Don't Miss: MacBook Air, Surface Pro 7, or $350 Off with SANS Online Training - Register Now!

Leadership & Cloud Training 2021 - Live Online

Virtual, US Eastern | Mon, Mar 29, 2021 - Fri, Apr 2, 2021

Get a 13" MacBook Air, a Microsoft Surface Pro 7, or Take $350 Off with ANY qualifying 5- or 6-Day Course through December 9.

View offer details for special codes to use during registration.

MGT551: Building and Leading Security Operations Centers New

Mon, March 29 - Tue, March 30, 2021

 Watch a free preview of this course

Course Syllabus  ·  12 CPEs  ·   Lab Requirements
Instructor: John Hubbard  ·  Price: 2,800 USD

Are you looking to build, grow, or sharpen your cyber defense team? If so, the new MGT551: Building and Leading Security Operations Centers course is for you. MGT551 is a highly focused two-day crash course in planning, organizing, and improving your security operations. Throughout this course students can expect to learn key factors for success in managing a Security Operations Center (SOC), including:

  • Collecting the most important logs and network data
  • Creating playbooks and using case organization and storage
  • Using threat intelligence to focus your budget and detection efforts
  • Threat hunting and active defense strategies
  • Efficient alert triage and investigation workflow
  • Incident response planning
  • Choosing metrics and goals to improve the SOC
  • Team member hiring, training, retention, and prevention of burnout
  • SOC assessment through purple team testing and adversary emulation

While this course is focused on management and leadership, it is by no means theory only. Throughout the two days of instruction students will work on six hands-on exercises covering everything from playbook implementation to use case database creation, attack and detection capability prioritization and visualization, and purple team planning, execution, and reporting. Attendees will leave with a framework for understanding where their SOC should be focusing its efforts, how to track and organize defensive capabilities, and how to drive, verify, and communicate SOC improvements.

HANDS-ON TRAINING:

  • Defining Your Assets and Adversaries
  • Developing and Implementing SOC Playbooks
  • Structuring, Documenting, and Organizing Use Cases
  • Prioritizing and Visualizing Attack Techniques and Security Controls
  • Creating, Classifying, and Communicating Your Metrics
  • Purple Team Assessment Planning, Execution, and Tracking

YOU WILL BE ABLE TO:

  • Collect the most important logs and network data
  • Create playbooks and use cases
  • Use threat intelligence to focus your budget and detection efforts
  • Implement threat hunting and active defense strategies
  • Develop efficient alert triage and investigation workflow
  • Create effective incident response processes
  • Implement metrics and goals to improve the SOC
  • Conduct effective team member hiring, training, and retention, and prevent burnout
  • Assess your SOC through purple team testing and adversary emulation

WHAT YOU WILL RECEIVE:

  • Custom distribution of the Linux Virtual Machine containing free open-source SOC tools
  • MP3 audio files of the complete course lecture
  • Electronic Courseware
  • A digital download package that includes the above and more

Course Syllabus


John Hubbard
Mon Mar 29th, 2021
9:00 AM - 12:15 PM ET
1:30 PM - 5:00 PM ET

Overview

MGT551 starts with the critical elements necessary to build your Security Operations Center: understanding your enemies, planning your requirements, making a physical space, building your team, and planning important data collection. Throughout this course section, students will learn how to build a strong foundation upon which an SOC can operate, including focusing defense on the most important users and data, and tailoring defense plans to high-risk threat groups. Through optimization of workflow, information organization, and data collection, you will learn how to ensure that your security operations will hit the ground running as efficiently as possible. Exercises show how to implement these concepts through threat group and asset profiling, playbook workflow creation and implementation, and the generation and organization of use cases for the SOC.

