SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise

GIAC Defensible Security Architecture (GDSA)
GIAC Defensible Security Architecture (GDSA)
  • In Person (6 days)
  • Online
36 CPEs
This course is designed to help students build and maintain a truly defensible security architecture, while taking them on a journey towards implementing Zero Trust principles, pillars and capabilities. There will be a heavy focus on leveraging current infrastructure and investment. Students will learn how to assess, re-configure and validate existing technologies to significantly improve their organizations' prevention, detection and response capabilities, augment visibility, reduce attack surface, and even anticipate attacks in innovative ways. The course will also delve into some of the latest technologies and their capabilities, strengths, and weaknesses. You will come away with recommendations and suggestions that will aid in building a robust security infrastructure, layer by layer, across hybrid environments, as you embark on a journey towards Zero Trust. 23 Hands-On Labs + Capstone Secure the Flag Challenge

What You Will Learn

NOTE: The term "architecture" is interpreted differently by different organizations and in various regions of the world. This course focuses on strategic and technical application and use cases, including fine-tuning and implementing various infrastructure components and cyber defense techniques. If you are expecting the course to focus exclusively on strategic solution placement, vendor products and use cases, the course is not for you.

Traditional methods of cyber defense, like perimeter-based network security, have always emphasized the need of keeping adversaries out of our networks, building a 'fortress' that would stop attackers while allowing secure access to legitimate users. However, modern client-side attacks have made evident that the old perimeter security model is clearly insufficient, creating the need for new data-centric models like Zero Trust.

But is Zero Trust just a new marketing buzzword, a simple iteration over the well-known 'least privilege' mindset, or a truly innovative strategy? Is Zero Trust really attainable, and if it's not, is it possible to gradually implement 'less trust' as part of a holistic defensible security architecture? How do we get started, and what are some of the tools and technologies that are available to implement it?

SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise, is designed to help students establish and maintain a holistic and layered approach to security, while taking them on a journey towards a realistic 'less trust' implementation, based on Zero Trust principles, pillars and capabilities. Effective security requires a balance between detection, prevention, and response capabilities, but such a balance demands that controls be implemented on the network, directly on endpoints, and within cloud environments. The strengths and weaknesses of one solution complement another solution through strategic placement, implementation, and continuous fine-tuning.

To address these issues, this course focuses on combining strategic concepts of infrastructure and tool placement while also diving into their technical application. We will discuss and identify what solutions are available and how to apply them successfully to reduce attack surface and implement adaptive trust. Most importantly, we'll evaluate the strengths and weaknesses of various solutions and how to layer them cohesively to achieve a defensible security architecture.

SEC530 is a practical class, focused on teaching effective tactics and tools to architect and engineer for disruption, early warning detection, and response to most prevalent attacks, based on the experience of the authors, highly experienced practitioners with an extensive career in cyberdefense. There will be a heavy focus on leveraging current infrastructure (and investment), including switches, routers, next-gen firewalls, IDS, IPS, WAF, SIEM, sandboxes, encryption, PKI and proxies, among others. Students will learn how to assess, re-configure and validate these technologies to significantly improve their organizations' prevention, detection and response capabilities, augment visibility, reduce attack surface, and even anticipate attacks in innovative ways. The course will also delve into some of the latest technologies and their capabilities, strengths, and weaknesses. You will come away with recommendations and suggestions that will aid in building a robust security infrastructure, layer by layer, across hybrid environments, as you embark on a journey towards Zero Trust.

While this is not a monitoring course, it will dovetail nicely with continuous security monitoring, ensuring that your security architecture not only supports prevention but also provides the critical logs that can be fed into behavioral detection and analytics systems, like UEBA or Security Information and Event Management (SIEM), in a Security Operations Center (SOC).

Multiple hands-on labs conducted daily will reinforce key points in the course and provide actionable skills that students will be able to leverage as soon as they return to work.

