SEC598: Security Automation for Offense, Defense, and Cloud™

Overview

Section one lays the foundation for the remainder of the course by explaining overall security automation concepts and how they can be used within different environments and technology stacks. Concepts to be discussed include automation triggers, desired state configuration and security automation.

Exercises

• Lab 1.1: Red Team Exercise
• Lab 1.2: OS Hardening baselines with Ansible
• Lab 1.3: Linking Triggers to Automation Scripting
• Lab 1.4: Define Your First Automation Playbook

Topics

• Course Outline & Lab Setup:
  • Course Objective & Lab Environment
  • Why Security Automation Matters
  • Introducing GLOBEX Automation
• Security Architecture & Configuration
  • Current state of Enterprise Architecture
  • Security Engineering CI/CD Approach
  • Infrastructure as Code
  • Desired State Configuration
• Security Automation fundamentals:
  • Triggers for Automation
  • Automation Playbooks
  • How to apply SOAR and SOEL

Overview

Section two focuses on security task automation in your infrastructure and explains how security automation can be engineered with built-in scripting and configuration management tooling. We will analyze how PowerShell can be used for desired state configuration to detect and respond to system misconfigurations. We will also look at what you can achieve with infrastructure as code tooling and a variety of SOAR tools. Finally, we will discuss playbook design and development for automated incident handling and mitigation techniques.

Exercises

• PowerShell OS hardening
• Cloud Management with Terraform
• Deploying a Firing Range with Terraform
• Create a Tines Story
• Create an IOC malware analysis playbook

Topics

• Automate Security Hardening
  • PowerShell for Automation
  • PowerShell OS hardening
  • Configuration management tooling
  • Hardening with Ansible
  • Building firing ranges
  • Cloud Management with Terraform
• Security Orchestration and Automation
  • Security Automation with Python
  • Security Orchestration tools
  • SOAR playbook development

Overview

Sections one and two covered security automation based largely on on-premise technology stacks, so in section three we will move towards cloud native automation tooling. Attendees will gain an in-depth understanding of cloud native technologies used for security automation. We will zoom into blueprinting, compliance validation, and automated remediation by using real-world examples of cloud misconfigurations.

Exercises

• Lab 3.1: Detecting an Exposed Server with Azure Policy
• Lab 3.2: Creating Automated Actions in Azure with Sentinel and Logic Apps
• Lab 3.3: Cloud-Native IR for Compromised Systems
• Lab 3.4: Integrating AWS/Azure with Third-Party API

Topics

• Introduction to Cloud
  • Azure Basics
  • AWS Basics
• Microsoft Azure Automation
  • Azure Policy and Blueprinting
  • Detect exposed server with Azure Policy
  • Security monitoring and automation triggers
  • Create automated actions in Azure
  • How to automate within MS cloud environments
  • Logic App and Azure Function
  • Locking down an Azure Storage Account
• Amazon Web Services Automation
  • AWS Configuration
  • AWS Configuration Rule
  • Security monitoring via CloudWatch and CloudTrail
  • How to automate within AWS
  • Integrate AWS/Azure with 3rd party API

Overview

• In section four, we will use the automation techniques we learned in previous sections for offensive security automation activities. This section presents examples on how to automate offensive techniques used by real-world adversaries and goes on to explain how chaining attack techniques can be used to emulate these adversaries.

Exercises

• Lab 4.1: Configuring Atomic Red Team
• Lab 4.2: Fully Automating Adversary Techniques
• Lab 4.3: Using Caldera to Run a Breach Exercise
• Lab 4.4: Cloud Adversary Simulation with Automated Detections
• Lab 4.4: Adversary Emulation as Code using API, Tines, and Github

Topics

• Introduction
  • The history of Offensive Security
  • Introduction to Adversary Emulation & Purple Teaming
  • The MITRE ATT&CK Framework
• Emulating Adversary Tactics & Techniques
  • Adversary emulation tooling
  • Zooming in on Atomic Red Team
  • Configuring Atomic Red Team
  • Breach and Attack Simulation tools
  • Fully automate adversary technique
  • Chaining techniques and automate adversaries
  • Cloud Adversary Emulation
  • Using Caldera to run a breach exercise
  • AI-Powered Cyberattacks
• Chaos Engineering
  • Create your automated chaos
  • Adversary Emulation as Code using API, Tines, and Github

Overview

Section five focuses on defensive security controls and how we use automation to prevent, detect, and respond to security incidents. Students will gain an in-depth understanding of how attacks can be detected and how to enrich incidents to minimize false positives and automatically trigger responses.

Exercises

• Lab 5.1: Automated Triage and Analysis with Velociraptor and Timesketch
• Lab 5.2: Creating an Incident Response Playbook in PowerShell
• Lab 5.3: Creating an Incident Response Playbook using Tines
• Lab 5.4: Detecting a Specific APT with Known Techniques and Automating Security Controls to Detect and Respond to This Attack

Topics

• Introduction
  • History of defensive security
  • Focus of automation within defensive security
• Detection and Incident Response
  • Automating Defense In-Depth
  • Incident Response phases and where to automate
  • Incident Response Playbooks
  • Create an IR Playbook in PowerShell
• Automate Incident Response using Tines
  • Create an IR playbook using Tines
• Bringing it all together: Adversary emulation vs incident response
  • Detect a specific ATP with known techniques and automate security
  • Create an Adversary Emulation & Detection Playbook

Overview

The final course section is a capstone event where students can apply and reinforce all the skills they've learned in a friendly, competitive environment. The capstone is a full day of challenging hands-on work applying the principles taught throughout the course. Your team will progress through multiple levels and missions designed to ensure the presence of detection and defensive capabilities.

Topics

• Applying Previously Covered Security Controls In-depth
• Applying and fine-tuning detection capabilities and use automation to reduce false / positive ratio
• Configuration management tools
• Infrastructure as code templates
• Tines playbook development
• AWS Configuration rules & ARM templates.