Last Day to Save $200 on SANS Cyber Defense San Diego 2014
 

SEC511: Continuous Monitoring and Security Operations

SEC511: Continuous monitoring in the Security Operations Center (SOC). We continue to underestimate the tenacity of our adversaries! Organizations are investing a significant amount of time and financial and human resources trying to combat cyber threats and prevent cyber attacks, but despite this tremendous effort organizations are still getting compromised. The traditional perimeter-focused, prevention-dominant approach to security architecture has failed to prevent intrusions. No network is impenetrable, a reality that business executives and security professionals alike have to accept. Prevention is crucial, and we can't lose sight of it as the primary goal. However, a new proactive approach to security is needed to enhance the capabilities of organizations to detect threats that will inevitably slip through their defenses.

The underlying challenge for organizations victimized by an attack is timely incident detection. Industry data suggest that most security breaches typically go undiscovered for an average of seven months. Attackers simply have to find one way into most organizations, because they know that the lack of visibility and internal security controls will then allow them to methodically carry out their mission and achieve their goals.

The Defensible Security Architecture, Network Security Monitoring (NSM)/Continuous Diagnostics and Mitigation (CDM)/ Continuous Security Monitoring (CSM), taught in this course will best position your organization or Security Operations Center (SOC) to analyze threats and detect anomalies that could indicate cybercriminal behavior. The payoff for this new proactive approach would be early detection of an intrusion, or successfully thwarting the efforts of attackers altogether. The National Institute of Standards and Technology (NIST) developed guidelines described in NIST SP 800-137 for Continuous Monitoring (CM), and Day five (5) will greatly increase your understanding and enhance your skills in implementing Continuous Monitoring utilizing NIST framework.

SANS is uniquely qualified to offer this course. Course authors Eric Conrad (GSE #13) and Seth Misenar (GSE #28) hold the distinguished GIAC Security Expert Certification (GSE). Both are experienced, real-world, practitioners who apply the concepts and techniques they teach in this course on a daily basis. SEC511 will take you on quite a journey. We start by exploring traditional security architecture to assess its current state and the attacks against it. Next, we discuss and discover modern security design that represents a new proactive approach to such architecture that can be easily understood and defended. We then transition to how to actually build the network and endpoint security, and then carefully navigate our way through automation, NSM/CDM/CSM. For timely detection of potential intrusions, the network and systems must be proactively and continuously monitored for any changes in the security posture that might increase the likelihood that attackers will succeed.

Your SEC511 journey will conclude with one last hill to climb! The final day (Day 6) features a capture-the-flag competition that challenges you to apply the skills and techniques learned in the course to detect and defend the modern security architecture that has been designed. Course authors Eric Conrad and Seth Misenar have designed the capture-the-flag competition to be fun, engaging, comprehensive, and challenging. You will not be disappointed!

With your training journey now complete and your skills enhanced and honed, it is time to go back to work and deliver on the SANS promise that you will be able to apply what you learn in this course the day you return to the office.

You Will Be Able To:

  • Analyze a security architecture for deficiencies
  • Apply the principles learned in the course to design a defensible security architecture
  • Understand the importance of a detection-dominant security architecture and security operations centers (SOC)
  • Identify the key components of Network Security Monitoring (NSM)/Continuous Diagnostics and Mitigation (CDM)/ Continuous Monitoring (CM)
  • Determine appropriate security monitoring needs for organizations of all sizes
  • Implement a robust Network Security Monitoring/Continuous Security Monitoring (NSM/CSM)
  • Determine requisite monitoring capabilities for a SOC environment
  • Determine capabilities required to support continuous monitoring of key Critical Security Controls
  • Utilize tools to support implementation of Continuous Monitoring (CM) per NIST guidelines SP 800-137

While the above list briefly outlines the knowledge and skills you will learn, it barely scratches the surface of what this course has to offer. Hands-on labs throughout the course will reinforce key concepts and principles, as well as teach you how to use key scripting tools (e.g., Python and Powershell) to automate continuous monitoring. We look forward to seeing you soon!