Exercises
  • Defining Your Assets and Adversaries
  • Developing and Implementing SOC Playbooks
  • Structuring, Documenting, and Organizing Use Cases

CPE/CMU Credits: 6

Topics

Introduction

  • What we are up against/industry surveys
  • The average SOC
  • What top-performing SOCs have in common
  • SOC trends
  • Class goals

SOC Functions

  • High-level SOC diagram
  • SOC functions
  • Core activities
  • Auxiliary functions

SOC Planning

  • Do you need a dedicated internal SOC?
  • What is and what is not a SOC?
  • Mission and purpose
  • Requirements
  • Standards and frameworks
  • Policies
  • Roles
  • Staffing levels
  • Constituency
  • Steering committee
  • Services/Capabilities
  • Charter

Building the SOC

  • Physical space
  • Analyst/SOC IT considerations
  • Protecting SOC data

SOC Tools and Technology

  • Foundational network and endpoint collection and detection technologies
  • "Next-gen" must-have capabilities
  • Advanced detection technologies
  • Analyst core toolset
  • Playbooks and SOAR

Team Creation, Hiring, and Training

  • Organizational charts
  • Choosing a tiered vs. tierless SOC
  • Building a dream team
  • Interviewing tips and techniques
  • Interviewing mistakes and avoiding bias
  • Training plans

Mental Models for SOC Operations

  • Ops Tempo and the OODA Loop
  • Threat modeling
  • MITRE ATT&CK/Kill Chain
  • Threat Intel - F3EAD
  • Pyramid of pain and analytic types
  • The SOC as an "infinite game"

Data Collection

  • The SOC data collection system
  • Open-source NSM and host-data tools
  • Collection issues
    • Tactical log collection
    • Audit policy flexibility
    • Most important data sources
    • How to collect data
    • Parsing, filtering, enrichment, and storage

Use Case Development and Storage

  • Analytic rule types
  • Analytic rule life cycle
  • Use case organization and storage

John Hubbard
Tue Mar 30th, 2021
9:00 AM - 12:15 PM ET
1:30 PM - 5:00 PM ET

Overview

The second day of MGT551 focuses on understanding and improving everyday SOC activities such as detection design, investigation and triage, threat hunting, active defense, and incident response. We'll look at all the exciting new tools in the blue team space that can improve your team in these areas. Additionally, we'll tackle common concerns such as employee retention and the prevention of burnout, as well as improvement measures such as analytic testing and false positive reduction, measurement and execution of SOC growth initiatives, adversary emulation, and purple team testing. Exercises include attack technique prioritization with MITRE ATT&CK Navigator, a guided exercise on how to define, derive, and track the most important metrics for your SOC, and a walk-through with examples of how to plan and track a purple team assessment to ensure your SOC is delivering on its goal of improving cyber defense and resiliency.

Exercises
  • Prioritizing and Visualizing Attack Techniques and Security Controls
  • Creating, Classifying, and Communicating Your Metrics
  • Purple Team Assessment Planning, Execution, and Tracking

CPE/CMU Credits: 6

Topics

Detection and Analytic Design

  • SOC threat detection systems
  • Analytic outcomes and tuning
  • Writing high-fidelity rules
  • Dealing with high-volume alerts
  • Risk-based scoring and alert aggregation

Analytic and Analysis Frameworks and Tools

  • Blue team knowledge standardization and upcoming tools
  • ATT&CK Navigator
  • Yara
  • Sigma
  • Jupyter notebooks
  • Detection testing labs

Threat Hunting

  • What is threat hunting and why is it needed?
  • Scheduling
  • Data quality
  • Hunting process and techniques
  • Hunting maturity model
  • Showing the value of threat hunting

Active Defense

  • What is active defense/deception?
  • Active defense techniques and goals
  • Tooling

Alert Triage and Investigation

  • Tiered vs. tierless SOC triage process
  • Where to triage alerts
  • Software for triage and desired features
  • Prioritization of alerts
  • Investigation issues and tactics
    • Structured analysis - brainstorming, ACH, externalization, decomposition

Incident Response (IR) Planning

  • IR policy, plans, and procedures
  • Staffing for IR
  • Communication guidelines and methods
  • IR go bags
  • Live IR - Guarding your credentials
  • Malware analysis sandboxes and analysis methods
  • Containment procedures
  • Eradication
  • Watch and learn
  • Recovery
  • Post-incident activity
  • Lessons learned

Staff Retention and Mitigation of Burnout

  • Cultivating intrinsic motivation in your team
  • SOC human capital model
    • Growth, skills, empowerment, and creativity
    • Automation, Ops efficiency, management/metrics
  • Burnout mitigation tactics for new and experienced analysts
  • Optimizing tasks for analyst growth
  • Performance management

