SEC587: Advanced Open-Source Intelligence (OSINT) Gathering and Analysis

SEC587 is a fast-paced, advanced course that is meant to build upon previous knowledge and experience in OSINT. The SANS SEC487 Open-Source Intelligence Gathering and Analysis course is recommended but not required prior to taking this course.

• Basic knowledge and experience with open-source intelligence collection.
• Rudimentary understanding of intelligence analysis
• Knowledge of how to use a Virtual Machine (VM)

!! IMPORTANT - BRING YOUR OWN LAPTOP CONFIGURED USING THESE DIRECTIONS!!

A properly configured system is required for each student participating in this course. Before coming to class, carefully read and follow these instructions exactly.

CRITICAL NOTE: Apple systems using the M1 processor line cannot perform the necessary virtualization functionality and therefore cannot in any way be used for this course.

Host Operating System: Latest version of Windows 10, macOS 10.15.x or later, or Linux that also can install and run VMware virtualization products described below.

It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices.

Those who use a Linux host must also be able to access exFAT partitions using the appropriate kernel or FUSE modules.

You also must have 8 GB of RAM or higher for the VM to function properly in the class.

It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop.

In addition to having 64-bit capable hardware, AMD-V, Intel VT-x, or the equivalent must be enabled in BIOS/UEFI.

Download and install either VMware Workstation Pro 15.5.x, VMware Player 15.5.x or Fusion 11.5.x or higher versions before class. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website.

Other virtualization software, such as VirtualBox and Hyper-V, are not appropriate because of compatibility and troubleshooting problems you might encounter during class.

VMware Workstation Pro and VMware Player on Windows 10 is not compatible with Windows 10 Credential Guard and Device Guard technologies. Please disable these capabilities for the duration of the class, if they're enabled on your system, by following instructions in this document.

MANDATORY SEC587 SYSTEM REQUIREMENTS:

• CPU: 64-bit 2.0+ GHz processor or higher-based system is mandatory for this course (Important - Please Read: a 64-bit system processor is mandatory)
• BOIS/UEFI: VT-x, AMD-V, or the equivalent must be enabled in the BIOS/UEFI
• RAM: 8 GB (gigabytes) of RAM or higher is mandatory for this course (Important - Please Read: 8 GB of RAM or higher is mandatory)
• Wireless Ethernet 802.11 G/N/AC
• USB 3.0 port (courseware provided via USB)
• Disk: 30 gigabytes of free disk space
• VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+
• Privileged access to the host operating system with the ability to disable security tools
• A Linux virtual machine will be provided in class

Your course media will now be delivered via download. The media files for class can be large, roughly 40-50GB in size. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form and this class uses an electronic workbook in addition to the PDFs. In this new environment, we found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

"I have been practicing Open-Source Intelligence for over 20 years. There are lots of good OSINT study materials out there, but none took me to that advanced level. I know people want more, complex, in-depth knowledge on how to utilize OSINT in a professional way. This course was built by OSINT investigators and analysts with years and years of real-world experience in various backgrounds for OSINT investigators & analysts. This course is not about pushing buttons, it is all about in-depth and advanced methodology, sound analysis and practical real-world examples."

- Nico Dekens

"Although there are a number of open-source intelligence courses available, few go far beyond manually collecting information using browsers and search engines. Although these are core skills, there is another level OSINT investigators and analysts can get to. We designed this course with more advanced content to show students how to improve their collection and analysis using OSINT. Covering concepts from simple coding for automated collection and monitoring to a better understanding of how one conducts real intelligence analysis, it is all based on actual use cases with a hands-on learning style."

- John TerBush

"OSINT has become an essential part of many facets of information security. Whether working primarily as a network defender, a red teamer, or as an OSINT analyst, the core OSINT skills have applicability to many problems that we face in Infosec. To effectively collect and analyze the ever increasing amounts of relevant information, a shift must be made to leverage automation. This course covers different approaches to automation of the OSINT process as well as diving into more advanced analysis techniques. Building on use cases that reflect real-world problems, the course provides learning opportunities through relevant hands-on exercises, giving students tools and techniques that they can take back and apply to their unique challenges in their workplaces."

- David Mashburn