Notice:

This is a technical course and a laptop is required to perform the hands-on exercises. Also, building and establishing a SOC are outside the scope of this course.

Course Syllabus
Course Contents
  SEC511.1: Current State Assessment, SOCs, and Security Architecture
Overview

The prevention-dominant security model has failed. Given the frequency and extent of significant intrusions, this should not come as a surprise. In order to address the root of the problem, we must understand the current architecture and the design gaps that facilitate the adversary's dominance. What do we need to address to begin to make things better? Can we ever hope to win? What would winning look like? These are important questions that we must answer if we hope to substantially improve our security posture.

We begin with the end in mind, and define the key techniques and principles that will allow us to achieve that state. An effective modern SOC or Security Architecture must enable an organization's ability to rapidly find intrusions to facilitate containment and response. Both significant knowledge and a commitment to continuous monitoring are required to achieve this goal.

CPE/CMU Credits: 6

Topics

Day 1: Current State Assessment, SOCs, and Security Architecture

    • Traditional Security Architecture
    • Perimeter Focused
    • Addressed Layer 3/4
    • Centralized Information Systems
    • Prevention-Oriented
    • Device-driven
    • Traditional Attack Techniques
  • Modern Security Architecture Principles
    • Detection-oriented
    • Post-Exploitation focused
    • Decentralized information systems/data
    • Risk-informed
    • Layer 7 Aware
    • Security Operations Centers
    • Network Security Monitoring
    • Continuous Security Monitoring
    • Modern Attack Techniques
    • Adversarial Dominance
  • Frameworks and Enterprise Security Architecture
    • Enterprise Security Architecture
    • Security Frameworks
  • Security Architecture - Key Techniques/Practices
    • Threat Vector Analysis
    • Data Exfiltration Analysis
    • Detection Dominant Design
    • Zero Trust Model (Kindervag)
    • Intrusion Kill Chain
    • Visibility Analysis
    • Data Visualization
    • Lateral Movement Analysis
    • Data Ingress/Egress Mapping
    • Internal Segmentation
    • Network Security Monitoring
    • Continuous Security Monitoring
  • Security Architecture - Design Tools/Strategies
    • Mapping software
    • Visualization
    • Qualitative Risk Assessment
    • Lab: Design Review
  • Security Operations Center (SOC)
    • Purpose of a SOC
    • Key SOC roles
    • Relationship to Defensible Security Architecture

 
  SEC511.2: Network Security Architecture
Overview

Understanding the problems with the current environment and realizing where we need to get is far from sufficient: we need a detailed roadmap to bridge the gap between the current and desired state. Day 2 introduces and details the components of our infrastructure that become part of a defensible network security architecture and SOC. We are long past the days where a perimeter firewall and ubiquitous antivirus was sufficient security. There are many pieces and moving parts that comprise a modern defensible security architecture.

In addition to discussing technologies like Next Generation Firewalls, UTM devices, Malware Detonation Devices, SIMs, DLP, and Honeypots that may not be found in all organizations, we will focus on repurposing traditional devices such as layer 3/4 firewalls, routers, switches, and NIDS. The goal of this course is not to give you a long list of items to add to the next year's budget, so we will focus on maximizing the capabilities of your current information security architecture, while pointing out new technologies that may offer a compelling return on investment (ROI).

CPE/CMU Credits: 6

Topics

Day 2: SOCs and Defensible Network Security Architecture

  • SOCs/Security Architecture - Key Infrastructure Devices
    • Traditional and Next Generation Firewalls, and NIPS
    • Web Application Firewall
    • Malware Detonation Devices
    • HTTP Proxies, Web Content Filtering, and SSL Decryption
    • SIMs, NIDS, Packet Captures, and DLP
    • Honeypots/Honeynets
    • Network Infrastructure - Routers, Switches, DHCP, DNS
    • Mobile Devices and Wireless Access Points
    • Threat Intelligence
  • Segmented Internal Networks
    • Routers
    • Internal SI Firewalls
    • VLANs
    • Detecting the Pivot
  • Defensible Network Security Architecture Principles Applied
    • Internal Segmentation
    • Threat Vector Analysis
    • Data Exfiltration Analysis
    • Detection Dominant Design
    • Zero Trust Model (Kindervag)
    • Intrusion Kill Chain
    • Visibility Analysis
    • Data Visualization
    • Lateral Movement Analysis
    • Data Ingress/Egress Mapping