Business Takeaways

This course will help your organization:

  • Identify and comprehend deficiencies in security solutions
  • Design and Implement Zero Trust strategies leveraging current technologies and investment
  • Maximize existing investment in security architecture by reconfiguring existing technologies
  • Layer defenses to increase protection time while increasing the likelihood of detection
  • Improved prevention, detection, and response capabilities
  • Reduced attack surface

You Will Be Able To

  • Analyze a security architecture for deficiencies
  • Discover data, applications, assets and services, and assess compliance state
  • Implement technologies for enhanced prevention, detection, and response capabilities
  • Comprehend deficiencies in security solutions and understand how to tune and operate them
  • Understand the impact of 'encrypt all' strategies
  • Apply the principles learned in the course to design a defensible security architecture
  • Determine appropriate security monitoring needs for organizations of all sizes
  • Maximize existing investment in security architecture by reconfiguring existing technologies
  • Determine capabilities required to support continuous monitoring of key Critical Security Controls
  • Configure appropriate logging and monitoring to support a Security Operations Center and continuous monitoring program
  • Design and Implement Zero Trust strategies leveraging current technologies and investment

While the above list briefly outlines the knowledge and skills you will learn, it barely scratches the surface of what this course has to offer.

When your SEC530 training journey is complete, and your skills are enhanced and honed, it will be time to go back to work and deliver on the SANS promise that you'll be able to apply what you learned in this course the day you return to the office.

This Course Will Prepare You To

  • Understand how to implement data-centric security architectures like Zero Trust
  • Layer security solutions ranging from network to endpoint and cloud-based technologies
  • Understand the implications of proper placement of technical controls
  • Tune, adjust, and implement security techniques, technologies, and capabilities
  • Think outside the box on using common security solutions in innovative ways
  • Balance visibility and detection with prevention while allowing for better response times and capabilities
  • Understand where prevention technologies are likely to fail and how to supplement them with specific detection technologies
  • Understand how security infrastructure and solutions work at a technical level and how to better implement them

What You Will Receive

  • An electronic workbook with introduction and walk-through videos of most labs
  • Bonus labs that are regularly updated
  • A Linux VM loaded with tons of tools and other resources
  • A Digital Download Package that includes the above and more

Syllabus (36 CPEs)

Download PDF
  • Overview

    This first section of the course describes the principles of designing and building defensible systems and networks. In this section we introduce the fundamentals of security architectures and the journey towards Zero Trust. We will cover traditional vs defensible security architectures, security models and winning techniques, and the defensible security architecture life cycle or DARIOM (Discover, Assess, Re-Design, Implement and Monitor) model.

    Main emphasis on sections 1 is on practical threat modeling with models like MITRE ATT&CK and building a good foundation from the bottom up, starting with physical security, and network security at the lower layers, from VLANs and PVLANs, along with understanding what normal looks like by baselining network activity with NetFlow data across hybrid environments, on-prem and in the Cloud. Section 1 will also introduce you to the principle of Time-Based Security and how to implement it in real world.

    Section 1 includes an overview of traditional network and security architectures and their common weaknesses. The defensible security mindset is "build it once, build it right." All systems must perform their operational functions effectively, and security can complement this goal. It is much more efficient to bake security in at the outset than to retrofit it later. To implement that concept, the class includes many "ripped from the headlines" tips the authors have successfully deployed in the trenches to harden and monitor infrastructure in order to prevent and detect modern attacks. Examples include the use of private VLANs, which effectively kills the malicious client-to-client pivot, and 802.1X and NAC, which mitigate rogue devices. Specific Cisco IOS syntax examples are provided to harden critical network devices.

