Network Security 2020

More businesses than ever are moving sensitive data and shifting mission-critical workloads to the cloud. And not just one cloud service provider (CSP) - research shows that most enterprises have strategically decided to deploy a multi-cloud platform, including Amazon Web Services, Azure, Google Cloud, and others.

Organizations are responsible for securing their data and mission-critical applications in the cloud. The benefits in terms of cost and speed of leveraging a multi-cloud platform to develop and accelerate delivery of business applications and analyze customer data can quickly be reversed if security professionals aren't properly trained to secure the organization's cloud environment and investigate and respond to the inevitable security breaches.

The SANS SEC488: Cloud Security Essentials course will prepare you to advise and speak about a wide range of topics and help your organization successfully navigate both the security challenges as well as the opportunities presented by cloud services. Like foreign languages, cloud environments have similarities and differences, and SEC488 covers all of the major CSPs.

We will begin by showing how your day-to-day operations will change due to the evolution of Cloud. Expect changes from the different responsibility models to the different CSP models of Infrastructure-as-a-Service, Platform-as-a-Service, and Software-as-a-Service. From there we'll move on to securing the cloud, managing risk, and addressing the challenges you may experience as you look to achieve a specific level of security assurance.

New technologies introduce new risks. This course will equip you to implement appropriate security controls in the cloud, often using automation to "inspect what you expect." Mature CSPs have created a variety of security services that can help customers use their products in a more secure manner, but nothing is a magic bullet. This course covers real-world lessons using security services created by the CSPs and open-source tools. Each course day features hands-on lab exercises to help students hammer home the lessons learned. We progressively layer multiple security controls in order to end the week with a functional security architecture implemented in the cloud.

SEC488: Cloud Security Essentials reinforces the training material via multiple hands-on labs each day of the course. Every lab is designed to impart practical skills that students can bring back to their organizations and apply on the first day back in the office. The labs go beyond the step-by-step instructions and provide the context of "why" the skill is important and instill insights as to why the technology works the way it does.

Highlights of what students will learn in SEC488 labs include:

• Accessing the web consoles of AWS, Azure, GCP, and Alibaba and launching virtual machines in select environment
• Performing a security assessment of a Software-as-a-Service offering
• Hardening and securing cloud environments and applications using security tools and services
• Hardening, patching, and securing virtual machine images, including SSH
• Using the command line interface (CLI) and simple scripts to automate work
• Preventing secrets leakage in code deployed to the cloud
• Using logs and security services to detect malware on a cloud virtual machine and perform preliminary file-system forensics
• Using Terraform to deploy a complete environment to multiple cloud providers.

SEC488 Lab Summary

• Lab 1.1 - Exploring the Web Consoles
• Lab 1.2 - Launching Virtual Machines in AWS and Azure
• Lab 1.3 - Exploring Platform-as-a-Service Offerings
• Lab 1.4 - High-Level Security Assessment of Box.com
• Lab 2.1 - Securing Console Access
• Lab 2.2 - Getting to Know IAM via the Command Line Interface
• Lab 2.3 - Using an Open-Source Tool to Audit an AWS Account
• Lab 2.4 - Log Service Exploration
• Lab 3.1 - Serverless Dynamic Analysis Security Testing
• Lab 3.2 - Adding a Break the Glass Account
• Lab 3.3 - Preventing Leakage of Secrets
• Lab 3.4 - Cloud Log Retrieval & Parsing
• Lab 3.5 - Data Protection
• Lab 4.1 - VPCs
• Lab 4.2 - Hardened Image Provisioning
• Lab 4.3 - Azure Security Center Exploration
• Lab 4.4 - Introduction to Terraform
• Lab 5.1 - Security Hub Compliance Assessment
• Lab 5.2 - Government Clouds
• Lab 5.3 - Multicloud Penetration Testing
• Lab 5.4 - Multicloud Forensics

You will be able to:

• Identify the risks and risk control ownership based on the deployment models and service delivery models of the various products offered by cloud service providers (CSPs).
• Evaluate the trustworthiness of CSPs based on their security documentation, service features, third-party attestations, and position in the global cloud ecosystem.
• Create accounts and use the services on any one the leading CSPs and be comfortable with the self-service nature of the public cloud. This includes finding documentation, tutorials, pricing, and security features.
• Articulate the business and security implications of a multi-cloud strategy.
• Secure access to the consoles used to access the CSP environments.
• Use command line interfaces to query assets and identities in the cloud environment.
• Use hardening benchmarks, patching, and configuration management to achieve and maintain an engineered state of security for the cloud environment.
• Evaluate the logging services of various CSPs and use those logs to provide the necessary accountability for events that occur in the cloud environment.
• Implement, configure, and secure certificate-based SSH authentication to virtual machines launched in the cloud.
• Configure the CLI and properly protect the access keys to minimize the risk of compromised credentials.
• Use basic Bash and Python scripts to automate tasks in the cloud.
• Configure cross-account role assumption, a best practice for AWS.
• Implement network security controls that are native to both AWS and Azure.
• Employ an architectural pattern to automatically create and provision patched and hardened virtual machine images to multiple AWS accounts.
• Use Azure Security Center to audit the configuration in an Azure deployment and identify security issues.
• Use Terraform to deploy a complete "infrastructure as code" environment to multiple cloud providers.
• Leverage the Cloud Security Alliance Cloud Controls Matrix to select the appropriate security controls for a given cloud network security architecture and assess a CSP's implementation of those controls using audit reports and the CSP's shared responsibility model.
• Use logs from cloud services and virtual machines hosted in the cloud to detect a security incident and take appropriate steps as a first responder according to a recommended incident response methodology.
• Perform a preliminary forensic file system analysis of a compromised virtual machine to identify indicators of compromise and create a file system timeline.

This course will prepare you to:

• Navigate your organization through the security challenges and opportunities presented by cloud services
• Identify the risks of the various services offered by cloud service providers (CSPs).
• Select the appropriate security controls for a given cloud network security architecture.
• Evaluate CSPs based on their documentation, security controls, and audit reports.
• Confidently use the services on any of the leading CSPs.
• Articulate the business and security implications of multiple cloud providers.
• Secure, harden, and audit CSP environments.
• Protect the access keys and secrets used in cloud environments.
• Use application security tools and threat modeling to assess the security of cloud-based web applications.
• Automatically create and provision patched and hardened virtual machine images.
• Deploy a complete "infrastructure as code" environment to multiple cloud providers.
• Leverage cloud logging capabilities to establish accountability for events that occur in the cloud environment.
• Prepare to detect and respond to security incidents in the cloud and take appropriate steps as a first responder.
• Perform a preliminary forensic file system analysis of a compromised virtual machi

With this course, you will receive:

• MP3 audio files of the complete course lectures
• Digital Download Package with supplementary content
• Cloud security services cheat sheet (AWS vs. Azure vs GCP)
• Electronic Courseware