 
  SEC511.3: Endpoint Security Architecture
Overview

One of the hallmarks of modern attacks is an emphasis on client-side exploitation. The days of breaking into networks via direct frontal assaults on unpatched mail, web, or DNS servers are largely behind us. We must focus on mitigating the risk of compromise of clients. Day 3 details ways in which endpoint systems can be both more resilient to attack and also enhance detective capabilities.

These endpoints are increasingly portable devices that frequently stray beyond the traditional perimeter. This day ends with discussion about current modern security architecture and SOC design challenges and offers ways to accommodate rapidly changing business environments. Security architecture and virtualization, cloud services, mobile devices/applications, and web applications will be considered as the course moves from the design elements to the monitoring aspects.

CPE/CMU Credits: 6

Topics

Day 3: SOCs and Defensible Endpoint Security Architecture

  • Security Architecture - Endpoint Protection
    • Antimalware
    • Host-based Firewall, Host-based IDS/IPS
    • Application Whitelisting, Application Virtualization
    • Privileged Accounts, Authentication, Monitoring, and UAC
    • Whole Disk Encryption
    • Virtual Desktop Infrastructure
    • Browser Security
    • EMET
  • Dangerous Endpoint Applications
    • Java
    • Adobe Reader
    • Flash
    • Microsoft Office
    • Browsers
  • Patching
    • Process
    • To Test or Not to Test
    • Microsoft
    • 3rd Party
  • Current Architectural Challenges
    • Virtualized Infrastructure
    • Cloud Services
    • Mobile Devices/Applications
    • Portable Devices
    • Web Applications
    • Browsers

 
  SEC511.4: Network Security Monitoring
Overview

Designing a SOC or security architecture that enhances visibility and detective capabilities represents a paradigm shift for most organizations. However, the design is simply the beginning. The most important element of a modern security architecture is the emphasis on detection. The architecture presented in days 1-3 emphasized baking visibility and detective capabilities into the design. Now we must figure out how to look at the data and continuously monitor the enterprise for evidence of compromise or changes that increase the likelihood of compromise.

We must first understand the approach and goals of monitoring and define a methodology for analysis. Key terms such as Network Security Monitoring (NSM), Continuous Diagnostics and Mitigation (CDM), and Continuous Security Monitoring (CSM) can cause confusion, and we will make sure these terms are understood to enable the security professional to guide an organization in the best practices. Speaking of best practices: we will emphasize the continuous monitoring of the Critical Security Controls.

Then we will describe enabling continuous monitoring by developing a model for employing robust Network Security Monitoring (NSM). NSM will allow an organization to deal with and make sense of data that will rapidly allow for the detection of potential intrusions or unauthorized actions.

CPE/CMU Credits: 6

Topics

Continuous Monitoring Overview

  • Defined
  • Network Security Monitoring (NSM)
  • Continuous Security Monitoring (CSM)
  • Continuous Monitoring and the 20 Critical Security Controls

Network Security Monitoring (NSM)

  • Evolution of NSM
  • The NSM Toolbox
  • NIDS Design
  • Analysis Methodology
  • Understanding Data Sources
    • Full Packet Capture
    • Extracted Data
    • String Data
    • Flow Data
    • Transaction Data
    • Statistical Data
    • Alert Data
    • Tagged Data
    • Correlated Data
  • Practical NSM Issues
  • Cornerstone NSM

    • Service-side and Client-side Exploits
    • Identifying High-entropy Strings
    • Tracking EXE Transfers
    • Identifying Command and Control (C2) Traffic
    • Tracking User Agents
    • C2 via HTTPS
    • Tracking Encryption Certificates