Metrics, Goals, and Effective Execution

  • Daily Ops vs. initiatives
  • Metrics vs. KPIs. vs. OKRs
  • Selecting metrics
    • Metrics sampling rates
  • Selecting KPIs
    • Organizing operational measures
  • Creating OKRs
  • Successful execution
    • Metrics types
    • Goal setting
    • Acting on the right metrics
    • Scoreboards
    • Keeping a cadence of accountability

Analytic Testing and Adversary Emulation

  • Analytic testing
    • Analytic testing tools
    • Automated assessments
  • Penetration resting, red teaming, and adversary emulation
  • Purple team vs. red team execution and benefits
  • Purple teaming
    • Benefits
    • Methodology and execution
    • Reporting and tracking tools

Additional Information

Important! Bring your own system configured according to these instructions!

We ask that you do 5 things to prepare prior to class start. This early preparation will allow you to get the most out of your training. One of those five steps is ensuring that you bring a properly configured system to class. This document details the required system hardware and software configuration for your class. You can also watch a series of short videos on these topics at the following web link https://sansurl.com/sans-setup-videos.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

Your host operating system must be either the latest version of Windows 10, macOS 10.15.x or later, or Linux that also can install and run VMware virtualization products described below. You also must have 8 GB of RAM or higher for the VM to function properly in the class.

It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop.

In addition to having 64-bit capable hardware, AMD-V, Intel VT-x, or the equivalent must be enabled in BIOS/UEFI.

Please download and install either VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+ on your system prior to the beginning of class. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial on its website.

MANDATORY MGT551 SYSTEM REQUIREMENTS:

CPU: 64-bit 2.0+ GHz processor or higher-based system is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)

BIOS/UEFI: VT-x, AMD-V, or the equivalent must be enabled in the BIOS/UEFI

RAM: 8 GB (gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 8 GB of RAM or higher is mandatory)

Disk: 25 gigabytes of free disk space

Connectivity:

  • Wireless Ethernet 802.11 B/G/N/AC
  • USB-A ports or an adapter to use a USB-A thumb drive (version 3.0 compatibility highly recommended)

Software:

  • VMware Workstation, Workstation Player, or Fusion
  • The Linux virtual machine will be provided to students

Configuration:

Please verify before coming to class that you have the administrative permissions required to transfer a virtual machine from a USB drive to your hard disk and start it. Also verify that Windows Device Guard, DLP, or other host-based protections will not interfere with the USB transfer or VM startup. (This is a common issue with company-built PCs, so if you intend to bring a corporate laptop, please test this before the event.)

Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

If you have additional questions about the laptop specifications, please contact√¬†laptop_prep@sans.org.

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

This course is intended for those who are looking to build a Security Operations Center for the first time or improve the one their organization is already running.

Ideal student job roles for this course include:

  • Security Operations Center Managers
  • New Security Operations Team Members
  • Lead / Senior SOC Analysts
  • Technical CISOs and Security Directors

"The information was pertinent and current for the environment SOCs are facing today" - Christopher Elliot, Hulu

This course does not have any specific prerequisites, but it is suggested that students have some experience in an operational security role. SANS courses such as SEC450 or MGT512 will give students a solid base-level understanding of the concepts that will be discussed.

Author Statement

"Written to compliment my first SOC course (SEC450: Blue Team Fundamentals), MGT551 completes the security operations picture by introducing the best higher-level frameworks and organization tactics I've discovered throughout my career as a SOC analyst and manager for a large pharmaceutical company. By including hands-on application with state of the art open-source tools and methods for security operations, MGT551 delivers the complete package for SOC leaders. This course condenses years of knowledge and real-life experience with months of additional research to bring you the most important information to effectively and efficiently lead your security team to success.

As someone who has been the victim of less than ideal data collection and workflow, my goal with this course is to help ensure every organization's blue team runs at peak efficiency and capability, and no one has to suffer through repeating mistakes so commonly made within the industry. This course is the culmination of years of teaching, leading, and researching security operations and I am incredibly excited to bring it to the SANS community."

- John Hubbard

"Who can do it better than John? He explains things very clearly and is easy to listen to. His previous work experience sharing was insightful. Well done again!" - Muhammad Sulaiman, BSP Sdn Bhd