FOR498A: Forensic Data Acquisition teaches the latest tools, digital container access techniques, and enterprise methodologies to identify, access, and preserve evidence across a vast range of devices, repositories, and non-traditional storage areas. Learn how to extract actionable intelligence in 90 minutes or less.

FOR572A: Lethal Network Forensics teaches the three primary sources of network-based evidence: full packet capture, NetFlow, and logs. Whether used together or separately, or in conjunction with host-based evidence or alone, they can provide critical insight into the actions an attacker has taken or continue to take in their victims' environment.

FOR585A: iOS Forensic Analysis teaches the proper handling and parsing skills needed to bypass locked iOS devices and correctly interpret the data, it delves into the iOS file system and discusses common areas containing files of evidentiary value. This course will prepare you to deal with the iOS device that will likely be a major component in a forensic investigation.

FOR610A: Introduction to Malware Analysis: Hands-on and Technical supercharges your incident response and forensics skills by learning key malware analysis tools and techniques. This practical, hands-on course builds upon your existing network, system and infoSec skills and teach you how to turn Windows and related malware inside out.

SANS SEC552 teaches students how to apply modern attack techniques, inspired by real-world bug bounty case studies. The course will teach pen testers how to discover and responsibly disclose tricky, logic-based application flaws that automated scanning tools do not reveal.

SEC554 will teach you the essential topics of blockchain and smart contract technology. The course takes a detailed look at the cryptography and transactions behind blockchain and provides the hands-on training and tools to deploy, audit, scan, and exploit blockchain and smart contract assets.

SEC580 will teach you how to apply the incredible capabilities of the Metasploit Framework in a comprehensive penetration testing and vulnerability assessment regimen. In this course, you will learn how Metasploit can fit into your day-to-day penetration testing assessment activities. You'll gain an in-depth understanding of the Metasploit Framework far beyond how to exploit a remote system. You'll also explore exploitation, post-exploitation reconnaissance, token manipulation, spear-phishing attacks, and the rich feature set of the Meterpreter, a customized shell environment specially created for exploiting and analyzing security flaws.

With SEC582, you will master performing packet analysis through TShark and learn how to solve real-world problems through 19 different labs, demos, and challenges. This is the most in-depth, hands-on packet analysis course available through SANS.

MGT415 will provide students with an introduction to thinking practically about risk management and teach the skills necessary to perform risk assessments. Not only will students learn foundational concepts of risk, but they will be given templates and tools that they can take back to their office immediately after class to perform risk assessments. Throughout the class students will learn introductory concepts of Governance, Risk, and Compliance (GRC) that they can use to mature their cyber security programs.

Learn the key lessons and the roadmap to build a mature awareness program that your workforce will love and that has an impact you can measure. Apply models such as the BJ Fogg Behavior Model, AIDA Marketing funnel, and Golden Circle, and learn about the Elephant vs. the Rider.

Managing a security operations center (SOC) requires a unique combination of technical knowledge, management skills, and leadership ability. Whether you are looking to build a new SOC or take your current team to the next level, MGT551 provides the right balance of these elements to super-charge your people, tools, and processes. In the new 5-day version of MGT551, we will help you build a high-performing SOC tailored to your organization and the threats it faces. We will give you the tools you need to manage an effective defense, measure progress towards your goals, and build out more advanced processes like threat hunting, active defense, and continuous SOC assessment. Best of all, each section is packed with hands-on labs, introductions to some of the industrys best free and open source tools, and an interactive game in which you will apply your new SOC management skills in real-world scenarios.

High profile cybersecurity attacks indicate that offensive attacks are overwhelming defensive measures. Even with managements attention to system penetrations and data loss, risky incidents are still costly to the enterprises balance sheets. Cybersecurity, privacy, and compliance people are asking, "How do we practically protect and defend our information and systems? How do we understand security frameworks and controls?" This course provides students an overview to the security controls and cybersecurity hygiene defined in the CIS Critical Controls.

There are three huge reasons why SEC474: Building a Healthcare Security and Compliance Program is important to all healthcare organizations. First, the problem of healthcare security is big and only getting bigger. Adversaries are becoming more sophisticated in their approach and more focused on healthcare because of the value of the sector's data. Healthcare organizations of all sizes and types are concerned that the lack of properly trained security professionals is resulting in IT systems that are insecure and that they may be out of compliance and face steep fines. Second, fines under the Health Insurance Portability and Accountability Act (HIPAA) are only getting bigger. Recent years have seen many million-dollar+ fines levied against healthcare organizations for not being "HIPAA Compliant." Recent trends show that this situation is getting worse, not better. Third, HIPAA compliance regulations don't actually tell you how to attain "HIPAA Compliance." With absent specific guidance, organizations are left to figure out these challenges on their own. This course has been designed to help organizations with concrete guidance to build a secure and compliant environment.

SEC534: Secure DevOps: A Practical Introduction explains the fundamentals of DevOps and how DevOps teams can build and deliver secure software. You will learn DevOps principles, practices, and tools and how they can be leveraged to improve the reliability, integrity, and security of systems.

This course teaches practical open-source intelligence (OSINT) analysis and automation techniques. You will learn tradecraft tips, tactics, techniques, and procedures based on real-world examples that will enable you to carry out in-depth OSINT analysis of groups, image and video verification, and OSINT operations security, as well as understand the foundations of automating OSINT with Python.

SEC541 is a cloud security course that looks at how attackers are attacking the Amazon Web Services (AWS) and Microsoft Azure environments, what their characteristics are, and how to detect them and investigate suspicious activity in your cloud infrastructure. Every day, the class will analyze a real world set of attacks, break down how it happened, how they would detect it in their environment, and then dive into the AWS and Azure services analyzing logs, behaviors and building analytics that the students can bring back to their own cloud infrastructure.

SEC564 is a 2-day intensive course that enables students to plan and manage Red Team Exercises, including building and executing a adversary emulation. Students will learn the tactics, techniques, and procedures (TTPs) used by the adversary to create an adversary emulation plan, leveraging MITRE ATT&CK, then emulate the adversary during multiple labs.

SEC583 is a one-day, lab-heavy course designed to teach the powerful skill of how to craft and manipulate packets through the use of many hands-on activities. This skill can be used to test policies, behaviors, and configurations and will also provide deeper understanding of TCP/IP and application protocols.

SEC584 will perform a deep dive into defending key infrastructure deployment components, focusing on containerization and orchestration exploits. Students will be thrust directly into detailed issues related to misconfiguration and known attack patterns and will learn how to properly harden and protect against these exploits.

Are you a Blue Teamer who has been asked to do more with less? Do you wish that you could detect and respond at the same pace as your adversaries who are breaking into and moving within the network? Blue Team Operations: Defensive PowerShell teaches deep automation and defensive capabilities using PowerShell. Come join us and learn how to automate everything from regular hardening and auditing tasks to advanced defenses. This course will provide you with skills for near real-time detection and response and elevate your defenses to the next level.