    • Practical Threat Modeling with MITRE ATT&CK: In SEC530's first hands-on lab, students will learn practical threat modeling using MITRE ATT&CK. This framework will be used throughout the week, so All-Around-Defenders can use this model to prioritize security countermeasures and to drive efficacy. This class will teach students to be threat-focused, not vulnerability focused, identifying where the most important risks are.
    • Egress Analysis: The focus is on understanding how attackers exfiltrate data with common techniques like DNS tunneling, and how to layer defenses to increase protection time while increasing the likelihood of detection.
    • Identifying Layer 2 Attacks: Network security has increased, yet layer 2 attacks still are possible in a modern organization. The focus of this lab is on identifying relevant layer 2 attacks.
    • Architecting for Flow Data: This lab will help students understand the various forms of flow data and how to properly architect the proper position and use of various flow data sources to identify unauthorized or anomalous activity.
    • Course Overview
      • What is a Security Architecture?
      • What makes a good Security Architect?
      • Learning Through Case Studies from Day 1 to 6 (Tyrell Corp Case Study)
      • Our Journey Towards Zero Trust
    • Defensible Security Architecture
      • Mindset
        • Presumption of Compromise
        • De-perimeterization
        • Think Red, Act Blue
    • Traditional Security Architecture Deficiencies
      • Emphasis on Perimeter/Exploitation
      • Lack of a True Perimeter ("De-perimeterization" as a Result of Cloud/Mobile)
      • The Internet of Things
      • Compliance-Driven Security
    • Winning Defensible-Security Strategies
      • Risk-Driven and Business Outcome-Focused Architecture
      • Practical Threat Modeling: Purple Teaming
      • MITRE ATT&CK Matrix
      • Look for Blue/Red Asymmetries
      • Architecting with Security Operations in Mind
    • Security Models
      • Time Based Security
      • Cyber Kill Chain
      • TBS + Kill Chain + MITRE ATT&CK
      • Architecting for Visibility & Detection
      • Architecting for Incident Response
      • Zero Trust Model
    • Threat, Vulnerability, and Data Flow Analysis
      • Defensible Security Architecture Life Cycle (DARIOM Model)-
      • Threat Vector Analysis

        • Data Ingress Mapping
      • Data Exfiltration Analysis

        • Data Egress Mapping
      • Detection Dominant Design
      • Attack Surface Analysis
      • Visibility Analysis
    • Layer 1 - Physical Security Best Practices
      • Network Closets
      • Penetration Testing Dropboxes
      • USB Keyboard Attacks (Rubber Ducky)
    • Layer - Network Security Best Practices
      • Wireless, Zigbee and RFID badges
      • VLANs
        • Hardening
        • Private VLANs
      • Layer 2 Attacks and Mitigation
    • NetFlow
      • Layer 2 and 3 NetFlow
      • NetFlow, Sflow, Jflow, VPC Flow, Suricata and Endpoint Flow
      • Cloud Flows
  • Overview

    This section continues the discussion on hardening critical infrastructure that is often found in hybrid environments, and moves on to concepts such as routing devices, firewalls, and application proxies. Actionable examples are provided for hardening routers, with specific Cisco IOS commands to perform each step.

    The section then continues with a deep dive on IPv6, which currently accounts for over 30% percent of Internet backbone traffic, according to Google, while simultaneously being used and ignored by most organizations. We will provide deep background on IPv6, discuss common mistakes (such as applying an IPv4 mindset to IPv6), and provide actionable solutions for securing the protocol. The section continues with a discussion of a key Zero Trust topic: segmentation. This section includes principles and defensive tactics that cover firewalls and network segmentation but also identity and access segmentation. Section 2 wraps up with a discussion on web application proxies and smtp proxies.