 
  SEC511.5: Automation and Continuous Security Monitoring
Overview

Network Security Monitoring (NSM) is the beginning: we need to not only detect active intrusions and unauthorized actions, but also know when our systems, networks, and applications are at an increased likelihood for compromise. A strong way to achieve this is through Continuous Security Monitoring (CSM) or Continuous Diagnostics and Mitigation (CDM). Rather than waiting for the results of a quarterly scan or an annual penetration test to determine what needs to be addressed, continuous monitoring insists on proactively and repeatedly assessing and reassessing the current security posture for potential weaknesses that need be addressed.

The volume of data that must continuously be sought and mined is vast: the goal of continuous monitoring would be out of reach without scripting and automation. Naturally, there are vendors and tools to scratch this itch, but they will be incomplete and require their own care, feeding, and monitoring. Day 5 describes how to perform continuous monitoring with simple tools and scripts.

Knowing how to script and automate is pointless unless you know what data should be captured and analyzed on a continuous basis. Again leaning on the Critical Security Controls, we will determine high value targets for continuous monitoring in an enterprise.

CPE/CMU Credits: 6

Topics

Continuous Security Monitoring

  • Overview
    • Continuous Security Monitoring (CSM) vs. Continuous Diagnostics and Mitigation (CDM) vs. Information Security Continuous Monitoring (ISCM)
    • Cyberscope and SCAP
  • Industry Best Practices
    • Continuous Monitoring and the 20 Critical Security Controls
    • Australian Signals Directorate (ASD) Strategies to Mitigate Targeted Cyber Intrusions
  • Winning CSM Techniques
  • Maintaining Situational Awareness
  • Host, Port and Service Discovery
  • Vulnerability Scanning
  • Monitoring Patching
  • Monitoring Applications
  • Monitoring Service Logs

    • Detecting Malware via DNS logs
  • Monitoring Change to Devices and Appliances
  • Leveraging Proxy and Firewall Data
  • Configuring Centralized Windows Event Log Collection
  • Monitoring Critical Windows Events

    • Hands on: Detecting Malware via Windows Event Logs
  • Scripting and Automation

    • Importance of Automation
    • PowerShell
    • Hands-on: Detecting Malicious Registry Run Keys with PowerShell

 
  SEC511.6: Capstone: Design, Detect, Defend
Overview

The course culminates in a team-based capstone project that is a full day of hands-on work applying the principles taught throughout the week.

The first component of the capstone requires teams to assess the deficiencies in a provided security architecture, and offer the best way to bridge the gap to achieve a robust security architecture/SOC environment. However, there is a twist...Teams must provide two different solutions to the same problem. One solution is the best-case-scenario where there are no budgetary constraints and unicorns and pixies frolic throughout the enterprise. While understanding the best we could possibly hope to achieve is laudable, an essential skill is to be able to distill down the best an organization can do given only what they have. So, teams first get it easy and have unlimited CAPEX, OPEX, and fully competent staff, and then teams are presented with the "real world" scenario and deal with no CAPEX, limited expansion of OPEX, and a less than ideal staffing capability.

The second portion of the capstone is an exercise in continuous monitoring. The task is to quickly and thoroughly instrument monitoring for a network; then the monitoring will be tested by authorized and unauthorized changes, system and application compromise, privileged account abuse, and lateral movement (to name a few). Teams will need to determine the extent of the changes, and perform triage to determine where containment and response efforts should be focused.

