Amsterdam November 2020

Overview

Securing an infrastructure is a complex task of balancing business needs against security risks. With the discovery of new security vulnerabilities almost on a daily basis, there is always the potential for an intrusion. In addition to online intrusions, physical incidents like fires, floods, and crime all require a solid methodology for incident handling to be in place to get systems and services back online as quickly and securely as possible.

The first part of this course section looks at the invaluable Incident Handling Step-by-Step model, which was created through a consensus process involving experienced incident handlers from corporations, government agencies, and educational institutes and has been proven effective in hundreds of organizations. This section is designed to provide students with a complete introduction to the incident handling process, using the six steps (preparation, identification, containment, eradication, recovery, and lessons learned) one needs to follow to prepare for and deal with a computer incident.

The second part of this section examines from-the-trenches case studies to understand what does and does not work in identifying computer attackers. This section provides valuable information on the steps a systems administrator can take to improve the chances of catching and prosecuting attackers.

Overview

Seemingly innocuous data leaking from your network could provide the clue needed by an attacker to blow your systems wide open. This course section covers the details associated with reconnaissance and scanning, which are the first two phases of many computer attacks.

Your networks reveal an enormous amount of information to potential attackers. In addition to looking for information leakage and open-source intelligence (OSINT), attackers also conduct detailed scans of systems, scouring for openings to get through your defenses. To break into your network, they scope out targets of opportunity, such as weak DMZ systems and turnkey platforms, unsecured modems, or vulnerable Wi-Fi and proprietary wireless systems. Attackers are increasingly employing devious scanning techniques to target publicly accessible and internal systems, seeking opportunities to manipulate otherwise benign security policies designed to protect systems. Another very hot area in computer attacks involves detailed scanning and interrogation of Windows Active Directory domains, identifying and manipulating configuration policies to their significant advantage.

If you do not have the skills needed to understand these critical phases of an attack in detail, you will not be able to protect your network. Students who take this course and master the material will understand these attacks and the associated defenses.

It is imperative that you get written permission from the proper authority in your organization before using these tools and techniques on your organization's systems. You also need to advise your network and computer operations teams of your testing schedule.

Overview

Computer attackers are ripping our networks and systems apart in novel ways, while constantly improving their techniques. This course section covers the third step of many hacker attacks: gaining access.

Attackers employ a variety of strategies to take over systems from the network level up to the application level. This section covers the attacks in depth, from the details of buffer overflow and common software flaw exploitation techniques to the latest in session hijacking of supposedly secure protocols. Additionally, you will get hands-on experience in running sniffers, exploiting common Windows networking vulnerabilities, using common tools for effective data shoveling, and bypassing host platform security endpoint tools.

Administrators need to get into the nitty-gritty of how the attacks and their associated defenses work if they want to effectively defend against these invasions. For each attack, the course explains the vulnerability, how various tools exploit it, the signature of the attack, and how to harden the system or application against the attack. Students who sign an ethics and release form are issued a USB drive containing the attack tools examined in class.

It is imperative that you get written permission from the proper authority in your organization before using these tools and techniques on your organization's system. You also need to advise your network and computer operations teams of your testing schedule.

Overview

This course section starts out by covering one of the attackers' favorite techniques for compromising systems: password attacks. We will analyze multiple attack techniques applied against password storage and selection, including password guessing and spray attacks, password cracking, and modern password mask recovery techniques. Then the course turns to another vital area often exploited by attackers: web applications. Because most organizations' homegrown web applications do not get the security scrutiny of commercial software, attackers exploit these targets using SQL injection, cross-site scripting, session cloning, and a variety of other mechanisms discussed in detail.

The course also presents a taxonomy of bots and malware attacks, including modern-day cryptomining and cryptolocker attacks. We conclude the day with a look at nasty denial-of-service attacks, illustrating how attackers can stop services or exhaust resources, as well as what you need to do to prevent their nefarious deeds.

Once intruders have gained access into a system, they want to keep that access, preventing pesky system administrators and security personnel from detecting their presence. To fool you, attackers install backdoor tools and manipulate existing software on a system to maintain access to the machine on their own terms. To defend against these attacks, you need to understand how attackers alter systems to discover the sometimes-subtle hints associated with system compromise. This course arms you with the understanding and tools you need to defend against attackers' maintaining access and covering their tracks.

It is imperative that you get written permission from the proper authority in your organization before using these tools and techniques on your organization's system. You also need to advise your network and computer operations teams of your testing schedule.

Overview

This course section covers the fourth and fifth steps of many hacker attacks: maintaining access and covering their tracks. Computer attackers install backdoors, apply rootkits, and sometimes even manipulate the underlying kernel itself to hide their nefarious deeds. Each of these categories of tools requires specialized defenses to protect the underlying system. In this course, we will analyze the most commonly used malicious code specimens and explore future trends in malware designed to obscure ab attacker's presence and disguise attribution.

Attackers also cover their tracks by hiding files, sniffers, network usage, and active processes. Additionally, they manipulate sophisticated network protocols to evade threat hunting systems and thwart investigations. Finally, attackers often alter system logs on UNIX and Windows systems, all in an attempt to make the compromised system appear normal. This course gives you the tools and techniques you need to detect and respond to these activities on your computers and network.

It is imperative that you get written permission from the proper authority in your organization before using these tools and techniques on your organization-s system. You also need to advise your network and computer operations teams of your testing schedule.

Overview

Over the years, the security industry has become smarter and more effective in stopping hackers. Unfortunately, hacker tools are becoming smarter and more complex. One of the most effective methods to stop the enemy is to actually test the environment with the same tools and tactics an attacker might use against you.

This workshop lets you put what you have learned over the past week into practice. You will be connected to one of the most hostile networks on earth. This network simulates the Internet and allows students to try actual attacks against live machines and learn how to protect against these attacks. The workshop will supplement the classroom training that students have already received and give them flight time with the attack tools to better understand how they work. The instructor will provide guidance on exactly what is happening as exploits and defensive measures are running. As students work on various exploits and master them, the environment will become increasingly difficult, so students will have to master additional skills in order to successfully complete the exercises.

Additionally, students can participate in the workshop's Capture-the-Flag event. By penetrating systems, discovering subtle flaws, and using puzzle-solving techniques, you can test the skills you have built over the week in this engaging contest. The Capture-the-Flag victors will win the coveted SEC504 challenge coin.