    • Auditing Router Security: The focus of this lab is on identifying and mitigating security issues in routers.
    • Router SNMP Security: In this lab, students will interact with live cloud routers and perform attacks against SNMP to understand them and, ultimately, to remove the threat
    • IPv6: The Next Generation Internet Protocol, also known as IPv6, is often ignored and misunderstood. This lab allows students to interact with IPv4 and IPv6 to be more familiar with some of the differences.
    • Proxy Power: Proxies have immense capabilities in dealing with malware and command and control channels. This lab walks students through what would happen to malware phoning home based on the different ways a proxy can be configured.
    • Layer 3 Attacks and Mitigation
      • IP Source Routing
      • ICMP Attacks
      • Unauthorized Routing Updates
      • Securing Routing Protocols
      • Unauthorized Tunneling (Wormhole Attack)
    • Switch and Router Best Practices
    • Layer 2 and 3 Benchmarks and Auditing Tools
      • Baselines
        • CISecurity
        • Cisco's Best Practices
        • Cisco Autosecure
        • DISA STIGs
        • Nipper-ng
    • Securing SNMP
      • SNMP Community String Guessing
      • Downloading the Cisco IOS Config via SNMP
      • Hardening SNMP
      • SNMPv3
    • Securing NTP
      • NTP Authentication
      • NTP Amplification Attacks
    • Bogon Filtering, Blackholes, and Darknets
      • Bogon Filtering
      • Monitoring Darknet Traffic
      • Building an IP Blackhole Packet Vacuum
    • IPv6
      • Dual-Stack Systems and Happy Eyeballs
      • IPv6 Extension Headers
      • IPv6 Addressing and Address Assignment
    • Securing IPv6
      • IPv6 Firewall Support
      • Scanning IPv6
      • IPv6 Asset Inventory with Rumble Network Discovery
      • IPv6 Tunneling
      • IPv6 Router Advertisement Attacks and Mitigation
    • Segmentation
      • Network vs Access Segmentation
      • Segmentation Principles
      • Firewall Architecture
      • DMZ Design
      • Layer 3/4 Stateful Firewalls
      • Router ACLs
      • Linux and BSD Firewalls
      • pfSense
      • Login segmentation
      • Azure Privileged Management (PIM)
    • Application Proxies
      • Web Proxy
        • Explicit vs. Transparent
        • ICAP
        • Forward vs. Reverse
      • SMTP Proxy
        • Augmenting with Phishing Protection and Detection Mechanisms
        • Bayesian Analysis
        • SPF, DKIM, DMARC
        • Dnstwist
        • Combining Open-Source Intelligence
  • Overview

    Organizations own or have access to many network-based security technologies, ranging from Next-Generation Firewalls to IDS/IPS and malware sandboxes. These are often deployed on-prem but also in the Cloud. Yet the effectiveness of these technologies is directly affected by their implementation. Too much reliance on built-in capabilities like application control, antivirus, intrusion prevention, data loss prevention, or other automatic evil-finding deep packet inspection engines leads to a highly preventative-focused implementation, with huge gaps in both prevention and detection.

    This section focuses on improving the efficacy of prevention and detection technologies using application-layer security solutions with a Zero Trust mindset. By thinking outside the box, even old controls like a spam appliance can be used to catch modern attacks such as phishing via cousin domains and other spoofing techniques. And again, by engineering defenses for modern attacks, both prevention and detection capabilities gain significantly.

    • Network Security Monitoring: Intrusion detection alerts and network metadata provide a holistic approach to knowing thyself and identifying unauthorized activity. This lab focuses on detecting malware operating over the network with NSM (Suricata).
    • NSM Architecture and Engineering: In this lab, students will learn how to place and implement NSM technologies for proper visibility and application/protocol awareness. They will also leverage advanced correlation capabilities on Zeek to detect C2 and tunnels.
    • Encryption Considerations: Network encryption protects data from being observed both by attackers and defenders. This lab focuses on how defenders can interact with TLS connections to gain back visibility for inspection in proxies, NSM, NGFW, and other solutions.
    • NGFW
      • Application Filtering
      • Implementation Strategies
      • Scripting & APIs
    • Network Security Monitoring (NSM)
      • Alert-Driven Workflows vs Data-Driven Workflows
      • Architecting for Network Visibility
      • Power of Network Metadata
      • Know Thy Network
      • SPAN ports vs TAPs
      • Sensor Placement
      • The Power of Network Metadata
      • Network Traffic Analysis Architecture
      • Zeek Use Cases
      • IDS/IPS Rule Writing
      • Signature vs Anomaly vs Protocol analysis
      • Snort
      • Suricata
      • Zeek
    • Sandboxing
      • Beyond Inline
      • Integration with Endpoint
      • Feeding the Sandbox Potential Specimens
      • Malware Detonation Devices
    • Encryption
      • The "Encrypt Everything" Mindset

        • Internal and External
      • Free SSL/TLS Certificate Providers
      • SSL/SSH Inspection
      • SSL/SSH Decrypt Dumps
      • SSL Decrypt Mirroring
      • Certificate Pinning