CPE/CMU Credits: 6

Topics

Day 6 - Capstone - Design/Detect/Defend

  • Security Architecture
  • Assess provided architecture
  • $0 CAPEX - Security Architecture
  • $$$$ CAPEX - Security Architecture
  • Continuous Security Monitoring
  • Using tools/scripts assess the initial state
  • Quickly/Thoroughly find all changes made

 
Additional Information
 
  Laptop Required
  • CPU: 2.0+ GHz processor
  • RAM: 4GB or higher
  • Ethernet port
  • Host OS: Windows 7 or newer. (If Mac OS X or Linux is used, a Win7 VM will be required)
  • Administrative access to the Windows system with the ability to disable security tools
  • VMware Workstation 9, Player 5, or Fusion 5 (or newer)

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

 
  Who Should Attend
  • Security Architects
  • Senior Security Engineers
  • Technical Security Managers
  • SOC Analysts
  • SOC Engineers
  • SOC Managers
  • CND Analysts
  • Individuals working to implement Continuous Diagnostics and Mitigation (CDM), Continuous Security Monitoring (CSM), or Network Security Monitoring (NSM)

 
  Prerequisites

Basic understanding of network protocols and devices. Experience with Linux and Windows from the command line.

 
  Hands-on Training
  • Automating/Scripting Continuous Monitoring
  • Security Architecture Design and Review
  • Cuckoo Sandbox
  • Squid Proxy
  • Snort for Exfiltration
  • Snort for Pivot Detection
  • DNS Sinkholes
  • Data Leakage Detection
  • Process Monitor
  • EMET
  • OSSEC
  • OSSIM
  • Mod_security
  • Log and Event Correlation
  • Automating Vulnerability Scanning/Reporting
  • Automating Port Scanning
  • Automating Host Discovery
  • Automating Service Detection
  • Final Capstone: Security Architecture Assessment and Continuous Monitoring Exercise

 
  What To Take Next?

Courses that Lead-in

  • 401: Security Essentials
  • 501: Advanced Security Essentials
  • 502: Perimeter Protection
  • 503: Intrusion Detection
  • 504: Hacker Techniques, Exploits, and Incident Handling
  • 566: Implementing and Auditing the Twenty Critical Security Controls

Courses that are good follow-ups

  • 501: Advanced Security Essentials
  • 502: Perimeter Protection
  • 503: Intrusion Detection
  • 504: Hacker Techniques, Exploits, and Incident Handling
  • 566: Implementing and Auditing the Twenty Critical Security Controls

 

Author Statement

We are just beginning to accept that every organization can and will be breached. Perimeter-focused preventive security controls have failed. Attackers simply have to find one way into most organizations, and then the lack of internal security controls allows adversaries to take their time to achieve the goal.

This course assesses the current state of security architecture and continuous monitoring, and provides a new approach to security architecture that can be easily understood and defended. What I love most about this course is that when students walk out they have a list of action items in hand for making their organization one of the most effective vehicles for frustrating adversaries. Students are able to assess deficiencies in their own organizations security architectures and effect meaningful changes that are continuously monitored for deviations from their expected security posture. - Eric Conrad and Seth Misenar

Additional Resources

Take your learning beyond the classroom. Explore our site network for additional resources related to this course's subject matter.

*CPE/CMU credits not offered for the SelfStudy delivery method

Online options available. Train from any location.
Type
Topic
Course
/ Location
/ Instructor
Date
Register

Training Event
Essentials Oct 19, 2014 -
Oct 27, 2014
 

Training Event
Essentials Nov 3, 2014 -
Nov 8, 2014
 

Training Event
Essentials
SANS Brussels 2015
Brussels, Belgium
Jan 26, 2015 -
Jan 31, 2015
 

Training Event
Essentials
SANS Scottsdale 2015
Scottsdale, AZ
Feb 16, 2015 -
Feb 21, 2015
 

Training Event
Essentials Mar 9, 2015 -
Mar 14, 2015
 

Training Event
Essentials
SANS Secure Singapore 2015
Singapore, Singapore
Mar 9, 2015 -
Mar 21, 2015
 

Training Event
Essentials
SANS Secure Europe 2015
Amsterdam, Netherlands
May 11, 2015 -
May 23, 2015
 

Summit
Essentials Feb 2, 2015 -
Feb 9, 2015
 

Community SANS
Essentials Dec 1, 2014 -
Dec 6, 2014
 

vLive
Essentials
Online
Staff
Oct 6, 2015 -
Nov 12, 2015
 

*Course contents may vary depending upon location, see specific event description for details.