Network Security 2020

Overview

This day starts with an introduction to the blue team, the mission of a SOC, and how to understand an organization's threat model and risk appetite. It is focused on top-down learning to explain the mindset of an analyst, the workflow, and monitoring tools used in the battle against attackers. Throughout this day, students will learn how SOC information management tools fit together, including incident management systems, threat intelligence platforms, SIEMs, and SOAR tools. We end the day describing the various groups of attackers, how their methods differ, and their motivations.

Overview

Day 2 begins the technical journey of understanding the environment. To defend a network, you must thoroughly understand its architecture and the impact that it will have on analysis. This day introduces the concepts of a modern organization's network traffic flow by dissecting a typical organization's network setup, the tools that contribute to security, and the features necessary for segmentation and monitoring. These modules ensure that students have a firm grasp on how network design affects their "view of the world" as an analyst.

After discussing the network, day 2 then goes in-depth on common network services. These sections provide a thorough, working explanation of the current and upcoming features of DNS, HTTP(S), SMTP, and more, with a focus on the most important points for analysts to understand. In each section there is a focus on understanding what normal data looks like, as well as the common fields and areas that are used to spot anomalous behavior. The goal will be to leave the day with the ability to quickly recognize common tricks used by attackers to turn these everyday services against us.

Overview

It is extremely difficult to succeed at cyber defense without knowing where and how your data is produced, so day 3 takes us down to the host, logging, and file level. Starting with a survey of common endpoint-based attack tactics, day 3 will orient students to the array of techniques that are used against their hosts. The first portion of the day will show how each step of the attack lifecycle aligns with typical defensive tools and what methods an organization can use to detect and prevent attacks on their endpoints.

To further prepare students for attack detection, these sections are followed by a thorough review of how Linux and Windows logging works. Reviewing logging capabilities gives students perspective on which logs will be present on any given system, where to find them, and how to interpret them. These sections cover high-importance log events and provide an in-depth explanation of how to interpret the most important Windows and Linux logs. The value of parsing and enriching logs is explained, as well as how SIEM log normalization and categorization works. These topics give a complete view of what happens from the moment a log is generated to when it shows up in our security tools.

Many new analysts struggle to understand how files are structured at a low level and therefore are hesitant when it comes to answering questions such as "could a file of type x be used for evil?" The final part of day 3 provides students with the concepts needed to reason through the answer, diving into files at the byte level. This section explains the difference between binary and text-based files, and what makes a file a valid document, PDF, executable, word document, or otherwise. It also explains file-based exploitation methods and the features and formats most seen in attacks. Concepts such as using strings, hashes, and file signatures are explained to show students how to quickly and accurately identify potentially malicious file samples. Students will finish this day understanding how different common file formats are identified, how they are typically weaponized, and how to quickly decide whether a given sample is likely to be malicious.

Overview

Now that the course has covered the ground required to understand the tools and data most frequently encountered by analysts, it's time to focus on the process of analysis itself. This day will focus on how the analysis process works and explain how to avoid the common mistakes and biases new analysts can slip into. To accomplish this, this day examines how our memory perception affects analysis and how cognitive biases cause us to fail to see what is right in front of us. The goal is to teach students not only how to think clearly and methodically, but also how to explain how they reached their conclusions in a way that can support future analysis.

In addition to analysis technique, this day covers both offensive and defensive mental models that are necessary to understand to perform high-quality analysis. Students will use these models to look at an alert queue and get a quick and intuitive understanding of which alerts may pose the biggest threat and which must be attended to first. Afterward, safe analysis techniques and analysis operational security concerns are discussed to ensure that analysts do not tip their hand to attackers during the investigation process. The day finishes discussing both how to react to identified intrusions and considerations for doing so as well as how to ensure high-quality documentation for incidents is produced and maintained. The goal is for students to leave this day better prepared to understand their alert queues, perform error-free investigation, and be able to choose the best response for any given attack situation.

Overview

Repetitive tasks, lack of empowerment or challenges, poorly designed manual processes - analysts know these pains all too well. While these are just some of the common painful experiences in day-to-day SOC work, they are also major contributing factors to unhappiness and burnout that can cause turnover in a SOC. Do things have to be this way? Of course not! But it will take some understanding and work on your part to do things differently.

This day focuses squarely on improving the efficiency and team enthusiasm for SOC work by tackling the most common problems head-on. Through process optimization, careful analytic design and tuning, and workflow efficiency improvements, we can eliminate many of these common pain points. This frees us from the repetitive work we loathe and allows us to focus on what we do best - analysis! Having the time for challenging and novel work leads to a virtuous cycle of growth and engagement throughout the SOC - and improving everyone's life in the process.

This day will focus on tuning your tools using clever analysis techniques and process automation to remove the monotonous and non-value-added activities from your day. It also covers containment activities including the containment techniques teams can use, and how to decide which option is best to halt a developing incident or infection. We'll wrap up the day with recommendations on skill growth, long-term career development, and how to get more involved in the cyber defense community.