SEC501: Advanced Security Essentials - Enterprise Defender

Overview

Section 1 will focus on security in the design and configuration of various enterprise infrastructures. From a security perspective, proper design and configuration protects both the components being configured and the rest of the enterprise that depends on that gear to defend other components from attacks. In other words, a good house needs a good foundation!

We will discuss published security benchmarks, vendor guidance to secure various products, and regulatory requirements and how they impact defending infrastructure against specific attacks. To illustrate these points, we will look in detail at securing and defending a router infrastructure against a number of device- and network-based attacks. Securing private and public cloud infrastructure against common attacks will also be discussed.

Exercises

• Initial Router Configuration and Audit
• Securing AAA
• Securing Redundancy Protocols
• Log Infrastructure in Defense
• Defending Routing Protocols
• Final Router Hardening Steps/Audit

Topics

• Security Standards and Audit
• Authentication, Authorization, and Accounting
• Defending Network Infrastructure
• Intrusion Prevention Systems and Firewalls
• Name Resolution Attacks and Defense
• Securing Private and Public Cloud Infrastructure

Overview

Security is all about understanding, mitigating, and controlling the risk to an enterprise's critical assets. An enterprise must understand the changing threat landscape and have the capacity to compare it against its own vulnerabilities that could be exploited to compromise the environment. This second course section will present the variety of tests that can be run against an enterprise and show how to perform effective penetration tests to better understand the security posture for network services, operating systems, and applications. In addition, we will talk about social engineering and reconnaissance activities to better emulate increasingly prevalent threats to users.

Finding basic vulnerabilities is easy but not necessarily effective if these are not the vulnerabilities attackers exploit to break into a system. Advanced penetration testing involves understanding the variety of systems and applications on a network and how they can be compromised by an attacker. Students will learn about scoping and planning their test projects, performing external and internal network penetration testing and web application testing, and pivoting through the environment like real-world attackers.

Penetration testing is critical to identify an enterprise's exposure points, but students will also learn how to prioritize and fix these vulnerabilities to increase the enterprise's overall security.

Exercises

• Network Scanning Fundamentals
• Scanning with Nessus
• Exploitation and Metasploit Basics
• Metasploit and Pivoting
• Basic Web App Scans and Attacks

Topics

• Penetration Testing Scoping and Rules of Engagement
• Online Reconnaissance
• Social Engineering
• Network Mapping and Scanning Techniques
• Enterprise Vulnerability Scanning
• Network Exploitation Tools and Techniques
• Post-Exploitation and Pivoting
• Web Application Exploitation Tools and Techniques
• Reporting and Debriefing

Overview

"Prevention is ideal, but detection is a must" is a critical motto for security professionals. However, because of the changing landscape of attacks, detecting them is an ongoing challenge. Today's attacks are stealthier and more difficult to find than ever before. Only by understanding the core principles of traffic analysis can you become a skilled analyst capable of differentiating between normal and attack traffic. New attacks are surfacing all the time, so security professionals must be able to write intrusion detection rules that detect the latest attacks before they compromise a network environment.

Traffic analysis and intrusion detection used to be treated as a separate discipline within many enterprises. Today, prevention, detection, and response must be closely knit, so that once an attack is detected, defensive measures can be adapted and proactive forensics implemented so the enterprise can continue to operate. This course section will start with a brief introduction to network security monitoring, followed by a refresher on network protocols with an emphasis on fields to look for as security professionals. We will use tools such as tcpdump and Wireshark to analyze packet traces and look for indicators of attacks. We will use a variety of detection and analysis tools, craft packets with Scapy to test detection, and touch on network forensics and the Security Onion monitoring distribution. Students will also explore Snort as a Network Intrusion Detection System and examine rule signatures in-depth.

Exercises

• Analyzing PCAPs with tcpdump
• Attack Analysis with Wireshark
• Snort Basics
• Detecting Malicious Activity with Security Onion
• Security Analytics with SOF-ELK

Topics

• Network Security Monitoring
• Advanced Packet Analysis
• Network Intrusion Detection/Prevention
• Writing Signatures for Detection
• Network Forensics and More
• Event Management Introduction
• Continuous Monitoring
• Logging and Event Collection and Analysis
• SIEM and Analytics

Overview

"Bad guy elimination" is the core mission for Digital Forensics and Incident Response (DFIR) professionals. Incidents happen, and enterprises rely on these professional responders to find, scope, contain, and eradicate evil from their networks. Investigators employ DFIR practices to determine what happened. DFIR teams conduct investigations to find evidence of compromise, remediate the environment, and provide data to generate local threat intelligence for operations teams in order to continuously improve detection. While traditionally seen as a finite process, incident response is now viewed as ongoing, with DFIR professionals searching for evidence of an attacker that has existed in the environment without detection by applying new threat intelligence to existing evidence. This is the crux of the concept known as "threat hunting."

This section begins with a discussion of Active Defense approaches in some detail. Next, we will present the core concepts of both Digital Forensics and Incident Response. We will explore some of the hundreds of artifacts that can give forensic investigators specific insight about what occurred during an incident. Students will learn how incident response currently operates, after years of evolving, in order to address the dynamic procedures used by attackers to conduct their operations. We will also look at how to integrate DFIR practices into a continuous security operations program.

The section will cover the general guidelines for a cyclical, six-step incident response process. Each step will be examined in detail, including practical examples of how to apply it. Finally, students will learn about the artifacts that can best be used to determine the extent of suspicious activity within a given environment and how to migrate techniques to a large data set for enterprise-level analysis.

Exercises

• Active Defense: Honeyports
• Data Recovery with FTK Imager and Photorec
• Discovering Artifacts
• Ransomware Timeline Analysis
• Ransomware Network Analysis

Topics

• Active Defense
• DFIR Core Concepts: Digital Forensics
• DFIR Core Concepts: Incident Response
• Modern DFIR
• Widening the Net: Scaling and Scoping

Overview

Malicious software is responsible for many incidents in almost every type of enterprise. Types of malware vary widely, from Ransomware and Rootkits to Crypto Currency Miners and Worms. We will define each of the most popular types of malware and walk through multiple examples. The four primary phases of malware analysis will be covered: Fully Automated Analysis, Static Properties Analysis, Interactive Behavior Analysis, and Manual Code Reversing. You will complete various in-depth labs requiring you to fully dissect a live Ransomware specimen from static analysis through code analysis. You will get hands-on experience with tricking the malware through behavior analysis techniques, and in decrypting files encrypted by Ransomware by extracting the keys through reverse engineering. All steps are well defined and tested to ensure that the process to achieve these goals is actionable and digestible.

Exercises

• Static Properties Analysis of Ransomware
• Interactive Behavior Analysis of RansomwarePart I
• Interactive Behavior Analysis of RansomwarePart II
• Manual Code Reversing of Ransomware

Topics

• Introduction to Malware Analysis
• Malware Analysis Stages: Fully Automated and Static Properties Analysis
• Malware Analysis Stages: Interactive Behavior Analysis
• Malware Analysis Stages: Manual Code Reversing

Overview

The concluding section of the course will serve as a real-world challenge for students by requiring them to work in teams, use the skills they have learned throughout the course, think outside the box, and solve a range of problems from simple to complex. A web server scoring system and Capture-the-Flag engine will be provided to score students as they submit flags to score points. More difficult challenges will be worth more points. In this defensive exercise, challenges include packet analysis, malware analysis, and other challenges related to the course material.