Cyber Security Training at SANS Cyber Defense Initiative® Washington DC 2023

In this presentation, we'll explore an unpatched vulnerability within Windows, one that attackers can likely exploit to bypass your defenses. Through the lens of this attack, we'll address a significant question: "Are programming skills a requisite for excelling in the field of information security?"

Recent research indicates that approximately 20% of entry-level positions in information security demand proficiency in programming. Yet, the ongoing debate in online forums highlights the uncertainty surrounding the necessity of coding skills. Join me as we navigate through this discussion, examining the intricate relationship between coding expertise and achieving success in the realm of information security.

Wednesday, December 13 | 6:00 pm – 7:00 pm Eastern Standard Time (UTC-5)

Attendance Options: In-Person

Phishing is a common attack path for attackers. Phishing users is one of the predominant attacks that are still highly effective today. It relies on the ability of end users to make quick and rash decisions. It also relies on users being unable to determine a real email from a legitimate source from one that is illegitimate. Understanding how to mount a phishing campaign is a key item many penetration testers should learn how to do.

In this workshop, we will cover how you can model what an App Consent attack looks like, how it operates, and how you, as the attacker, can abuse it. Are you a manager, director, or nontechnical people manager? This workshop is still for you!

This workshop will also help guide you with building preventative measures to protect your users. This is THE workshop to take if you want to simulate App Consent attacks. This is a sneak preview directly from the updated SEC588: Cloud Penetration Testing, so even if you have taken the course and want to see some additional material in the new versions, you’ll want to attend.

Wednesday, December 13 | 6:45 pm - 8:45 pm Eastern Standard Time (UTC-5)

Prior to the workshop, please create an Azure AD Tenant -

1. To create an Entra ID Tenant (Azure AD Tenant), create an Azure Portal account: https://azure.microsoft.com/en-us/free. You may need to create an account using a non-work email account such as Outlook, live, or Gmail.

2. You will also need a valid phone number to call or text for user verification.

3. Once you have signed into the Azure Portal, you can look for the Azure AD (Entra ID) Portal by typing Microsoft Entra ID in the search bar.
4. Click on "Custom Domain Name," and you should now see: [custom].onmicrosoft.com; this will be your default domain in which you can now "Add a Custom Domain Name" or choose to stay on this domain name.

This completes the setup process.

Attendance Options: In-Person

Everybody is talking about supply chain security. But supply chains are more than parts, libraries, and APIs. They include people, and developers, to duct tape the parts into something that vaguely resembles functioning software. While developers often hide in their cubicles or home offices to seek safety in the shadows of large monitors, attackers have found them. They found them in IDA plugin stores, software package repositories, Stackoverflow, and in online gaming communities (even during work hours). Network defenders on the other hand have often ignored developers, not just because they are "weird", but because standard security solutions often interfere with their work and cause them to complain loudly. In this talk, you will learn about some of these attacks, and how to defend against them, and you will also learn some bad jokes about developers.

Friday, December 15 | 7:15 pm – 8:15 pm Eastern Standard Time (UTC-5)

Attendance Options: In-Person