Attackers can run but not hide. Our radar sees all threats.
SEC541 is a cloud security course that investigates how attackers are operating against Amazon Web Services (AWS) and Microsoft Azure environments, the attacker's characteristics, and how to detect and investigate suspicious activity in your cloud infrastructure. You will learn how to spot the malice and investigate suspicious activity in your cloud infrastructure. In order to protect against cloud environment attacks, an organization must know which types of attacks are most likely to happen in your environment, be able to capture the correct data in a timely manner, and be able to analyze that data within the context of their cloud environment and overall business objectives.
SEC541 starts each day by walking through a real-world attack campaign against a cloud infrastructure. We will break down how it happened, what made it successful, and what could have been done to catch the attackers in the act. After dissecting the attacks, we learn how to leverage cloud native and cloud integrated capabilities to detect, threat hunt, or investigate similar attacks in a real environment, and building our arsenal of analytics, detections and best practices. The course dives into the AWS and Azure services, analyzing logs and behaviors and building analytics that the students can bring back to their own cloud infrastructure.
- Decrease the average time an attacker is in your environment
- Demonstrate how to automate analytics, thus reducing time
- Help your organization properly set up logging and configuration
- Decreases risk of costly attacks by understanding and leveraging cloud specific security services
- Lessen the impact of breaches that do happen
- Learn how to fly the plane, not just the ability to read the manual
- Research attacks and threats to cloud infrastructure and how they could affect you
- Break down a threat into detectable components
- Effectively use AWS and Azure core logging services to detect suspicious behaviors
- Make use of cloud native API logging as the newest defense mechanism in cloud services
- Move beyond the cloud-provided Graphic User Interfaces to perform complex analysis
- Perform network analysis with cloud-provided network logging
- Understand how application logs can be collected and analyzed inside the cloud environment
- Effectively put into practice the AWS and Azure security specific services
- Integrate container, operating system, and deployed application logging into cloud logging services for more cohesive analysis
- Centralize log data from across your enterprise for better analysis
- Perform inventory of cloud resources and sensitive data using scripts and cloud native tooling
- Analyzing Microsoft 365 activity to uncover threats
- Ability to leverage cloud native architecture to automate response actions to attacks
The labs in this course are hands-on explorations into AWS and Azure logging and monitoring services. About 75% of labs are AWS and 25% Azure. Each lab will start by researching a particular threat and the data needed to detect it. In most labs, the students will conduct the attack against their accounts, generating the logs and data needed to perform analysis. Students will use native AWS & Azure services and open-source products to extract, transform, and analyze the threat. The course lecture coupled with the labs will give students a full picture of how those services within AWS & Azure work, the data they produce, common ways to analyze the data, and walk away with the ability to discern and analyze similar attacks in their own cloud environment.
- Section 1: SEC541 environment deployment, analyzing cloud API logs with CloudTrail, parsing JSON-formatted logs with JQ, network analysis
- Section2: Environment setup, application/OS log lab with OpenCanary, CloudWatch agent and customization, strange ECS behavior, finding data exfiltration
- Section 3: Metadata services and GuardDuty, cloud inventory, discovering sensitive data in unapproved location with Macie, vulnerability assessment with Inspector, data centralization with Graylog
- Section 4: Microsoft 365 Exchange investigation, introduction to Kusto Query Language, log analytics analysis using Azure CLI, Microsoft Defender for Cloud and Sentinel, Azure network traffic analysis
- Section 5: Setup the automate forensics workflow, analyze the results, participate in the CloudWars Challenge
"Using the labs was easy with well documented instructions. I like the fact that I could easily copy and paste the commands. This helps me to get through the lab fast but I also know that I can come back later after the course and take the time to review each command." - Ludek Suk, Accenture
"Labs are awesome, and they all work! Learning a ton from these." - Joe Cultrara
"The lab guide is very detailed. Allowing me to learn and understand what I was doing. They also provided us with sufficient time to complete the labs and we were never rushed into doing anything." - Sambit Sarkar, ICE Data Services
- Section 1: Detecting adversarial activity in your cloud environment through management plane and network logging & analysis.
- Section 2: Dig deeper into your applications and compute systems running within the cloud environment.
- Section 3: Understanding your deployed cloud environment to easily identify deviation from organizational policy and potential malice.
- Section 4: Deep dive into Azure's ecosystem and the unique threats that can occur.
- Section 5: Learn to automate response actions in your cloud environment and put your new skills to the test in a Capture the Flag event.
ADDITIONAL FREE RESOURCES:
WHAT YOU WILL RECEIVE:
- Printed and electronic courseware
- MP3 audio files of the complete course lecture
- Access to virtual machine in the AWS cloud
- Access to an Azure account
WHAT COMES NEXT:
Depending on your current job role or future plans, any of the following SANS courses could be an excellent follow-on to SEC541:
SEC541 students will run the exercises from a virtual machine, in an AWS account that is configured with all the tools and documentation needed. All exercises will use Amazon Web Services (AWS).
IMPORTANT: You can use any 64-bit version of Windows, Mac OSX, or Linux as your core operating system that can also install and run VMware virtualization products. You also must have a minimum of 8 GB of RAM or higher for the virtual machines to function properly in the class. Verify that under BIOS, Virtual Support is ENABLED.
Mandatory System Requirements
- System running Windows, Linux, or Mac OS X 64-bit version
- At least 8 GB of RAM
- Wireless NIC for network connectivity
Mandatory Downloads BEFORE Coming to Class
- A 64-bit host operating system is installed (Windows is recommended)
- A modern web browser
- Adobe Acrobat or other PDF reader application
OnDemand Students Only: Mandatory AWS Account:
- An AWS account is required to do the hands-on exercises during this course.
- Estimated additional costs for the AWS account is less than $1 a day that services are running.
- You will receive detailed instructions for setting up your AWS account in what is called Lab 0.
Live and Live Online Students Only will be provided with an AWS Account.
If you have additional questions about the laptop specifications, please contact firstname.lastname@example.org.