoming common obstacles, such as integrating CTI into existing security infrastructures, ensuring timely dissemination of intelligence, and fostering collaboration through standardized frameworks. Presentations will also highlight strategies for bridging the skills gap, aligning CTI outputs with business objectives, and combating adversaries’ use of advanced automation.Whether you are a CISO, SOC manager, threat hunter, or analyst, this summit offers the tools, knowledge, and strategies to turn CTI challenges into opportunities for a stronger, more adaptive cybersecurity posture. Join us to learn how cutting-edge solutions and collaborative approaches transform CTI into a critical enabler of cyber resilience.
WebinarDigital Forensics and Incident Response
- 28 Jan 2025
- 10:30 UTC
- Douglas McKee
Offensive Security Operations with Attack Surface Management and Continuous Pen Testing
How does Continuous Attack Surface Management help disrupt Nation State hackers and cyber criminals?
WebinarOffensive Operations
- 29 Jan 2025
- 11:00 UTC
- Chris Dale
OSINT at Scale: Using AI Computer Vision Agents to Assist Investigations
OSINT (and forensics) analysts frequently must sort through hundreds of gigabytes of images or movies to find interesting data. Using open source tooling, Mick will show how to create an AI agent that will summarize and search through images and movies. Attendees will learn how to create a working AI solution that can help them solve major problems in this space.
WebinarOpen-Source Intelligence
- 3 Feb 2025
- 18:00 GMT
- Mick Douglas
Security + Architecture = ENTERPRISE SECURITY ARCHITECTURE
In this presentation we investigate how the term Enterprise Security Architecture and Enterprise Security Architect came about. We will be discussing the attributes of the field of Enterprise Security Architecture. What it is. Where it originated, and how it is being applied today.
WebinarSecurity Awareness
- 10 Feb 2025
- 17:30 AST
- Mark Williams
How CISOs Can Break the Curse of Knowledge
In this webinar, Russell Eubanks addresses a common challenge CISOs face: the Curse of Knowledge. Drawing inspiration from the work of Chip and Dan Heath, as featured in their article "What is the Curse of Knowledge?" in their Harvard Business Review. Russell highlights how deep expertise can unintentionally become a barrier to clear communication and leadership. The Heath brothers explain, "Once we know something—we find it hard to imagine not knowing it. Our knowledge has ‘cursed’ us. We have difficulty sharing it with others because we can’t readily re-create their state of mind."
WebinarCybersecurity Leadership
- 11 Feb 2025
- 10:00 UTC
- Russell Eubanks
SANS 5 ICS Critical Controls for Electric: Control 3 - ICS Network Visibility & Monitoring
Module 3 of the training focuses on network visibility and monitoring. The training module provides your operational and IT team with a foundational knowledge of techniques and benefits for this critical control. This control requires human intelligence and resources. Mature organizations use network visibility tools across their systems to identify opportunities for efficiency and vulnerabilities. Network visibility and monitoring benefits include safety asset identification, engineering asset identification, vulnerability detection, operational safety and reliability, and engineering troubleshooting.
WebinarIndustrial Control Systems Security
- 11 Feb 2025
- 13:00 UTC
- Dean Parsons
SANS 5 ICS Critical Controls for Electric: Control 1 - ICS-Specific Incident Response Plan
The first training module for the electric sector provides an overview of the elements of an ICS Specific Incident Response Plan, how it differs from a standard IT Incident Response Plan, and how to prepare your team to respond. An ICS-specific incident response plan requires the following: • Enriched insights from engineering operations • Specific to the power grid operations • Emphasis on control system integrity and engineering recovery capabilities in the face of an attack on any aspect of the engineering process. Not only should the plan exist, but it also must be tested to ensure its effectiveness and engineering preparedness for cyber risk scenarios unique to ICS operations and the physical process. This module will dive into how an informed incident response plan increase system integrity and speed up recovery during an attack.
WebinarIndustrial Control Systems Security
- 11 Feb 2025
- 13:00 UTC
- Dean Parsons
SANS 5 ICS Critical Controls for Electric: Control 2 - ICS Defensible Control System Network Architecture
Nearly 40% of ICS environment compromises come from the IT business network that allows a threat into the ICS environment. So, it’s more important than ever to focus on the ICS perimeter defenses first, followed closely by the additional required segmentation within the ICS network itself. An ICS DMZ introduces additional layers of protection and is therefore a must-have. An ICS DMZ acts as a buffer between the internal industrial network and external entities such as corporate networks or the internet. Network architecture can support effective network segmentation, visibility of control system traffic for analysis, detection of threats, log collection, asset identification, industrial control systems DMZ, and enforcement zones. Through the right architecture, you can improve safety and system integrity.
WebinarIndustrial Control Systems Security
- 11 Feb 2025
- 13:00 UTC
- Dean Parsons
SANS 5 ICS Critical Controls for Electric: Control 5 - Risk-Based ICS Vulnerability Management
The 5th and final Module of the cybersecurity series on ICS Critical Controls for the Electric Sector focuses on understanding and managing risk. A successful ICS cybersecurity strategy balances defense and offense. A mature vulnerability management program must consider many factors. It should focus on strategically patching vulnerabilities, implementing safety-informed mitigations to mitigate potential impacts, and actively monitoring for signs of pre-attack positioning from within the control network. But that’s only part of a risk-based vulnerability management program for ICS. This training module describes how organizations can identify vulnerabilities by understanding adversaries. This module will include safe and informed mitigation, workarounds, and monitoring for attack preposition and pre-exploitation attack attempts. It will be complete with a nuanced discussion of the probability of exploitation, where, and how an adversary gets into the system.
WebinarIndustrial Control Systems Security
- 11 Feb 2025
- 13:00 UTC
- Dean Parsons