        • Malware Pins
      • HSTS Preloading
      • Certificate Transparency Monitoring
      • Crypto Suite Support

        • Qualys SSL Labs
    • Secure Remote Access
      • Access into Organization
      • Dual Factor for All Remote Access (and More)

        • Google Authenticator/TOTP: Open Authentication
      • IPSec VPNs
      • SSH VPNs
      • SSL/TLS VPN
      • Jump Boxes
      • Remote Desktop on HTML5 with Guacamole
      • Always On VPN
      • Compression and WAN Optimization
      • Modern Alternatives to VPN: ZTNA and SDP
      • Clean Source Principle and AD Management
      • Identity Access Management
    • Distributed Denial-of-Service Protection
      • Impact of Internet of Things
      • Types of Attacks
      • Mitigation Techniques
  • Overview

    Our journey continues with the discussion of a strategy that is central to a Zero Trust Architecture: data-centric security. Organizations cannot protect something they do not know exists. The problem is that critical and sensitive data exist all over. Complicating this even more is that data are often controlled by a full application stack involving multiple services that may be hosted on-premises or in the cloud.

    This section focuses on identifying core data where they reside and how to classify, label and protect those data. Protection includes using data governance solutions and full application stack security measures such as web application firewalls and database activity monitoring, as well as keeping a sharp focus on securing the systems hosting core services such as on-premises hypervisors, cloud computing platforms, and container services such as Docker.

    The data-centric security approach focuses on what is core to an organization and prioritizes security controls around it. Why spend copious amounts of time and money securing everything when controls can be optimized and focused on securing what matters? Let's face it: some systems are more critical than others.

    • Securing Web Applications: In this lab, students will identify the prevention and detection capabilities that web application firewalls provide, and also learn where they can be evaded. Then changes will be applied to block and detect evasion techniques.
    • Discovering Sensitive Data: Identifying where sensitive data reside is difficult but necessary. You cannot control data if you do not know where those data reside. This lab walks students step-by-step through writing a PowerShell script in order to crawl through a file system looking for sensitive data.
    • Secure Virtualizatio: The focus of this lab is on showing the implication of attackers gaining host access to a hypervisor or container system, and also on various hardening and incident handling steps that can be taken

    • Application (Reverse) Proxies
    • Full Stack Security Design
      • Web Server
      • App Server
      • DB Server
    • Web Application Firewalls
      • Whitelisting and Blacklisting
      • WAF Bypass
      • Normalization
      • Dynamic Content Routing
    • Database Firewalls/Database Activity Monitoring
      • Data Masking
      • Advanced Access Controls
      • Exfiltration Monitoring
    • File Classification
      • Data Discovery
        • Scripts vs. Software Solutions
        • Find Sensitive Data in Databases or Files/Folders
        • Advanced Discovery Techniques such as Optical Character Recognition Scanning of Pictures and Saved Scan Files
      • Methods of Classification
      • Dynamic Access Control
    • Data Loss Prevention (DLP)
      • Network-based
      • Endpoint-based
      • Cloud Application Implementations
    • Data Governance
      • Policy Implementation and Enforcement
      • Access Controls vs. Application Enforcement and Encryption
      • Auditing and Restrictions
    • Mobile Device Management (MDM) and Mobile Application Management (MAM)
      • Security Policies
      • Methods for Enforcement
      • End-user Experience and Impact
    • Private Cloud Security
      • Securing On-premises Hypervisors (vSphere, Xen, Hyper-V)
      • Network Segmentation (Logical and Physical)
      • VM Escape
      • Surface Reduction
      • Visibility Advantages
    • Public Cloud Security Challenges
      • Shared Responsibility Implications
      • Cloud Strengths and Weaknesses
      • Data Remanence and Lack of Network Visibility
    • Container Security
      • Impact of Containers on On-premises or Cloud Architectures
      • Security Concerns
      • Protecting against Container Escape
  • Overview

    "Trust but verify" has been a common security mantra. But this is a broken concept. Computers can calculate trust on the fly, so rather than thinking in terms of "trust but verify" organizations should be implementing "verify then trust." By doing so, access can be constrained to appropriate levels at the same time that access can become more fluid.

