SEC501: Advanced Security Essentials - Enterprise Defender™

Overview

Proper design and configuration of network devices protects both the components being configured and the rest of the enterprise that depends on those devices to defend other components from attacks. In other words, a good house needs a good foundation!

In this course section we will discuss published security benchmarks, vendor guidance to secure various products, and regulatory requirements and how they impact defending infrastructure against specific attacks. To illustrate these points, we will look in detail at securing and defending a router infrastructure against a number of device- and network-based attacks. Securing private and public cloud infrastructure against common attacks will also be discussed.

Exercises

• Initial Router Configuration and Audit
• Securing AAA
• Securing Redundancy Protocols
• Log Infrastructure in Defense
• Defending Routing Protocols
• Final Router Hardening Steps/Audit

Topics

• Security Standards and Audit
• Authentication, Authorization, and Accounting
• Defending Network Infrastructure
• Name Resolution Attacks and Defense
• Securing and Defending Private and Public Cloud Infrastructure

Overview

Security is all about understanding, mitigating, and controlling the risk to an enterprise's critical assets. An enterprise must understand the changing threat landscape and have the capacity to compare it against its own vulnerabilities that could be exploited to compromise the environment. This course section will present the variety of tests that can be run against an enterprise, and show how to perform effective penetration tests to better understand the security posture for network services, operating systems, and applications. In addition, we will talk about social engineering and open-source intelligence activities to better emulate increasingly prevalent threats to users.

Finding basic vulnerabilities is easy but not necessarily effective if these are not the vulnerabilities attackers exploit to break into a system. Advanced penetration testing involves understanding the variety of systems and applications on a network and how they can be compromised by an attacker. Students will learn to scope and plan their test projects, perform external and internal network penetration testing and web application testing, and pivot through the environment like real-world attackers. And while penetration testing is critical to identify an enterprise's exposure points, students will also learn how to prioritize and fix these vulnerabilities to increase the enterprise's overall security.

Exercises

• Network Scanning Fundamentals
• Scanning with Nessus
• Exploitation and Metasploit Basics
• Post-Exploitation and Pivoting
• Basic Web App Scans and Attacks

Topics

• Penetration Testing Scoping and Rules of Engagement
• Open-Source Intelligence
• Social Engineering
• Network Mapping and Scanning Techniques
• Enterprise Vulnerability Scanning
• Network Exploitation Tools and Techniques
• Post-Exploitation and Pivoting
• Web Application Exploitation Tools and Techniques
• Reporting and Debriefing

Overview

Traffic analysis and intrusion detection used to be treated as a separate discipline within many enterprises. Today, prevention, detection, and response must be closely knit, so that once an attack is detected, defensive measures can be adapted and proactive forensics implemented so the enterprise can continue to operate. This course section will start with a brief introduction to network security monitoring, followed by a refresher on network protocols, with an emphasis on fields to look for as security professionals. We will use tools such as tcpdump and Wireshark to analyze packet traces and look for indicators of attacks. We will also use a variety of detection and analysis tools as well as explore Snort as a Network Intrusion Detection System and examine rule signatures in-depth., Students will also conduct network forensics, and make use of the SOF-ELK platform to demonstrate the power of Security Information and Event Management tools.

Exercises

• Analyzing PCAPs with tcpdump
• Attack Analysis with Wireshark
• Snort Basics
• Detecting Malicious Activity with Security Onion
• Security Analytics with SOF-ELK

Topics

• Network Security Monitoring
• Advanced Packet Analysis
• Network Intrusion Detection/Prevention
• Writing Signatures for Detection
• Network Forensics and More
• Event Management Introduction
• Continuous Monitoring
• Logging and Event Collection and Analysis
• SIEM and Analytics

Overview

Enterprises rely on their CERT/CSIRT to find, scope, contain, and eradicate evil from their networks. Incident investigators employ DFIR practices to determine what happened: DFIR teams conduct investigations to find evidence of compromise, remediate the environment, and provide data to generate local threat intelligence for operations teams in order to continuously improve detection. While traditionally seen as a finite process, incident response is now viewed as ongoing, with DFIR professionals searching for evidence of an attacker that has existed in the environment without detection by applying new threat intelligence to existing evidence. This is the crux of the concept known as "threat hunting."

This section begins with a discussion of Active Defense approaches in some detail, then presents the core concepts of DFIR. We will explore some of the hundreds of artifacts that can give forensic investigators specific insight about what occurred during an incident. Students will learn how incident response currently operates, after years of evolving, in order to address the dynamic procedures used by attackers to conduct their operations. We will also look at how to integrate DFIR practices into a continuous security operations program. Next, a cyclical, six-step incident response process is presented. Each step will be examined in detail, including practical examples of how to apply it. Finally, students will learn about the artifacts that can best be used to determine the extent of suspicious activity within a given environment and how to migrate techniques to a large data set for enterprise-level analysis.

Exercises

• Active Defense: Honeyports
• Data Recovery with FTK Imager and Photorec
• Discovering Artifacts
• Ransomware Timeline Analysis of Ransomware
• Ransomware Network Analysis of Ransomware

Topics

• Active Defense
• DFIR Core Concepts: Digital Forensics
• DFIR Core Concepts: Incident Response
• Modern Digital Forensics & Incident Response
• Widening the Net: Scaling and Scoping

Overview

Malicious software is responsible for many incidents in almost every type of enterprise. Types of malware vary widely, from Ransomware and Rootkits to Crypto Currency Miners and Worms. In this course section, we will define each of the most popular types of malware and walk through multiple examples. The four primary phases of malware analysis will be covered: Fully Automated Analysis, Static Properties Analysis, Interactive Behavior Analysis, and Manual Code Reversing. Students will complete various in-depth labs requiring them to fully dissect a live Ransomware specimen from static analysis through code analysis. They will also gain hands-on experience with manipulating the malware through behavior analysis techniques, and in decrypting files encrypted by Ransomware by extracting the keys through reverse engineering. All steps are well defined and tested to ensure that the process to achieve these goals is actionable and digestible.

Exercises

• Static Properties Analysis of Ransomware
• Interactive Behavior Analysis of Ransomware - Part I
• Interactive Behavior Analysis of Ransomware - Part II
• Manual Code Reversing of Ransomware

Topics

• Introduction to Malware Analysis
• Malware Analysis Stages: Fully Automated and Static Properties Analysis
• Malware Analysis Stages: Interactive Behavior Analysis
• Malware Analysis Stages: Manual Code Reversing

Overview

This final course section will serve as a real-world challenge for students by requiring them to work in teams, use the skills they have learned throughout the course, think outside the box, and solve a range of problems from simple to complex. A web server scoring system and Capture-the-Flag engine will be provided to score students as they submit flags to score points. More difficult challenges will be worth more points. In this defensive exercise, challenges include packet analysis, malware analysis, and other challenges related to the course material.