    This section culminates our journey towards Zero Trust by focusing on implementing an architecture where trust is no longer implied but must be proven. By doing so, a model of variable trust can be used to change access levels dynamically. This, in turn, allows for implementing fewer or more security controls as necessary given a user's and a device's trust maintained over time.

    On Section 5, we will review the zero trust principles, model and the latest US Government mandates (DISA, NSA, NIST), while we focus on practical implementations of this new philosophy. The focus will be on practical application of zero trust through existing infrastructure to maximize their value and impact for an organization's security posture: credential rotation, securing traffic on windows networks, host-based firewalls, NAC, segmentation gateways, SIEM, log collection, audit policies, detection engineering, and red herring defenses

    • Network Isolation and Mutual Authentication: Attackers cannot attack what they cannot see or interact with. This lab shows defenders how to implement SPA or mutual TLS so that only authorized assets can connect.
    • SIEM Analysis and Tactical Detection: Logging and inspecting is difficult without the right data and the proper ability to view those data. This lab shows how to use a SIEM system to find an attacker more than 10 different ways. The detection capabilities are important but the logic behind them is also important to implement variable trust conditional access across an enterprise.
    • SIGMA Generic Signatures: In this lab students will understand how to use and implement Sigma generic signature rules, a new community driven project, to convert generic signatures into various formats for operational use. Students will use these signatures to enhance existing detection capabilities, determine coverage with MITRE ATT&CK Navigator and search for adversary activity.
    • Advanced Defense Strategies: Attackers do not play fair and neither should defenders. In this lab, students will configure services to identify attacks in a way that internal systems continue to function but attack tools do not. Also, specialized detection honeytokens will be implemented to identify attackers cloning a public site and using it against your staff or external clients.
    • Zero Trust Architecture
      • Why Perimeter Security Is Insufficient
      • What Zero Trust Architecture Means
      • "Trust but Verify" vs. "Verify then Trust"
      • US Government - Embracing a Zero Trust Security Model
      • DISA  Rethinking How We Use Existing Infrastructure
      • DISA  Zero Trust Pillars and Capabilities
      • Example of Zero Trust Scenario  Remote Exploitation or Insider Threat
      • Zero Trust  A Journey Over Time
      • Implementing Variable Access
      • Logging and Inspection
      • Network Agent-based Identity Controls
    • Credential Rotation
      • Certificates
      • Passwords and Impact of Rotation
      • Password Auditing
      • LAPS
      • gMSA
    • Compromised Internal Assets
      • Pivoting Adversaries
      • Insider Threat
      • NAC
    • Adaptive Trust and Security Orchestration
      • Electric Fence (Automated Digital Response)
      • Quarantine
      • Device Compliance
    • Securing the Network
      • Authenticating and Encrypting Endpoint Traffic
      • Domain Isolation (Making Endpoint Invisible to Unauthorized Parties)
      • Mutual TLS
      • Single Packet Authorization
      • 802.1x
      • Client Certificates
      • PKI
    • Segmentation Gateways
      • Network Agent
      • Planes of Authorization
      • Micro Segmentation, Micro Core and Perimeter (MCAP)
      • Dynamic Authorization
    • Leveraging Endpoints as Hardened Security Sensors
      • End-user Privilege Reduction
      • Host-based IDS/IPS

        • As Tripwires
      • Endpoint Firewalls

        • Pivot Detection
    • Scaling Endpoint Log Collection/Storage/Analysis
      • How to Enable Logs that Matter
      • Designing for Analysis Rather than Log Collection
      • Auditing Policies on Windows and Linux
      • Sysmon
      • Auditd
    • MITRE ATT&CK Content Engineering
      • Anomalies vs Signatures
      • SIGMA Generic Signatures
      • How SIGMA Works
      • Conversion of Signatures to Alert Queries
      • Sigma2Attack
      • Anomaly Identification vs Real-Time Alerts
    • Tripwire and Red Herring Defenses
      • Honeynets, Honeypots, and Honeytokens
      • Single Access Detection Techniques
      • Proactive Defenses to Change Attacker Tool Behaviors
      • Increasing Prevention Capabilities while Adding Solid Detection
  • Overview

    The course culminates in a team-based Design-and-Secure-the-Flag competition. Powered by NetWars, day six provides a full day of hands-on work applying the principles taught throughout the week. Your team will progress through multiple levels and missions designed to ensure mastery of the modern cyber defense techniques promoted throughout this course. Teams will assess, design, and secure a variety of computer systems and devices, leveraging all the knowledge, tools and skills obtained in class, as they defend Tyrell Corporation from the attack of the replicants.

    • Capstone - Design/Detect/Defend
      • Defensible Security Architecture
      • Assess Provided Architecture and Identify Weaknesses
      • Use Tools/Scripts to Assess the Initial State
      • Quickly/Thoroughly Find All Changes Made

GIAC Defensible Security Architecture

The GIAC Defensible Security Architect (GDSA) certification validates a practitioner's ability to design and implement a strategic combination of network-centric and data-centric controls to balance prevention, detection, and response capabilities.

  • Using network-centric and data-centric security strategies to architect a layered defense
  • Assessing existing technology implementations to improve prevention, detection, and response
  • Understanding and applying Zero Trust principles

More Certification Details

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

  • CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
  • CRITICAL: Apple systems using the M1/M2 processor line cannot perform the necessary virtualization functionality and therefore cannot in any way be used for this course.
  • BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
  • 8GB of RAM or more is required.
  • 40GB of free storage space or more is required.
  • At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.
  • Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
  • Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
  • Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
  • Download and install VMware Workstation Pro 16.2.X+ or VMware Player 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ or VMware Player 17.0.0+ (for Windows 11 hosts), or VMWare Fusion Pro 12.2+ or VMware Fusion Player 11.5+ (for macOS hosts) prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Also note that VMware Workstation Player offers fewer features than VMware Workstation Pro. For those with Windows host systems, Workstation Pro is recommended for a more seamless student experience.
  • On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
  • Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

If you have additional questions about the laptop specifications, please contact support.

Author Statement

"In our many years of experience assessing the security posture of organizations, responding to incidents, and ramping up security operations, we've seen the futility of trying to monitor and defend against modern adversaries when the architecture in place has not been designed with security in mind. Likewise, we've continually seen that organizations that suffer massive breaches and business disruption often focused their emphasis prior to the breach on perimeter protection and prevention mechanisms but lacked defensible security architecture.

"We've designed this course to address this gap. In six days filled with case studies, winning techniques, instructor-led demos, and plenty of hands-on labs (including a NetWars-based Defend-the-Flag challenge), students will learn how to design, build, and harden networks, infrastructure, and applications that can truly be called 'defensible.'

"As practitioners, we know that theory is not enough, so we've made sure that this class is focused on real-world implementations of network-centric, data-centric, and zero-trust security architecture mapped to best practices and standards, but also based on our many years of experience on what works and what doesn't. You'll find that this makes the content appropriate and relevant for the reality of a wide variety of organizations and roles."

- Justin Henderson and Ismael Valenzuela

"Every security professional should have the knowledge from SEC530. Ismael is very knowledgeable and humorous and conducts the remote lessons very well." - Frank Fu, SCB


This training showed how overall security posture of an organization can be improved. It helps connect the dots between different areas within security infrastructure.
Farruk Ali
SEC530 teaches you to defend and put mechanisms in place to secure the environment. The real life scenarios and examples were priceless. Hearing the stories from the trenches really made me feel like being able to apply
Omar Zaman
United Airlines
I just have to say, these labs are astonishingly well set up. They demonstrate exactly what's needed in very few steps. There's a lot of moving parts behind some of them but they are robust, and all in a small VM footprint. I've never seen any course lab environment executed so well.
Michael Curran
SEC530 is a great course for Blue Teams & Security Engineers. This is an evolution to the significance of good & practical defense approach in enterprises.
Bhupesh Roma
AXA Group

    Register for SEC530

    Prices below exclude applicable taxes and shipping costs. If applicable, these will be shown on the last page of checkout.